Replaced OSVDB-124991.yml with CVE-2015-20108.yml (#621)

Author: jasnow

gems/ruby-saml/CVE-2015-20108.yml

@@ -0,0 +1,28 @@
+---
+gem: ruby-saml
+osvdb: 124991
+cve: 2015-20108
+ghsa: r364-2pj4-pf7f
+url: https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217
+title: ruby-saml gem is vulnerable to XPath injection
+date: 2015-04-29
+description: |
+  xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby
+  allows XPath injection and code execution because prepared
+  statements are not used.
+
+  The lack of prepared statements allows for possibly command
+  injection, leading to arbitrary code execution.
+cvss_v2: 6.7
+cvss_v3: 9.8
+patched_versions:
+  - ">= 1.0.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-20108
+    - https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.0.0
+    - https://github.com/SAML-Toolkits/ruby-saml/pull/225
+    - https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448
+    - https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217
+    - https://www.mend.io/vulnerability-database/WS-2015-0036
+    - https://github.com/advisories/GHSA-r364-2pj4-pf7f