Vulnerabilities (CVE)

Vendor filter

Rubyonrails Subscribe

Product filter

Ruby On Rails Subscribe

Filter

77 total CVE
CVE Vendors Products Updated CVSS
CVE-2014-3483 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 7.5
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute...
CVE-2015-7577 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 5.0
activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain...
CVE-2016-0751 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 5.0
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which...
CVE-2016-6316 2 Rubyonrails, Debian 3 Debian Linux, Ruby On Rails, Rails 2019-08-08 4.3
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used...
CVE-2014-7818 3 Rubyonrails, Novell, Opensuse 4 Ruby On Rails, Opensuse, Opensuse and 1 more 2019-08-08 4.3
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is...
CVE-2016-0753 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 5.0
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted...
CVE-2016-0752 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 5.0
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's...
CVE-2015-7576 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 4.3
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x...
CVE-2016-2097 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 5.0
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot...
CVE-2014-0130 2 Rubyonrails, Redhat 3 Ruby On Rails, Subscription Asset Manager, Rails 2019-08-08 4.3
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are...
CVE-2016-2098 2 Rubyonrails, Debian 3 Debian Linux, Ruby On Rails, Rails 2019-08-08 7.5
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
CVE-2015-7581 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 5.0
actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an...
CVE-2014-3514 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 7.5
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application...
CVE-2014-7829 3 Rubyonrails, Novell, Opensuse 4 Ruby On Rails, Opensuse, Opensuse and 1 more 2019-08-08 5.0
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is...
CVE-2015-3226 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 4.3
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is...
CVE-2015-3227 3 Rubyonrails, Novell, Opensuse 4 Ruby On Rails, Opensuse, Opensuse and 1 more 2019-08-08 5.0
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
CVE-2013-0155 2 Rubyonrails, Debian 3 Ruby On Rails, Debian Linux, Rails 2019-08-08 6.4
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass...
CVE-2013-0156 2 Rubyonrails, Debian 3 Rails, Ruby On Rails, Debian Linux 2019-08-08 7.5
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct...
CVE-2013-6414 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 5.0
actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads...
CVE-2012-6497 1 Rubyonrails 2 Ruby On Rails, Rails 2019-08-08 5.0
The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in...