Vulnerabilities (CVE)

Vendor filter

Rubyonrails Subscribe

Filter

89 total CVE
CVE Vendors Products Updated CVSS
CVE-2018-16477 1 Rubyonrails 2 Active Storage, Rails 2019-05-17 4.3
A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline....
CVE-2018-16476 2 Rubyonrails, Redhat 3 Active Job, Rails, Cloudforms 2019-05-17 5.0
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This...
CVE-2019-5419 3 Rubyonrails, Debian, Redhat 3 Rails, Debian Linux, Cloudforms 2019-05-13 7.8
There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.
CVE-2019-5418 3 Rubyonrails, Debian, Redhat 3 Rails, Debian Linux, Cloudforms 2019-05-13 5.0
There is a File Content Disclosure vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
CVE-2019-5420 2 Rubyonrails, Debian 2 Rails, Debian Linux 2019-05-10 7.5
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails...
CVE-2013-1854 2 Rubyonrails, Redhat 2 Enterprise Linux, Ruby On Rails 2019-04-22 5.0
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted...
CVE-2013-1855 2 Rubyonrails, Redhat 2 Enterprise Linux, Ruby On Rails 2019-04-22 4.3
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline)...
CVE-2013-1857 2 Rubyonrails, Redhat 2 Enterprise Linux, Ruby On Rails 2019-04-22 4.3
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon)...
CVE-2014-7819 2 Rubyonrails, Sprockets Project 2 Ruby On Rails, Sprockets 2018-12-18 5.0
Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x...
CVE-2013-0156 2 Rubyonrails, Debian 3 Rails, Ruby On Rails, Debian Linux 2018-12-06 7.5
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct...
CVE-2013-0155 2 Rubyonrails, Debian 2 Ruby On Rails, Debian Linux 2018-12-06 6.4
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass...
CVE-2014-0081 4 Opensuse Project, Rubyonrails, Redhat and 1 more 5 Enterprise Linux, Ruby On Rails, Opensuse and 2 more 2018-10-30 4.3
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or...
CVE-2014-7829 3 Rubyonrails, Novell, Opensuse 3 Ruby On Rails, Opensuse, Opensuse 2018-10-30 5.0
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is...
CVE-2014-7818 3 Rubyonrails, Novell, Opensuse 3 Ruby On Rails, Opensuse, Opensuse 2018-10-30 4.3
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is...
CVE-2015-3227 3 Rubyonrails, Novell, Opensuse 3 Ruby On Rails, Opensuse, Opensuse 2018-10-30 5.0
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
CVE-2015-1840 4 Rubyonrails, Fedoraproject, Novell and 1 more 5 Jquery-ujs, Fedora, Jquery-rails and 2 more 2018-10-30 5.0
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to...
CVE-2006-4112 1 Rubyonrails 1 Ruby On Rails 2018-10-17 7.5
Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of...
CVE-2016-6317 1 Rubyonrails 1 Ruby On Rails 2018-08-13 5.0
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query...
CVE-2016-6316 2 Rubyonrails, Debian 2 Debian Linux, Ruby On Rails 2018-08-13 4.3
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used...
CVE-2018-3741 1 Rubyonrails 1 Html Sanitizer 2018-04-23 4.3
There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these...