Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

rubyonrails actionpack vulnerabilities and exploits

(subscribe to this query)
6.1
CVSSv3
CVE-2023-22797
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could a...
Rubyonrails RailsActionpack Project Actionpack
7.5
CVSSv3
CVE-2021-22885
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.
Rubyonrails RailsRubyonrails Actionpack Page-caching -Debian Debian Linux 10.0
6.1
CVSSv3
CVE-2022-22577
An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an malicious user to bypass CSP for non HTML like responses.
Rubyonrails ActionpackDebian Debian Linux 10.0
6.1
CVSSv3
CVE-2022-27777
A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an malicious user to inject content if able to control input into specific attributes.
Rubyonrails ActionpackDebian Debian Linux 10.0
9.8
CVSSv3
CVE-2020-8159
There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an malicious user to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.
Rubyonrails Actionpack Page-cachingDebian Debian Linux 9.0
NA
CVE-2013-1855
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails prior to 2.3.18, 3.0.x and 3.1.x prior to 3.1.12, and 3.2.x prior to 3.2.13 does not properly handle \n (newline) characters, which makes it easier...
Rubyonrails Rails 3.2.0Rubyonrails Rails 3.2.7Rubyonrails Rails 3.2.8Rubyonrails Rails 3.2.9Rubyonrails Rails 3.2.1Rubyonrails Rails 3.2.5Rubyonrails Rails 3.2.6Rubyonrails Rails 3.2.10Rubyonrails Rails 3.2.11Rubyonrails Rails 3.2.12Rubyonrails Rails 3.2.2Rubyonrails Rails 3.2.3Rubyonrails Rails 3.2.4Rubyonrails Ruby On Rails 0.8.0Rubyonrails Ruby On Rails 0.5.7Rubyonrails Ruby On Rails 0.7.0Rubyonrails Ruby On RailsRubyonrails Rails 1.2.4Rubyonrails Ruby On Rails 0.8.5Rubyonrails Ruby On Rails 0.6.0Rubyonrails Ruby On Rails 0.5.6Rubyonrails Ruby On Rails 0.9.0
NA
CVE-2013-1857
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails prior to 2.3.18, 3.0.x and 3.1.x prior to 3.1.12, and 3.2.x prior to 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes ...
Redhat Enterprise Linux 6.0Rubyonrails Rails 2.3.15Rubyonrails Rails 2.3.2Rubyonrails Rails 2.3.0Rubyonrails Rails 2.3.9Rubyonrails Rails 2.0.0Rubyonrails Ruby On RailsRubyonrails Rails 2.3.11Rubyonrails Rails 2.3.12Rubyonrails Rails 2.3.10Rubyonrails Rails 2.2.1Rubyonrails Rails 2.1.1Rubyonrails Rails 2.1.2Rubyonrails Rails 2.1.0Rubyonrails Rails 1.2.1Rubyonrails Rails 1.2.0Rubyonrails Rails 1.1.6Rubyonrails Rails 1.1.5Rubyonrails Rails 0.9.4.1Rubyonrails Rails 0.14.4Rubyonrails Ruby On Rails 0.5.0Rubyonrails Ruby On Rails 0.5.5
7.3
CVSSv3
CVE-2016-2098
Action Pack in Ruby on Rails prior to 3.2.22.2, 4.x prior to 4.1.14.2, and 4.2.x prior to 4.2.5.2 allows remote malicious users to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Debian Debian Linux 8.0Rubyonrails Rails 4.2.4Rubyonrails Rails 4.2.3Rubyonrails Rails 4.2.1Rubyonrails Rails 4.2.0Rubyonrails Rails 4.0.0Rubyonrails Rails 4.1.9Rubyonrails Rails 4.1.3Rubyonrails Rails 4.1.2Rubyonrails Rails 4.1.12Rubyonrails Rails 4.1.10Rubyonrails Rails 4.1.0Rubyonrails Rails 4.0.6Rubyonrails Rails 4.0.5Rubyonrails Rails 4.0.1Rubyonrails Ruby On RailsRubyonrails Rails 4.2.5Rubyonrails Rails 4.1.5Rubyonrails Rails 4.1.4Rubyonrails Rails 4.1.14Rubyonrails Rails 4.1.13Rubyonrails Rails 4.0.10
NA
CVE-2012-3463
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x prior to 3.0.17, 3.1.x prior to 3.1.8, and 3.2.x prior to 3.2.8 allows remote malicious users to inject arbitrary web script or HTML via the prompt field to the ...
Rubyonrails Rails 3.0.8Rubyonrails Rails 3.0.9Rubyonrails Rails 3.0.4Rubyonrails Rails 3.0.12Rubyonrails Rails 3.0.13Rubyonrails Rails 3.0.0Rubyonrails Rails 3.0.14Rubyonrails Rails 3.0.16Rubyonrails Rails 3.0.7Rubyonrails Rails 3.0.6Rubyonrails Rails 3.0.1Rubyonrails Rails 3.0.2Rubyonrails Rails 3.0.11Rubyonrails Rails 3.0.5Rubyonrails Rails 3.0.10Rubyonrails Ruby On Rails 3.0.4Rubyonrails Rails 3.0.3Rubyonrails Rails 3.1.0Rubyonrails Rails 3.1.2Rubyonrails Rails 3.1.6Rubyonrails Rails 3.1.4Rubyonrails Rails 3.1.1
NA
CVE-2012-3464
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails prior to 3.0.17, 3.1.x prior to 3.1.8, and 3.2.x prior to 3.2.8 might allow remote malicious users to inject arbitrary web script or HTML via vectors inv...
Rubyonrails Rails 3.0.14Rubyonrails Rails 3.0.8Rubyonrails Rails 3.0.7Rubyonrails Rails 3.0.5Rubyonrails Rails 3.0.6Rubyonrails Rails 3.0.2Rubyonrails Rails 3.0.1Rubyonrails Rails 3.0.10Rubyonrails Rails 3.0.12Rubyonrails Rails 3.0.11Rubyonrails Rails 3.0.0Rubyonrails Rails 2.1.1Rubyonrails Rails 2.1.2Rubyonrails Rails 2.0.0Rubyonrails Rails 2.3.3Rubyonrails Rails 1.2.4Rubyonrails Rails 1.2.3Rubyonrails Rails 1.1.3Rubyonrails Rails 1.1.2Rubyonrails Rails 0.9.2Rubyonrails Rails 0.9.3Rubyonrails Rails 3.0.9
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48693CVE-2024-30851CVE-2024-34460CVE-2024-2887localCVE-2024-27956remote code executionCVE-2024-34475privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook