Filtered by vendor Rubyonrails Subscriptions
Total 129 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-21831 2 Debian, Rubyonrails 2 Debian Linux, Active Storage 2024-08-03 9.8 Critical
A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.
CVE-2022-3704 1 Rubyonrails 1 Rails 2024-08-03 3.5 Low
A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212319. NOTE: Maintainer declares that there isn’t a valid attack vector. The issue was wrongly reported as a security vulnerability by a non-member of the Rails team.
CVE-2023-25015 2 Clockwork Web Project, Rubyonrails 2 Clockwork Web, Rails 2024-08-02 6.5 Medium
Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
CVE-2023-22795 4 Debian, Redhat, Ruby-lang and 1 more 4 Debian Linux, Satellite, Ruby and 1 more 2024-08-02 7.5 High
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
CVE-2023-22792 2 Redhat, Rubyonrails 2 Satellite, Rails 2024-08-02 7.5 High
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
CVE-2023-22799 2 Redhat, Rubyonrails 2 Satellite, Globalid 2024-08-02 7.5 High
A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.
CVE-2023-22797 2 Actionpack Project, Rubyonrails 2 Actionpack, Rails 2024-08-02 6.1 Medium
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.
CVE-2024-32464 1 Rubyonrails 1 Rails 2024-08-02 6.1 Medium
Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
CVE-2024-28103 1 Rubyonrails 1 Rails 2024-08-02 5.4 Medium
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.