Vulnerabilities (CVE)

Filtered by vendor Rubyonrails Subscribe
Total 116 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2013-4491 1 Rubyonrails 2 Rails, Ruby On Rails 2019-08-08 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
CVE-2013-6414 1 Rubyonrails 2 Rails, Ruby On Rails 2019-08-08 5.0 MEDIUM N/A
actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
CVE-2014-0081 4 Opensuse, Opensuse Project, Redhat and 1 more 6 Opensuse, Opensuse, Cloudforms and 3 more 2019-08-08 4.3 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
CVE-2014-0082 1 Rubyonrails 2 Rails, Ruby On Rails 2019-08-08 5.0 MEDIUM N/A
actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
CVE-2014-3482 1 Rubyonrails 2 Rails, Ruby On Rails 2019-08-08 7.5 HIGH N/A
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
CVE-2007-6077 1 Rubyonrails 2 Rails, Ruby On Rails 2019-08-08 6.8 MEDIUM N/A
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
CVE-2013-0277 1 Rubyonrails 2 Rails, Ruby On Rails 2019-08-08 10.0 HIGH N/A
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
CVE-2011-0448 1 Rubyonrails 1 Rails 2019-08-08 7.5 HIGH N/A
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
CVE-2011-3187 1 Rubyonrails 1 Rails 2019-08-08 4.3 MEDIUM N/A
The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
CVE-2011-0446 1 Rubyonrails 1 Rails 2019-08-08 4.3 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
CVE-2011-0447 1 Rubyonrails 1 Rails 2019-08-08 6.8 MEDIUM N/A
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
CVE-2011-0449 1 Rubyonrails 1 Rails 2019-08-08 7.5 HIGH N/A
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
CVE-2013-6416 1 Rubyonrails 1 Rails 2019-08-08 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
CVE-2014-0080 1 Rubyonrails 1 Rails 2019-08-08 6.8 MEDIUM N/A
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.
CVE-2016-6317 1 Rubyonrails 1 Rails 2019-08-08 5.0 MEDIUM 7.5 HIGH
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
CVE-2015-7578 1 Rubyonrails 2 Html Sanitizer, Rails 2019-08-08 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
CVE-2015-7580 1 Rubyonrails 2 Html Sanitizer, Rails 2019-08-08 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
CVE-2015-7579 1 Rubyonrails 2 Html Sanitizer, Rails 2019-08-08 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
CVE-2010-3933 1 Rubyonrails 1 Rails 2019-08-08 6.4 MEDIUM N/A
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
CVE-2009-3009 1 Rubyonrails 1 Rails 2019-08-08 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.