RA
Product
Rails
On CISA KEVExploited in the wild
118
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 23Medium 27Low 1
Watch
Add Rails to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-26144 | 5.3 | Feb 27 | Rails is a web-application framework Affected: 5.2.0 before 6.1.7.7; 7.0.0 before 7.1.0 |
| CVE-2016-2097 | 5.3 | Apr 7 | Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.1; +34 more |
| CVE-2016-0753 | 5.3 | Feb 16 | Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which… Affected: 4.1.0 before 4.1.14.1; 4.2.0 before 4.2.5.1; 5.0.0 |
| CVE-2015-7577 | 5.3 | Feb 16 | activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.1; +34 more |
| CVE-2020-8166 | 4.3 | Jul 2 | A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the… Affected: before 5.2.4.3; 6.0.0 before 6.0.3.1 |
| CVE-2015-7576 | 3.7 | Feb 16 | The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.1; +34 more |
| CVE-2015-3227 | – | Jul 26 | The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +5 more |
| CVE-2015-3226 | – | Jul 26 | Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to… Affected: 3.0.0; 3.1.0; 3.2.0; 3.2.1; 3.2.2; 3.2.3; +24 more |
| CVE-2014-7829 | – | Nov 18 | Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2014-3916 | – | Nov 16 | The str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string Affected: 1.9.3; 2.0.0; 2.1.0 |
| CVE-2014-7818 | – | Nov 8 | Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2014-3514 | – | Aug 20 | activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.1; +22 more |
| CVE-2014-3483 | – | Jul 7 | SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.1; +18 more |
| CVE-2014-3482 | – | Jul 7 | SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x… Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.1; 2.0.2; 2.0.4; +34 more |
| CVE-2014-0082 | – | Feb 20 | actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2014-0081 | – | Feb 20 | Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before… Affected: 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.4.1; 0.10.0; +34 more |
| CVE-2014-0080 | – | Feb 20 | SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.1; +5 more |
| CVE-2013-6417 | – | Dec 7 | actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2013-6416 | – | Dec 7 | Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers… Affected: through 4.0.1; 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.1 |
| CVE-2013-6415 | – | Dec 7 | Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2013-6414 | – | Dec 7 | actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory… Affected: through 4.0.1; 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.1; +34 more |
| CVE-2013-4491 | – | Dec 7 | Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and… Affected: through 4.0.1; 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.1; +34 more |
| CVE-2013-4389 | – | Oct 17 | Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to… Affected: 3.0.0 before 3.2.15 |
| CVE-2013-3221 | – | Apr 22 | The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input… Affected: 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.9; +34 more |
| CVE-2013-1857 | – | Mar 19 | The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and… Affected: 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.4.1; 0.10.0; +34 more |
| CVE-2013-1856 | – | Mar 19 | The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before… Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; +34 more |
| CVE-2013-1855 | – | Mar 19 | The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12,… Affected: 3.2.0; 3.2.0; 3.2.0; 3.2.1; 3.2.2; 3.2.2; +34 more |
| CVE-2013-1854 | – | Mar 19 | The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which… Affected: 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.9; +34 more |
| CVE-2013-0277 | – | Feb 13 | ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2013-0276 | – | Feb 13 | ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify… Affected: 3.2.0; 3.2.0; 3.2.0; 3.2.1; 3.2.2; 3.2.2; +34 more |
| CVE-2013-0333 | – | Jan 30 | lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML… Affected: 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.9; +34 more |
| CVE-2013-0156 | – | Jan 13 | active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of… Affected: 3.2.0 before 3.2.11 |
| CVE-2013-0155 | – | Jan 13 | Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component… Affected: 3.2.0 before 3.2.11 |
| CVE-2012-6497 | – | Jan 4 | The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct… Affected: before 3.2.10 |
| CVE-2012-6496 | – | Jan 4 | SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary… Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; +34 more |
| CVE-2012-3465 | – | Aug 10 | Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and… Affected: 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.4.1; 0.10.0; +34 more |
| CVE-2012-3464 | – | Aug 10 | Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before… Affected: 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.4.1; 0.10.0; +34 more |
| CVE-2012-3463 | – | Aug 10 | Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2012-3424 | – | Aug 8 | The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2012-2695 | – | Jun 22 | The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2012-2694 | – | Jun 22 | actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2012-2661 | – | Jun 22 | The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2012-2660 | – | Jun 22 | actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2012-1099 | – | Mar 13 | Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2012-1098 | – | Mar 13 | Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2011-4319 | – | Nov 28 | Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2011-3187 | – | Aug 29 | The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a… Affected: 3.0.5 |
| CVE-2011-3186 | – | Aug 29 | CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and… Affected: 2.3.2; 2.3.3; 2.3.4; 2.3.9; 2.3.10; 2.3.11; +1 more |
| CVE-2011-2932 | – | Aug 29 | Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x… Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.1; 2.0.2; 2.0.4; +34 more |
| CVE-2011-2931 | – | Aug 29 | Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before… Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.1; 2.0.2; 2.0.4; +34 more |