RA
Product
Rails
On CISA KEVExploited in the wild
118
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 23Medium 27Low 1
Watch
Add Rails to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2011-2930 | – | Aug 29 | Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before… Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.1; 2.0.2; 2.0.4; +34 more |
| CVE-2011-2929 | – | Aug 29 | The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2011-2197 | – | Jun 30 | The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe… Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.1; 2.0.2; 2.0.4; +34 more |
| CVE-2011-0449 | – | Feb 21 | actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +7 more |
| CVE-2011-0448 | – | Feb 21 | Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection… Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +7 more |
| CVE-2011-0447 | – | Feb 14 | Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier… Affected: 2.1.0; 2.1.1; 2.1.2; 2.2.0; 2.2.1; 2.2.2; +18 more |
| CVE-2011-0446 | – | Feb 14 | Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote… Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.1; 2.0.2; 2.0.4; +24 more |
| CVE-2010-3933 | – | Oct 28 | Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form… Affected: 2.3.9; 3.0.0 |
| CVE-2008-7248 | – | Dec 16 | Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request… Affected: 2.1.0; 2.1.1; 2.1.2; 2.2.0; 2.2.1 |
| CVE-2009-4214 | – | Dec 7 | Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script… Affected: 2.3.2; 2.3.3; 2.3.4; 0.9.1; 0.9.2; 0.9.3; +34 more |
| CVE-2009-3086 | – | Sep 8 | A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie… Affected: 2.1.0; 2.1.1; 2.1.2; 2.2.0; 2.2.1; 2.2.2; +2 more |
| CVE-2009-3009 | – | Sep 8 | Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing… Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.1; 2.0.2; 2.0.4; +8 more |
| CVE-2008-5189 | – | Nov 21 | CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL… Affected: 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.4.1; 0.10.0; +32 more |
| CVE-2008-4094 | – | Sep 30 | Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters,… Affected: 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.4.1; 0.10.0; +34 more |
| CVE-2007-6077 | – | Nov 21 | The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant,… Affected: 1.2.4 |
| CVE-2007-3227 | – | Jun 14 | Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web… Affected: 1.1.5 |
| CVE-2006-4112 | – | Aug 14 | Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is… Affected: 1.1.0; 1.1.1; 1.1.2; 1.1.3; 1.1.4 |
| CVE-2006-4111 | – | Aug 14 | Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH… Affected: 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.4.1; 0.10.0; +16 more |