RO
Product
Ruby ON Rails
49
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 4Medium 3Low 1
Watch
Add Ruby ON Rails to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2009-2422 | 9.8 | Jul 10 | The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that… Affected: before 2.3.3 |
| CVE-2017-17920 | 8.1 | Dec 29 | SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter Affected: through 5.1.4 |
| CVE-2017-17919 | 8.1 | Dec 29 | SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter Affected: through 5.1.4 |
| CVE-2016-0751 | 7.5 | Feb 16 | actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before… Affected: through 3.2.22; 4.0.10; 4.0.11; 4.0.11.1; 4.0.12; 4.0.13; +2 more |
| CVE-2016-2098 | 7.3 | Apr 7 | Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's… Affected: through 3.2.22.1; 4.1.14.1 |
| CVE-2016-6316 | 6.1 | Sep 7 | Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject… Affected: 3.0.4; 3.2.14; 3.2.14; 3.2.14; 3.2.15; 3.2.15; +14 more |
| CVE-2016-2097 | 5.3 | Apr 7 | Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an… Affected: through 3.2.22.1; 4.1.14.1 |
| CVE-2015-7577 | 5.3 | Feb 16 | activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and… Affected: through 3.2.22; 4.0.10; 4.0.11; 4.0.11.1; 4.0.12; 4.0.13; +2 more |
| CVE-2015-7576 | 3.7 | Feb 16 | The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on… Affected: through 3.2.22; 4.0.10; 4.0.11; 4.0.11.1; 4.0.12; 4.0.13; +2 more |
| CVE-2015-3226 | – | Jul 26 | Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to… Affected: 3.2.14 |
| CVE-2014-7829 | – | Nov 18 | Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before… Affected: 3.0.4; 3.2.19; 3.2.20; 4.0.11 |
| CVE-2014-7818 | – | Nov 8 | Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before… Affected: 3.0.4; 3.2.19 |
| CVE-2014-3482 | – | Jul 7 | SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x… Affected: 2.3.17; 3.0.4 |
| CVE-2014-0082 | – | Feb 20 | actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render… Affected: through 3.2.16; 3.0.4; 3.2.14; 3.2.14; 3.2.14; 3.2.15; +1 more |
| CVE-2014-0081 | – | Feb 20 | Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before… Affected: through 3.2.16; 0.5.0; 0.5.5; 0.5.6; 0.5.7; 0.6.0; +11 more |
| CVE-2013-6417 | – | Dec 7 | actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active… Affected: through 3.2.15; 3.0.4; 3.1.11; 3.2.14; 3.2.14; 3.2.14; +2 more |
| CVE-2013-6415 | – | Dec 7 | Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before… Affected: through 3.2.15; 3.0.4; 3.1.11; 3.2.14; 3.2.14; 3.2.14; +2 more |
| CVE-2013-6414 | – | Dec 7 | actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory… Affected: through 3.2.15; 3.0.4; 3.1.11; 3.2.14; 3.2.14; 3.2.14; +2 more |
| CVE-2013-4491 | – | Dec 7 | Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and… Affected: through 3.2.15; 3.0.4; 3.1.11; 3.2.14; 3.2.14; 3.2.14; +2 more |
| CVE-2013-3221 | – | Apr 22 | The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input… Affected: 3.0.4 |
| CVE-2013-1857 | – | Mar 19 | The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and… Affected: through 2.3.17; 0.5.0; 0.5.5; 0.5.6; 0.5.7; 0.6.0; +7 more |
| CVE-2013-1856 | – | Mar 19 | The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before… Affected: 3.1.11 |
| CVE-2013-1855 | – | Mar 19 | The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12,… Affected: through 2.3.17; 0.5.0; 0.5.5; 0.5.6; 0.5.7; 0.6.0; +7 more |
| CVE-2013-1854 | – | Mar 19 | The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which… Affected: 2.3.17; 3.1.11 |
| CVE-2013-0277 | – | Feb 13 | ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes… Affected: 3.0.4 |
| CVE-2013-0333 | – | Jan 30 | lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML… Affected: 3.0.4 |
| CVE-2013-0156 | – | Jan 13 | active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of… Affected: before 2.3.15; 3.0.0 before 3.0.19; 3.1.0 before 3.1.10 |
| CVE-2013-0155 | – | Jan 13 | Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component… Affected: 3.0.0 before 3.0.19; 3.1.0 before 3.1.10 |
| CVE-2012-6496 | – | Jan 4 | SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary… Affected: through 3.0.17; 3.0.4 |
| CVE-2012-3465 | – | Aug 10 | Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and… Affected: through 3.0.16; 0.5.0; 0.5.5; 0.5.6; 0.5.7; 0.6.0; +6 more |
| CVE-2012-3464 | – | Aug 10 | Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before… Affected: through 3.0.16; 0.5.0; 0.5.5; 0.5.6; 0.5.7; 0.6.0; +6 more |
| CVE-2012-3463 | – | Aug 10 | Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8… Affected: 3.0.4 |
| CVE-2012-3424 | – | Aug 8 | The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7… Affected: 3.0.4 |
| CVE-2012-2695 | – | Jun 22 | The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in… Affected: through 3.0.13; 3.0.4 |
| CVE-2012-2694 | – | Jun 22 | actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter… Affected: through 3.0.13; 3.0.4 |
| CVE-2012-2661 | – | Jun 22 | The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where… Affected: 3.0.4 |
| CVE-2012-2660 | – | Jun 22 | actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter… Affected: 3.0.4 |
| CVE-2012-1099 | – | Mar 13 | Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before… Affected: 3.0.4 |
| CVE-2012-1098 | – | Mar 13 | Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or… Affected: 3.0.4 |
| CVE-2011-4319 | – | Nov 28 | Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on… Affected: 3.0.4 |
| CVE-2011-2932 | – | Aug 29 | Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x… Affected: 3.0.4 |
| CVE-2011-2931 | – | Aug 29 | Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before… Affected: 3.0.4 |
| CVE-2011-2930 | – | Aug 29 | Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before… Affected: 3.0.4 |
| CVE-2011-2929 | – | Aug 29 | The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle… Affected: 3.0.4 |
| CVE-2011-2197 | – | Jun 30 | The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe… Affected: 3.0.4 |
| CVE-2009-4214 | – | Dec 7 | Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script… Affected: through 2.1.2; 0.5.0; 0.5.5; 0.5.6; 0.5.7; 0.6.0; +5 more |
| CVE-2008-5189 | – | Nov 21 | CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL… Affected: through 2.0.4; 0.5.0; 0.5.5; 0.5.6; 0.5.7; 0.6.0; +5 more |
| CVE-2008-4094 | – | Sep 30 | Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters,… Affected: through 2.1.0; 0.5.0; 0.5.5; 0.5.6; 0.5.7; 0.6.0; +5 more |
| CVE-2006-4111 | – | Aug 14 | Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH… Affected: through 1.1.4; 0.5.0; 0.5.5; 0.5.6; 0.5.7; 0.6.0; +5 more |
Showing 49