Ruby on Rails vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
47 matching records
- Medium6.1CVE-2021-22903 is listed by The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability..Check if you run itEPSS 1.23%Jun 11, 2021
- High7.5The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerabil…Check if you run itEPSS 2.87%Jun 11, 2021
- High7.5A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the or helper with untrusted user input.Check if you run itEPSS 4.05%May 27, 2021
- Medium6.1The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability.Check this weekEPSS 87.30%Feb 11, 2021
- High7.5The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability.Check if you run itEPSS 4.49%Feb 11, 2021
- Medium6.1In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another pa…Check this weekEPSS 66.99%Jan 6, 2021
- Medium6.5A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.Check if you run itEPSS 2.18%Jul 2, 2020
- Medium4.3A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the…Check if you run itEPSS 1.67%Jul 2, 2020
- High8.8The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the argument of a call to perform a RCE.Check this weekEPSS 82.47%Jul 2, 2020
- Medium6.5A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.Check if you run itEPSS 1.49%Jun 19, 2020
- Critical9.8A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCac…Check this weekEPSS 45.73%Jun 19, 2020
- High7.5A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently lea…Check if you run itEPSS 4.89%Jun 19, 2020
- High7.5A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length…Check if you run itEPSS 3.03%Jun 19, 2020
- Medium6.5The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.Check if you run itEPSS 1.14%Nov 12, 2019
- Critical9.8A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token.Check this weekEPSS 89.33%Mar 27, 2019
- High7.5There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause act…Check if you run itEPSS 8.44%Mar 27, 2019
- High7.5Rails Ruby on Rails Path Traversal VulnerabilityPatch nowKEVEPSS 98.51%Mar 27, 2019
- High7.5Ruby on Rails Directory Traversal VulnerabilityPatch nowKEVEPSS 95.54%Feb 15, 2016
- High7.5Ruby on Rails Directory Traversal VulnerabilityPatch nowKEVEPSS 53.70%May 7, 2014
- Unknownrubyonrails rails Improper Input ValidationPatch nowKEVEPSS 98.98%May 28, 2013
- High7.5CVE-2006-4112 is listed by inventory_high.Check if you run itEPSS 3.12%Aug 14, 2006
- High7.5CVE-2006-4111 is listed by inventory_high.Check if you run itEPSS 2.33%Aug 14, 2006