CVE-2016-2098

CVE-2016-2098 Action Pack no Ruby on Rails anterior a 3.2.22.2, 4.x anterior a 4.1.14.2 e 4.2.x anterior a 4.2.5.2 permite que atacantes remotos executem código Ruby arbitrário ao explorar o uso irrestrito do método render por uma aplicação RCE https://nvd.nist.gov/vuln/detail/CVE-2016-2098 Uso g...

CVE-2016-2098

CVE-2016-2098 Ruby on Rails में Action Pack, 3.2.22.2 से पहले, 4.x 4.1.14.2 से पहले, और 4.2.x 4.2.5.2 से पहले के संस्करणों में, दूरस्थ हमलावरों को render विधि के अनियंत्रित उपयोग का लाभ उठाकर मनमाना Ruby कोड निष्पादित करने की अनुमति देता है। वर्ग इनपुट सत्यापन त्रुटि क्रेडिट Tobias Kraze makandra...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails vor 3.2.22.2, 4.x vor 4.1.14.2 und 4.2.x vor 4.2.5.2 erlaubt es Remote-Angreifern, beliebigen Ruby-Code auszuführen, indem sie die uneingeschränkte Nutzung der render-Methode der Anwendung ausnutzen. Ressourcen https://vulners.com/cve/CVE-2016-2098...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails prima della versione 3.2.22.2, 4.x prima della 4.1.14.2 e 4.2.x prima della 4.2.5.2 consente a un attaccante remoto di eseguire codice Ruby arbitrario sfruttando l'uso illimitato del metodo render da parte dell'applicazione...

name_reverser

== Benvenuto in Rails Rails è un framework per applicazioni web che include tutto il necessario per creare applicazioni web basate su database secondo il pattern Model-View-Control. Questo pattern divide la view chiamata anche presentazione in template "stupidi" che sono principalmente responsabi...

Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

VulnCheck KEV: CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

K000162741: Ruby on Rails Action Pack vulnerability CVE-2026-66066

Security Advisory Description Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation...

Arbitrary File Read

Action Pack Active Storage is vulnerable to Arbitrary File Read. The vulnerability is due to unsafe libvips operations being permitted on untrusted image uploads, allowing attackers to craft malicious images that read arbitrary files accessible to the Rails process and expose sensitive applicatio...

CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

UBUNTU-CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

EUVD-2026-51270

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-66066

CVE-2026-66066 affects Ruby on Rails with Active Storage using libvips. In vulnerable releases (prior to fixed versions on each line), Active Storage does not disable unsafe libvips operations during image processing, allowing an unauthenticated attacker uploading crafted images to read arbitrary...

CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

Astra Linux – Vulnerability in Rails

Action Pack is a framework for handling and responding to web requests. Under certain circumstances, response bodies may not be closed properly. If a response does not notify the system of a close operation, ActionDispatch::Executor will not know to reset the thread local state for the next...

Astra Linux – Vulnerability in Rails

The Actionpack Ruby gem versions prior to 6.1.3.2, 6.0.3.7, 5.2.4.6, and 5.2.6 have a possible denial-of-service vulnerability in the Token Authentication logic of the Action Controller, due to overly permissive regular expressions. Affected code uses authenticateorrequestwithhttptoken or...

Astra Linux – Vulnerability in Rails

An XSS vulnerability exists in Action Pack versions = 5.2.0 and 5.2.0, which could allow an attacker to bypass the Content Security Policy and generate non-HTML responses...

RHCOS 6 : Ruby on Rails (RHSA-2013:0153)

The remote Red Hat Enterprise Linux CoreOS 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0153 advisory. - rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack CVE-2013-0156 Note that Nessus has not tested for this...

Linux Distros Unpatched Vulnerability : CVE-2026-33167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does no...