EUVD-2020-0429

Malware in sbrugna...

EUVD-2017-0276

Malware in sbrugna...

EUVD-2024-3158

Malicious code in bioql PyPI...

Rails 安全漏洞

Rails is a set of open source web application frameworks based on the Ruby language from the US-based Rails team. A security vulnerability exists in versions prior to Rails 7.1.5.2, 7.2.2.2, and 8.0.2.1, which stems from the possibility that unescaped IDs may contain ANSI sequences, which could...

Internet Bug Bounty: [CVE-2024-54133] Possible Content Security Policy bypass in Action Dispatch

A vulnerability was discovered in the contentsecuritypolicy helper in Action Pack of Ruby on Rails. Carefully crafted inputs were able to inject new directives into the Content-Security-Policy CSP header, potentially leading to a bypass of the CSP and its protection against cross-site scripting X...

UBUNTU-CVE-2024-47888

Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plaintextforblockquotenode helper in Action Text. Carefully crafted text can cause the...

DEBIAN-CVE-2024-47887

Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For applications using HTTP Token authenticatio...

OESA-2024-1366 rubygem-activestorage security update

Attach cloud and local files in Rails applications. Security Fixes: Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cooki...

CVE-2024-0241

encodedid-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an extremely long "id" parameter...

Ruby on Rails: XSS when using `translate` in Action Controller (Rails 7.0, 7.1)

The vulnerability allows cross-site scripting XSS when using the translate method in Action Controller in Rails versions 7.0 and 7.1. The vulnerability was caused by the implementation of translate in Action Controller, which did not properly escape the values passed to it. The vulnerability was...

PT-2023-21673

Name of the Vulnerable Software and Affected Versions Rails versions prior to 7.0.5.1 Rails versions prior to 6.1.7.4 Description The redirect to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream...

SUSE CVE-2012-1099

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/formoptionshelper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain...

SUSE CVE-2012-3463

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/formtaghelper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the selecttag helper...

SUSE CVE-2015-7577

activerecord/lib/activerecord/nestedattributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass...

SUSE CVE-2019-5420

A remote code execution vulnerability in development mode Rails 5.2.2.1, 6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit...

SUSE CVE-2020-8164

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

SUSE CVE-2022-23634

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination ...

Clockwork Web 跨站请求伪造漏洞

Clockwork Web is the web interface for Clockwork. A security vulnerability exists in Clockwork Web versions prior to 0.1.2, which stems from a cross-site request forgery when using Rails versions prior to 5.2...

GHSA-P84V-45XJ-WWQJ ReDoS based DoS vulnerability in Action Dispatch

There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792. Versions Affected: = 3.0.0 Not affected: 3.0.0 Fixed Versions: 5.2.8.15 Rails LTS, 6.1.7.1, 7.0.4.1 Impact Specially crafted cookies, in...

PT-2022-16147 · Puma +6 · Puma +8

Name of the Vulnerable Software and Affected Versions: Rails versions prior to 7.0.2.2 Rails versions prior to 6.1.4.6 Rails versions prior to 6.0.4.6 Rails versions prior to 5.2.6.2 Puma versions prior to 5.6.2 Puma versions prior to 4.3.11 Description: Action Pack is a framework for handling an...