CVE-2023-25015

Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF...

CVE-2022-39281

fatfreecrm is a an open source, Ruby on Rails customer relationship management platform CRM. In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit c85a254 and will be...

CVE-2022-39232

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete...

CVE-2021-41275

spreeauthdevise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spreeauthdevise is subject to a CSRF vulnerability that allows user account...

CVE-2021-39900

Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs...

CVE-2020-26416

Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions =8.4 to =13.5 to =13.6 to 13.6.2...

CVE-2010-3299

The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...

CVE-2015-10083

A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basicauth of the file app/controllers/applicationcontroller.rb. The manipulation leads to improper authentication. This product does not use versioning. This is w...

CVE-2014-125033

A vulnerability was found in rails-cv-app. It has been rated as problematic. Affected by this issue is some unknown functionality of the file app/controllers/uploadedfilescontroller.rb. The manipulation with the input ../../../etc/passwd leads to path traversal: '../filedir'. The exploit has been...

CVE-2015-2179

The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments...

ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 on GA media (moderate)

ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 on GA media Announcement ID: openSUSE-SU-2025:15125-1 Rating: moderate Cross-References: CVE-2015-7578 CVE-2015-7579 CVE-2015-7580 CVE-2018-3741 CVE-2022-23517 CVE-2022-23518 CVE-2022-23519 CVE-2022-23520 CVE-2022-32209 CVSS scores: CVE-2018-3741 SUS...

OPENSUSE-SU-2025:15117-1 ruby3.4-rubygem-jquery-rails-4.6.0-1.7 on GA media

These are all security issues fixed in the ruby3.4-rubygem-jquery-rails-4.6.0-1.7 package on the GA media of openSUSE Tumbleweed...

CVE-2025-46727 vulnerabilities

Vulnerabilities for packages: ruby3.4-rack, ruby3.2-rails, ruby4.0-rack, ruby3.4-rails, ruby3.2-rack, gitlab-rails-ce, logstash, ruby3.3-rack, ruby3.3-rails...

Rails Config File Detected

A Ruby on Rails configuration file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks. No source data...

📄 Ruby on Rails Cross Site Request Forgery

Ruby on Rails appears to include a one time pad for cross site request forgery protections to the user, making it possible to forge valid tokens. Good morning. All current versions and all versions since the 2022/2023 "fix" to the Rails cross-site request forgery CSRF protections continue to be...

GHSA-5W6V-399V-W3CC vulnerabilities

Vulnerabilities for packages: ruby3.4-rails...

GHSA-5W6V-399V-W3CC vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails, ruby3.3-rails...

CVE-2024-46986

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9.

Summary There are vulnerabilities in the Ruby On Rails component used by IBM License Metric Tool. Vulnerability Details CVEID:CVE-2024-47887 DESCRIPTION: railsis vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in HTTP Token authentication in Action...

The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications allows attackers to perform cross-site scripting attacks.

The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications is related to improper elimination of input data during web page generation. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...