Command Injection

rails-routes-to-json is vulnerable to command injection. The vulnerability exists due to improper input sanitization in the childprocess function, which allows an attacker to inject malicious commands into the system...

rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations

A Cross-site scripting vulnerability was found in rails-html-sanitizer. Certain configurations of rails-html-sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...

rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service

An inefficient Regular Expression vulnerability was found in rubygem rails-html-sanitizer. Certain configurations are susceptible to excessive backtracking, leading to a denial of service through CPU resource consumption...

rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations

A Cross-site scripting vulnerability was found in rails-html-sanitizer. Certain configurations of rails-html-sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...

rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting

A Cross-site scripting vulnerability was found in rails-html-sanitizer. When used in combination with Loofah since version 2.1.0, improper neutralization of data URIs may allow Cross-site scripting...

Rails 安全漏洞

Rails is a set of open source web application frameworks based on the Ruby language by the American Rails team. A security vulnerability exists in versions prior to Rails v6.1.7.3, which stems from insufficient cleansing of user-supplied data, that could allow a remote attacker to trick a victim...

RHEL 9 : pcs (RHSA-2023:1981)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1981 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: rubygem-rack: Denial ...

CVE-2023-27849

rails-routes-to-json v1.0.0 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...

CVE-2023-27849

rails-routes-to-json v1.0.0 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...

Remote code execution

rails-routes-to-json v1.0.0 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...

npm rails-routes-to-json 命令注入漏洞

npm rails-routes-to-json is a library from the US-based npm. A security vulnerability exists in npm rails-routes-to-json v1.0.0, which stems from the discovery of a remote code execution RCE vulnerability contained via the childprocess function...

CVE-2023-27849

CVE-2023-27849 affects rails-routes-to-json v1.0.0 and is described as a remote code execution (RCE) vulnerability triggered via the child_process function. Public entries consistently indicate network-based exploitation with high impact to confidentiality, integrity, and availability. No specifi...

CVE-2023-27849

rails-routes-to-json v1.0.0 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...

PT-2023-21374 · Unknown · Rails-Routes-To-Json

Name of the Vulnerable Software and Affected Versions: rails-routes-to-json version 1.0.0 Description: The issue is related to a remote code execution RCE vulnerability via the child process function. Recommendations: For rails-routes-to-json version 1.0.0, consider disabling the child process...

CVE-2023-27849

rails-routes-to-json v1.0.0 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...

GHSA-CQF3-VPX7-RXHW Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay

Impact A payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If t...

Cross-site Scripting (XSS)

Overview pay is a package for processing payments in Ruby on Rails apps Affected versions of this package are vulnerable to Cross-site Scripting XSS via the back parameter on a Stripe payment page. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” ...

Ruby on Rails: Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability.

An incorrect handling of certain characters passed to the redirection functionality in Rails could lead to a single-click XSS vulnerability. This vulnerability allowed an attacker to control the href attribute in the HTML response and serve an XSS payload by preventing the redirect. The...

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay

Impact A payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If t...

CVE-2023-30614

Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL...