CVE-2024-21636

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the...

Cross site scripting

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the...

CVE-2024-21636 view_component Cross-site Scripting vulnerability

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the...

CVE-2024-21636 view_component Cross-site Scripting vulnerability

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the...

CVE-2024-21636

CVE-2024-21636 affects the ViewComponent framework for Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 allow cross-site scripting when a component defines a #call method and returns unescaped content, and when #output_postamble also returns unescaped content. The vulnerability applies to render...

CVE-2024-21636 view_component Cross-site Scripting vulnerability

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the...

PT-2024-18986 · View · View

Name of the Vulnerable Software and Affected Versions: view component versions prior to 3.9.0 and 2.83.0 Description: The view component framework for Ruby on Rails has a cross-site scripting issue that can impact anyone rendering a component directly from a controller with the view component gem...

Active Admin security vulnerability

Active Admin is Active Admin open source a Ruby on Rails framework . It is used to create the backend for website management. A security vulnerability exists in versions prior to Active Admin 3.2.0, which stems from a csv injection vulnerability in the file csvbuilder.rb...

Fedora 39 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2023-4f0bb4ff5e)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-4f0bb4ff5e advisory. Ruby on Rails security upgrade: https://rubyonrails.org/2023/8/22/Rails-Versions-7-0-7-2-6-1-7-6-have- been-released - incorrect file permissions on encrypte...

The vulnerability of the Ruby on Rails software platform lies in the redirection of URLs to an unreliable website, allowing attackers to redirect users to arbitrary URL addresses.

The vulnerability of the Ruby on Rails software platform is related to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses when using unvalidated external data in the redirectto handler...

The vulnerability of the Active Record component of the Ruby on Rails software framework lies in its ability to allow SQL code to be inserted through comments, enabling attackers to execute arbitrary code.

The vulnerability of the Active Record component of the Ruby on Rails software framework lies in the ability to inject SQL code through comments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2023-36465

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in t...

Security feature bypass

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in t...

CVE-2023-36465 Decidim has broken access control in templates

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in t...

CVE-2023-36465

Decidim (Ruby on Rails) has a broken access control in the templates module, allowing any logged-in user to access template management in the admin panel and to change, create, or delete survey templates. The issue is confirmed across multiple sources and has been patched in versions 0.26.8 and 0...

CVE-2023-36465 Decidim has broken access control in templates

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in t...

CVE-2023-36465 Decidim has broken access control in templates

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in t...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2023-28362) and could allow cross-site scripting.

Summary There is a vulnerability in the Ruby On Rails opens source component used by IBM License Metric Tool. The vulnerability could allow a remote attacker to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web...

Fedora: Security Advisory for rubygem-rails (FEDORA-2023-4f0bb4ff5e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: rubygem-rails-7.0.7.2-1.fc39

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration...