CVE-2024-21636

CVE-2024-21636 affects the ViewComponent framework for Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 allow cross-site scripting when a component defines a #call method and returns unescaped content, and when #output_postamble also returns unescaped content. The vulnerability applies to render...

PT-2024-18986 · View · View

Name of the Vulnerable Software and Affected Versions: view component versions prior to 3.9.0 and 2.83.0 Description: The view component framework for Ruby on Rails has a cross-site scripting issue that can impact anyone rendering a component directly from a controller with the view component gem...

CVE-2024-21636: Improper Neutralization of Input During Web Page Generation

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the...

Active Admin security vulnerability

Active Admin is Active Admin open source a Ruby on Rails framework . It is used to create the backend for website management. A security vulnerability exists in versions prior to Active Admin 3.2.0, which stems from a csv injection vulnerability in the file csvbuilder.rb...

Fedora 39 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2023-4f0bb4ff5e)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-4f0bb4ff5e advisory. Ruby on Rails security upgrade: https://rubyonrails.org/2023/8/22/Rails-Versions-7-0-7-2-6-1-7-6-have- been-released - incorrect file permissions on encrypte...

Ruby on Rails SQL Injection

The vulnerability of the Active Record component of the Ruby on Rails software framework lies in the ability to inject SQL code through comments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Ruby on Rails URL Redirection

The vulnerability of the Ruby on Rails software platform is related to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses when using unvalidated external data in the redirectto handler...

CVE-2023-36465

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in t...

Security feature bypass

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in t...

CVE-2023-36465 Decidim has broken access control in templates

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in t...

CVE-2023-36465 Decidim has broken access control in templates

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in t...

CVE-2023-36465 Decidim has broken access control in templates

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in t...

CVE-2023-36465

Decidim (Ruby on Rails) has a broken access control in the templates module, allowing any logged-in user to access template management in the admin panel and to change, create, or delete survey templates. The issue is confirmed across multiple sources and has been patched in versions 0.26.8 and 0...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2023-28362) and could allow cross-site scripting.

Summary There is a vulnerability in the Ruby On Rails opens source component used by IBM License Metric Tool. The vulnerability could allow a remote attacker to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web...

Fedora: Security Advisory for rubygem-rails (FEDORA-2023-4f0bb4ff5e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: rubygem-rails-7.0.7.2-1.fc39

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration...

[SECURITY] [DLA 3566-1] ruby-rails-html-sanitizer security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3566-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler September 13, 2023 https://wiki.debian.org/LTS -...

DLA-3566-1 ruby-rails-html-sanitizer - security update

Bulletin has no description...

Oracle Linux 9 : pcs (ELSA-2023-12595)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12595 advisory. 0.11.4-7 - Fix displaying differences between configuration checkpoints in pcs config checkpoint diff command - Fix pcs stonith update-scsi-devices...

Internet Bug Bounty: [CVE-2023-27531] Possible Deserialization of Untrusted Data vulnerability in Kredis JSON

A deserialization vulnerability was discovered in the Kredis JSON deserialization code, allowing for the potential deserialization of untrusted data. This could result in unexpected objects being deserialized in the system. The vulnerability has been assigned the CVE identifier CVE-2023-27531...