Linux Distros Unpatched Vulnerability : CVE-2024-54133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy...

Linux Distros Unpatched Vulnerability : CVE-2024-47887

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1,...

Linux Distros Unpatched Vulnerability : CVE-2024-28103

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses...

Linux Distros Unpatched Vulnerability : CVE-2024-41128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1,...

The vulnerability of the content_security_policy function in the Action Pack interpreter for Ruby allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the contentsecuritypolicy function in the Action Pack interpreter for Ruby is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor, operating remotely, to perform cross-site scripting attacks...

ROS-20250121-03

Vulnerability The contentsecuritypolicy function of the Ruby interpreter's Action Pack extension is related to a vulnerability in the dynamically set Content-Security-Policy CSP headers. Content-Security-Policy CSP dynamically set headers vulnerability. Exploitation The vulnerability could allow ...

The vulnerability of the Action Pack framework for the Ruby interpreter allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Action Pack framework’s Ruby interpreter lies in insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

ROS-20250110-11

A vulnerability in the Action Pack framework of the Ruby on Rails software platform is related to incorrect validation of the of input data. Exploitation of the vulnerability could allow a remote attacker to bypass certain security restrictions. certain security restrictions...

BIT-RAILS-2024-28103 Action Pack is missing security headers on non-HTML responses

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3...

Cross-Site Scripting (XSS)

Action Pack is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the contentsecuritypolicy helper, allowing carefully crafted inputs to inject new directives into the Content-Security-Policy CSP headers...

CVE-2024-54133

A cross site scripting XSS vulnerability was found in the contentsecuritypolicy helper in certain versions of Action Pack. Applications which set Content-Security-Policy CSP headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs injecting new directives into t...

CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

DEBIAN-CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

CVE-2024-54133

CVE-2024-54133 – Action Pack CSP bypass (XSS): Affected Rails Action Pack versions exposed a vulnerability in the content_security_policy helper that could allow untrusted input to inject new directives into CSP headers, bypassing CSP protections. The issue affects 5.2.0–7.0.8.6, 7.1.0–7.1.5.0, 7...

CVE-2024-54133 Possible Content Security Policy bypass in Action Dispatch

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

CVE-2024-54133 Possible Content Security Policy bypass in Action Dispatch

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

CVE-2024-54133 Possible Content Security Policy bypass in Action Dispatch

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

GHSA-VFM5-RMRH-J26V Possible Content Security Policy bypass in Action Dispatch

There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper in Action Pack. Impact ------ Applications which set Content-Security-Policy CSP headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new...

PT-2024-10400

Name of the Vulnerable Software and Affected Versions Action Pack versions 5.2.0 through 7.0.8.6 Action Pack versions 7.0.8.7 through 7.1.5.0 Action Pack versions 7.1.5.1 through 7.2.2.0 Action Pack versions 7.2.2.1 through 8.0.0.0 Description The issue is related to the content security policy...