ActionPack input validation error vulnerability

RubyGems is a Ruby package manager from the RubyGems organization. The product is primarily used for publishing and managing Ruby packages. A security vulnerability exists in rubygem-actionpack, which stems from a redirection vulnerability in Action Controller...

Open Redirect

actionpack is vulnerable to Open Redirect. The vulnerability exists because the urlhostallowed function in redirecting.rb does not properly validate the URL strings, allowing an attacker to redirect the user to malicious URLs...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect when passing unsanitized user input to the redirectto helper in metal/redirecting.rb. NOTE: A patch has been released to address this issue: 7-0-Fix-sec-issue-with-urlhostallowed.patch Remediation Upgrade actionpack to...

SUSE-SU-2022:15116-1 Security update for rubygem-actionpack-3_2

This update for rubygem-actionpack-32 fixes the following issues: - CVE-2021-22885: Fixed Possible Information Disclosure / Unintended Method Execution in Action Pack bsc1185715. - CVE-2016-2097: Fixed Possible Information Leak Vulnerability in Action View bsc968850...

GHSA-9CHR-4FJH-5RGW Cross-site Scripting in actionpack

actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error Page. This issue has been patched with this commit. This vulnerability is disputed by the Rails security team. It requires that the developer is tricked into copy pasting a malicious...

CVE-2022-3704

A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/actiondispatch/middleware/templates/routes/table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The real...

CVE-2022-3704 Ruby on Rails _table.html.erb cross site scripting

A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/actiondispatch/middleware/templates/routes/table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The real...

PT-2022-7468

Name of the Vulnerable Software and Affected Versions actionpack affected versions not specified Description The issue is related to the incorrect neutralization of input data during web page generation, potentially leading to cross-site scripting. It affects the file actionpack/lib/action...

CVE-2022-3704: Improper Neutralization

A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/actiondispatch/middleware/templates/routes/table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The real...

actionpack Plugin XSS

The vulnerability of the actionpack plugin for the Ruby on Rails software platform exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect due to improper URL validation in the urlhostallowed? method. Remediation Upgrade actionpack to version 7.0.4 or higher. References - GitHub Commit - GitHub Commit - GitHub PR - PoC Credit: santib...

SUSE SLES15 Security Update : rubygem-actionpack-5_1, rubygem-activesupport-5_1 (SUSE-SU-2022:2108-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2108-1 advisory. - The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the...

openSUSE: Security Advisory for rubygem-actionpack-5_1, (SUSE-SU-2022:2108-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-22577

A flaw was found in rubygem-actionpack where CSP headers were sent with responses that Rails considered "HTML" responses. This flaw allows an attacker to leave API requests without CSP headers and perform a Cross-site scripting attack...

Cross-Site Scripting (XSS)

actionpack is vulnerable to cross-site scripting. The vulnerability exists in call function in contentsecuritypolicy.rb because the API requests are not sent along with CSP headers but responses which allows an attacker to inject and execute javascript...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect through the X-Forwarded-Host header. If the value of the header is prefixed with a invalid domain character for example a /, it is always accepted as the actual host of that request. Since this host is used for all url...

Host Authorization Framework Ruby on Rails Information Disclosure

The vulnerability in the Host Authorization framework of the actionpack ruby gem in the Ruby on Rails software platform relates to the conversion of strings in config.hosts without a starting point, into regular expressions without encapsulation. Exploiting this vulnerability can allow an attacke...

Open Redirection

actionpack is vulnerable to open redirection. A malicious X-Forwarded-Host when used in combination with certain allowed host formats, can cause the Host Authorization middleware to redirect users to a malicious website...

CVE-2021-22942

A flaw was found in rubygem-actionpack. Specially crafted “X-Forwarded-Host” headers, in combination with certain “allowed host” formats, can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. The highest threat from this vulnerability is to system...

Ruby on Rails input validation vulnerability

Ruby on Rails is a set of open source web application frameworks based on the Ruby language by the American Rails team. Ruby on Rails suffers from an Input Validation Error vulnerability that stems from a flaw found in rubygem-actionpack, which, via a specially crafted X-Forwarded-Host header, in...