4495 matches found
Ruby On Rails - Local File Inclusion
Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server. id: CVE-2018-3760 info: name: Ruby On Rails - Local File Inclusio...
Ruby on Rails Web Console - Remote Code Execution
Ruby on Rails Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelistedips protection mechanism via a crafted request to request.rb...
Camaleon CMS < 2.8.1 Arbitrary File Write to RCE
An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on depending on the permissions of the underlying filesystem. E.g. This can lead to a remote...
Ruby on Rails - Open Redirect via Host Header Injection
Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...
Ruby on Rails <5.0.1 - Remote Code Execution
Ruby on Rails before version 5.0.1 is susceptible to remote code execution because it passes user parameters as local variables into partials. id: CVE-2020-8163 info: name: Ruby on Rails 5.0.1 - Remote Code Execution author: timkoopmans severity: high description: Ruby on Rails before version 5.0...
Rails File Content Disclosure
Rails 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 and v3 are susceptible to a file content disclosure vulnerability because specially crafted accept headers can cause contents of arbitrary files on the target system's file system to be exposed. id: CVE-2019-5418 info: name: Rails File Content Disclosure...
PT-2026-77143
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT PARAMS when LDAP authentication uses LDAP TLS NO VERIFY=true, disabling SSL...
CVE-2026-69185 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...
GHSA-2M8V-J782-FHVR vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...
CVE-2026-73648 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.3-rails, ruby3.2-rails, pghero, pghero-fips...
CVE-2026-73648 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...
CVE-2026-73648
A flaw was found in rails-html-sanitizer, a component responsible for sanitizing HTML fragments in Rails applications. This vulnerability allows a remote attacker to perform Cross-Site Scripting XSS by exploiting improper sanitization of SVG Scalable Vector Graphics reference elements. The...
GO-2024-2576 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...
GO-2026-5024 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, k3s, trino, kube-conformance, gitlab-rails-ce, upwind-agent, etcd, etcd-fips, kubeflow-katib...
GO-2025-4116 vulnerabilities
Vulnerabilities for packages: falco-no-driver, gitlab-rails-ce-fips, k3s, consul-k8s, cert-manager-fips, gitlab-rails-ce, rke2-runtime-fips, vault, backup-restore-operator, etcd, etcd-fips, terraform...
GO-2026-5094 vulnerabilities
Vulnerabilities for packages: gitness, argocd-image-updater-fips, gitlab-rails-ce-fips, portieris, argocd-image-updater, gitlab-rails-ce, portieris-fips, envoy-gateway, kots, envoy-gateway-fips, zot...
GO-2026-5185 vulnerabilities
Vulnerabilities for packages: gitness, argocd-image-updater-fips, gitlab-rails-ce-fips, portieris, argocd-image-updater, gitlab-rails-ce, portieris-fips, envoy-gateway, kots, envoy-gateway-fips, zot...
GO-2026-5693 vulnerabilities
Vulnerabilities for packages: argo-cd-fips, flux-fips, gitlab-rails-ce-fips, flux, external-secrets-operator, external-secrets-operator-fips, argo-cd, gitaly, nemo, grafana, gitlab-rails-ce, terragrunt, teleport, grafana-fips, upwind-agent, guac, terragrunt-fips...
Linux Distros Unpatched Vulnerability : CVE-2026-73648
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG...