4576 matches found
CVE-2026-33209
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting XSS vulnerability exists in the returnto query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is execute...
CVE-2026-33209 Avo has a XSS vulnerability on `return_to` param
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting XSS vulnerability exists in the returnto query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is execute...
Avo 跨站脚本漏洞
Avo is an open-source Ruby on Rails management panel framework developed by Avo itself. Versions of Avo prior to 3.30.3 contained a cross-site scripting vulnerability. This vulnerability stemmed from the returnto query parameter in the Avo interface, which allowed reflective cross-site scripting...
DEBIAN-CVE-2026-32700
Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the reconfirmable option the default when using...
Malicious code in rails_structured_logging (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-1920 Malicious code in rails_structured_logging (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
ruby4.0-rubygem-rails-8.0-8.0.3-1.3 on GA media (moderate)
ruby4.0-rubygem-rails-8.0-8.0.3-1.3 on GA media Announcement ID: openSUSE-SU-2026:10360-1 Rating: moderate Cross-References: CVE-2024-54133 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 on GA media (moderate)
ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 on GA media Announcement ID: openSUSE-SU-2026:10361-1 Rating: moderate Cross-References: CVE-2015-7578 CVE-2015-7579 CVE-2015-7580 CVE-2018-3741 CVE-2022-23517 CVE-2022-23518 CVE-2022-23519 CVE-2022-23520 CVE-2022-32209 CVSS scores: CVE-2018-3741 SUS...
ruby4.0-rubygem-jquery-rails-4.6.0-1.9 on GA media (moderate)
ruby4.0-rubygem-jquery-rails-4.6.0-1.9 on GA media Announcement ID: openSUSE-SU-2026:10350-1 Rating: moderate Cross-References: CVE-2015-1840 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in th...
OPENSUSE-SU-2026:10360-1 ruby4.0-rubygem-rails-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-rails-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:10361-1 ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 on GA media
These are all security issues fixed in the ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:10350-1 ruby4.0-rubygem-jquery-rails-4.6.0-1.9 on GA media
These are all security issues fixed in the ruby4.0-rubygem-jquery-rails-4.6.0-1.9 package on the GA media of openSUSE Tumbleweed...
Ruby on Rails: Rails::HTML::Sanitizer.allowed_uri? returns true for entity-encoded control-character-split javascript: URLs
A vulnerability was discovered in the Rails::HTML::Sanitizer.alloweduri? method of the rails-html-sanitizer library. The method incorrectly returned true for entity-encoded control-character-split javascript: URLs, which could lead to potential security issues if the application relied on the...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: crossplane-function-environment-configs-fips, k6-operator-fips, memcached-exporter-fips, nri-haproxy-fips, apisix-ingress-controller, cue-fips, kube-arangodb, esbuild-fips, spiffe-helper-fips, jaeger, wuzz, smokescreen, addon-resizer-fips,...
MarkUs 安全漏洞
MarkUs is an open-source Ruby on Rails and React web application used for submitting and grading student assignments. Versions of MarkUs prior to 2.9.4 contained a security vulnerability due to the lack of size or item quantity limits when extracting zip files...
Ruby on Rails: ActiveStorage Disk Service Path Traversal via Custom Blob Key Injection
A vulnerability was discovered in the ActiveStorage Disk Service component of Ruby on Rails. The vulnerability allowed an attacker to achieve arbitrary file write, read, and delete on the server's filesystem by injecting a malicious blob key. The vulnerability was due to insufficient validation o...
GHSA-WX95-C6CV-8532 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, ruby3.3-rails...
GHSA-WX95-C6CV-8532 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, ruby3.3-rails...