PT-2022-23105 · Unknown +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Arvados versions prior to 2.4.2 Description: Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution vulnerability in the Arvados Workbench allow...

Activerecord update_by_case SQL注入漏洞

Activerecord updatebycase is a Ruby on Rails tool for updating many records with case values from a single database hit. A SQL injection vulnerability exists in Activerecord updatebycase prior to version 0.1.3, which stems from updatebycase using a customized sql string that is not cleaned up...

Remote Code Execution (RCE)

Overview activerecord is a library for databases on Rails. Affected versions of this package are vulnerable to Remote Code Execution RCE. When serialized columns that use YAML the default are deserialized, Rails uses YAML.unsafeload to convert the YAML data in to Ruby objects. If an attacker can...

The vulnerability of the actionpack plugin in the Ruby on Rails software platform allows attackers to execute XSS attacks.

The vulnerability of the actionpack plugin for the Ruby on Rails software platform exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

PT-2022-21161 · Ruby +4 · Ruby On Rails +4

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions prior to 7.0.3.1 Ruby on Rails versions prior to 6.1.6.1 Ruby on Rails versions prior to 6.0.5.1 Ruby on Rails versions prior to 5.2.8.1 Description: A possible escalation to remote code execution RCE exists when using...

Exploit for Command Injection in Rubyonrails Rails

PoC exploit for CVE-2019-5420, a Ruby deserialization vulnerabil...

CVE-2022-32209

A Cross-site scripting XSS vulnerability exists in ruby on rails. This issue could allow an attacker to inject content into the application, leading to loss of integrity and confidentiality...

CVE-2022-32209

Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3 ImpactA possible XS...

Malicious code in ruby-on-rails-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34c450a4a909b2cff0881264fc0cacab1b54bdb89064e08b2c17d897a4cfc2dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-M44R-GV6Q-9J9R papercrop does not properly handle crop input

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...

papercrop does not properly handle crop input

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...

GHSA-RX7J-MW4C-76G9 Authlogic Information Exposure vulnerability

The Authlogic gem for Ruby on Rails prior to version 3.3.0 makes potentially unsafe findbyid method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secrettoken value, as demonstrated by a value...

Authlogic Information Exposure vulnerability

The Authlogic gem for Ruby on Rails prior to version 3.3.0 makes potentially unsafe findbyid method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secrettoken value, as demonstrated by a value...

GHSA-F57C-HX33-HVH8 Active Record component in Ruby on Rails has a data-type injection vulnerability

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

Active Record component in Ruby on Rails has a data-type injection vulnerability

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

Ruby On Rails Directory Traversal (CVE-2016-0752)

A directory traversal vulnerability exists in Ruby on Rails. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

Ruby on Rails: Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag

It seems to be a problem caused by a difference between the nokogiri java implementation and the ruby implementation. It seems to be an ambiguous case as to whether to do it with nokogiri or have rails-html-sanitizer defend it. jruby9.3.3.0 nokogiri java, use...

The vulnerability of the Active Storage module in the Ruby on Rails software framework allows attackers to execute arbitrary code.

The vulnerability of the Active Storage module in the Ruby on Rails software framework is related to errors during code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Ruby on Rails 代码注入漏洞

Ruby on Rails is a set of open source web application frameworks based on the Ruby language from the Rails team. Ruby on Rails suffers from a code injection vulnerability that stems from incorrect input validation in the Active Storage module. A remote attacker can exploit the vulnerability to se...

PT-2022-1849 · Ruby +2 · Ruby On Rails Active Storage +2

Name of the Vulnerable Software and Affected Versions: Ruby on Rails Active Storage versions 5.2.0 through 5.2.6.2 Ruby on Rails Active Storage versions 6.0.0 through 6.0.4.6 Ruby on Rails Active Storage versions 6.1.0 through 6.1.4.6 Ruby on Rails Active Storage versions 7.0.0 through 7.0.2.2...