Rails@7.0.0 Security Vulnerabilities and Issues — Rails@7.0.0 CVE List

Lucene search

RubyonrailsRails7.0.0

3 matches found

CVE•added 2024/02/27 4:15 p.m.•170 views

CVE-2024-26143

Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the...

6.1CVSS6AI score0.01535EPSS

CVE•added 2024/02/27 4:15 p.m.•154 views

CVE-2024-26144

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain pr...

5.3CVSS5.2AI score0.02507EPSS

CVE•added 2024/06/04 8:15 p.m.•71 views

CVE-2024-28103

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.

9.8CVSS6.8AI score0.00666EPSS