Skip to content
OpenAdvisories
High 1 exploited CVE WID-SEC-2025-1085 9 CVEs

Ruby on Rails: Mehrere Schwachstellen

Published Jan 25, 2016 · Updated Mar 17, 2026 · Revision 22 · de-DE

Vendor: Debian Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Enterprise Server Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Sicherheitsfunktionen zu umgehen, um Dateien zu manipulieren oder um einen Denial of Service Zustand herbeizuführen.

Product

Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.

Vulnerabilities 9

  • High 7.5
    CVE-2016-0752 Exploited Public exploit EPSS 96%

    Directory traversal vulnerability in Action View in Ruby on Rails

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted …

    rails actionpack actionview Debian RubyGems
    KEV Mar 25, 2022
  • High 7.5
    CVE-2015-7581

    actionpack is vulnerable to denial of service because of a wildcard controller route

    actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application'…

    rails actionpack Debian RubyGems
  • High 7.5
    CVE-2016-0751

    actionpack is vulnerable to denial of service via a crafted HTTP Accept header

    actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote at…

    rails actionpack Debian RubyGems
  • Medium 6.1
    CVE-2015-7578

    rails-html-sanitizer Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.

    rails-html-sanitizer ruby-rails-html-sanitizer Debian RubyGems
  • Medium 6.1
    CVE-2015-7579

    rails-html-sanitizer Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.

    rails-html-sanitizer ruby-rails-html-sanitizer Debian RubyGems
  • Medium 6.1
    CVE-2015-7580

    rails-html-sanitizer Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.

    rails-html-sanitizer ruby-rails-html-sanitizer Debian RubyGems
  • Medium 5.3
    CVE-2015-7577

    Active Record Improper Access Control

    activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, wh…

    rails activerecord Debian RubyGems
  • Medium 5.3
    CVE-2016-0753

    activemodel contains Improper Input Validation

    Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

    rails activemodel Debian RubyGems
  • Low 3.7
    CVE-2015-7576

    actionpack is vulnerable to remote bypass authentication

    The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, a…

    rails actionpack Debian RubyGems

Revision history

  1. #22

    Neue Updates von openSUSE aufgenommen

  2. #21

    Neue Updates von openSUSE aufgenommen

  3. #20

    New remediations available

  4. #18

    New remediations available

  5. #19

    Version nicht vorhanden

  6. #17

    New remediations available

  7. #16

    New remediations available

  8. #15

    New remediations available

  9. #14

    New remediations available

  10. #13

    New remediations available

  11. #12

    New remediations available

  12. #10

    New remediations available

  13. #11

    Version nicht vorhanden

  14. #9

    New remediations available

  15. #8

    New remediations available

  16. #7

    New remediations available

  17. #5

    New remediations available

  18. #6

    Version nicht vorhanden

  19. #3

    New remediations available

  20. #4

    Version nicht vorhanden

  21. #1

    Initial Release

  22. #2

    Version nicht vorhanden

References