Skip to content
OpenAdvisories

Package · RubyGems

actionview

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.3
    CVE-2023-23913

    rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements

    There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clip…

    rails rails-ujs rails rails Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2022-27777

    XSS Vulnerability in Action View tag helpers

    A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

    rails rails redmine actionview Debian Ubuntu RubyGems
  • Medium 5.4
    CVE-2020-15169 Public exploit

    XSS in Action View

    In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could …

    rails actionview rails rails Debian Ubuntu RubyGems
  • Medium 6.5
    CVE-2020-8167

    CSRF Vulnerability in rails-ujs

    A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

    rails rails actionview Debian Ubuntu RubyGems
  • Medium 4.0
    CVE-2020-5267 Public exploit

    Possible XSS vulnerability in ActionView

    In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions…

    rails actionview rails rails Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2016-6316

    actionview Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute…

    rails actionview Debian RubyGems
  • Medium 5.3
    CVE-2016-2097

    actionview contains Path Traversal vulnerability

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pa…

    rails actionpack actionview Debian RubyGems
  • Medium —
    CVE-2011-0446

    Rails actionpack gem vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email…

    rails actionpack actionview Debian RubyGems