Skip to content
OpenAdvisories

Package · RubyGems

activeadmin

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.1
    CVE-2024-37031

    activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends

    The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a f…

    activeadmin RubyGems
  • High 8.4
    CVE-2023-50448

    Potential CSV export data leak

    In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.

    activeadmin RubyGems
  • Medium 5.2
    CVE-2023-51763

    ActiveAdmin CSV Injection leading to sensitive information disclosure

    csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.

    activeadmin RubyGems