Skip to content
OpenAdvisories

Ecosystem

RubyGems

1,138 known vulnerabilities.

Most affected packages

actionpack 69 nokogiri 60 rack 54 rubygems-update 25 activerecord 23 puppet 23 activesupport 19 activestorage 18 actionview 17 loofah 17 publify_core 15 camaleon_cms 15 rails-html-sanitizer 15 passenger 14 puma 14 decidim 13 openc3 11 fat_free_crm 11 rails 11 oj 11 ruby-saml 10 net-imap 10 jquery-rails 9 decidim-core 9 katello 8 avo 8 spree 8 addressable 8 rexml 8 lodash-rails 7 fluentd 7 bootstrap 7 bootstrap-sass 7 jquery-ui-rails 7 webrick 6 json 6 doorkeeper 6 ember-source 6 mcp 6 devise 6
All Critical High Medium Low Exploited only Public exploit

83 results · Clear filters · Feed

  • Medium —
    CVE-2008-7248 Public exploit

    Improper Input Validation in actionpack

    Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protectio…

    rails actionpack Debian RubyGems
  • High —
    CVE-2008-4310 Public exploit EPSS 14%

    WEBrick Denial of Service Vulnerability

    httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-…

    webrick RubyGems
  • Medium —
    CVE-2007-3227 Public exploit

    Moderate severity vulnerability that affects rails

    Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.

    rails rails Debian RubyGems