Skip to content
OpenAdvisories

Package · RubyGems

rails

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.1
    CVE-2024-26143

    Rails Possible XSS Vulnerability in Action Controller

    Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key whic…

    rails rails rails actionpack Ubuntu RubyGems
  • Medium —
    CVE-2014-0081

    Rails vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (…

    rails actionpack rails Debian RubyGems
  • Medium —
    CVE-2009-4214

    Moderate severity vulnerability that affects rails

    Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tok…

    rails rails Debian RubyGems
  • Medium —
    CVE-2008-5189

    rails is vulnerable to CRLF injection

    CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.

    rails rails Debian RubyGems
  • Medium —
    CVE-2007-6077

    session fixation protection mechanism in cgi_process.rb in Rails

    The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiat…

    rails rails Debian RubyGems
  • Medium —
    CVE-2007-5379

    Moderate severity vulnerability that affects rails

    Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsaf…

    rails rails Debian RubyGems
  • Medium —
    CVE-2007-5380

    Session fixation vulnerability in Rails

    Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."

    rails rails Debian RubyGems
  • Medium —
    CVE-2007-3227 Public exploit

    Moderate severity vulnerability that affects rails

    Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.

    rails rails Debian RubyGems