Skip to contentRubyonrails Rails vulnerabilities
- rubyonrails rails, debian linux, fedoraproject fedora +1 more +3 moreUse of Insufficiently Random Values in Railties Allows Remote Code ExecutionCVE-2019-5420Public exploitFix availableEPSS 89.3%9.8 Critical
- debian linux, fedoraproject fedora, opensuse leap +5 more +7 morePath Traversal in Action ViewCVE-2019-5418In KEVPublic exploitFix availableEPSS 98.5%7.5 High
- rubyonrails rails, debian linux, fedoraproject fedora +4 more +6 moreDenial of Service Vulnerability in Action ViewCVE-2019-5419Fix available7.5 High
- rails https://github.com/rails/rails, rubyonrails rails +1 moreExposure of Sensitive Information to an Unauthorized Actor in activestorageCVE-2018-16477Fix available6.5 Medium
- rails https://github.com/rails/rails, redhat cloudforms, rubyonrails rails +2 moreImproper Access Control in activejobCVE-2018-16476Fix available7.5 High
- rubyonrails ruby on rails** DISPUTED ** SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and...CVE-2017-17920Disputed8.1 High
- rubyonrails ruby on rails** DISPUTED ** SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and...CVE-2017-17919Disputed8.1 High
- rubyonrails rails** DISPUTED ** SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and...CVE-2017-17917Public exploitDisputed8.1 High
- rubyonrails rails** DISPUTED ** SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and...CVE-2017-17916Disputed8.1 High
- rubyonrails railsActiveRecord in Ruby on Rails allows database-query bypassCVE-2016-6317Public exploitFix available7.5 High
- rubyonrails rails, ruby on rails, debian linux +2 moreactionview Cross-site Scripting vulnerabilityCVE-2016-6316Fix available6.1 Medium
- rubyonrails rails, ruby on rails, debian linux +2 moreactionpack allows remote code execution via application's unrestricted use of render methodCVE-2016-2098Public exploitFix availableEPSS 81.4%7.3 High
- rubyonrails rails, ruby on rails +1 moreactionview contains Path Traversal vulnerabilityCVE-2016-2097Fix available5.3 Medium
- rubyonrails rails, debian linux, fedoraproject fedora +1 more +3 moreactivemodel contains Improper Input ValidationCVE-2016-0753Fix available5.3 Medium
- rails ruby on rails, rubyonrails rails, debian linux +4 more +6 moreDirectory traversal vulnerability in Action View in Ruby on RailsCVE-2016-0752In KEVPublic exploitFix availableEPSS 95.5%7.5 High
- rubyonrails rails, ruby on rails +1 moreactionpack is vulnerable to denial of service via a crafted HTTP Accept headerCVE-2016-0751Fix available7.5 High
- rubyonrails railsactionpack is vulnerable to denial of service because of a wildcard controller routeCVE-2015-7581Fix available7.5 High
- rubyonrails rails, ruby on rails +1 moreActive Record Improper Access ControlCVE-2015-7577Fix available5.3 Medium
- rubyonrails rails, ruby on rails +1 moreactionpack is vulnerable to remote bypass authenticationCVE-2015-7576Fix available3.7 Low
- rubyonrails rails, opensuse +1 moreactivesupport vulnerable to Denial of Service via large XML document depthCVE-2015-3227Fix available5.0 Medium
- rubyonrails rails, ruby on rails +1 moreactivesupport Cross-site Scripting vulnerabilityCVE-2015-3226Fix available4.3 Medium
- rubyonrails jquery-rails, jquery-ujs, fedoraproject fedora +1 more +3 morejquery-rails and jquery-ujs subject to Exposure of Sensitive InformationCVE-2015-1840Fix available5.0 Medium
- rubyonrails rails, ruby on rails, opensuse +2 moreDirectory traversal vulnerability in actionpackCVE-2014-7829Fix available5.0 Medium
- rubyonrails railsThe str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent...CVE-2014-39165.0 Medium
- rubyonrails rails, ruby on rails, opensuse +2 moreactionpack vulnerable to Path TraversalCVE-2014-7818Fix available4.3 Medium
- rubyonrails railsActive Record subject to strong parameters protection bypassCVE-2014-3514Fix available7.5 High
- rubyonrails railsActive Record contains SQL Injection via improper range quotingCVE-2014-3483Fix available7.5 High
- rubyonrails rails, ruby on rails +1 moreSQL Injection in Active RecordCVE-2014-3482Fix available7.5 High
- rails ruby on rails, rubyonrails rails, redhat enterprise linux server +1 more +3 moreactionpack Path Traversal vulnerabilityCVE-2014-0130In KEVPublic exploitFix availableEPSS 53.7%7.5 High
- rubyonrails rails, ruby on rails +1 moreactionpack Improper Input Validation vulnerabilityCVE-2014-0082Fix available5.0 Medium
- rubyonrails rails, ruby on rails, opensuse +2 more +4 moreRails vulnerable to Cross-site ScriptingCVE-2014-0081Fix available4.3 Medium
- rubyonrails railsArray data injection vulnerability in activerecordCVE-2014-0080Fix available6.8 Medium
- rubyonrails rails, ruby on rails +1 moreactionpack allows bypass of database-query restrictionsCVE-2013-6417Fix available6.4 Medium
- rubyonrails railsactionpack Cross-site Scripting vulnerabilityCVE-2013-6416Fix available4.3 Medium
- rubyonrails rails, ruby on rails +1 moreactionpack vulnerable to Cross-site ScriptingCVE-2013-6415Fix available4.3 Medium
- rubyonrails rails, ruby on rails +1 moreactionpack Improper Input Validation vulnerabilityCVE-2013-6414Fix availableEPSS 20.7%5.0 Medium
- rubyonrails rails, ruby on rails +1 moreactionpack vulnerable to Cross-site ScriptingCVE-2013-4491Fix available4.3 Medium
- rubyonrails rails, debian linux, opensuse +2 moreactionmailer email address processing causes Denial of serviceCVE-2013-4389Fix available4.3 Medium
- rubyonrails rails, ruby on rails +1 moreActive Record component in Ruby on Rails has a data-type injection vulnerabilityCVE-2013-3221Fix available6.4 Medium
- rubyonrails rails, ruby on rails, redhat enterprise linux +2 moreactionpack Cross-site Scripting vulnerabilityCVE-2013-1857Fix available4.3 Medium
- rubyonrails rails, ruby on rails +1 moreactivesupport Improper Input Validation vulnerabilityCVE-2013-1856Fix available5.8 Medium
- rubyonrails rails, ruby on rails, redhat enterprise linux +2 moreactionpack Cross-site Scripting vulnerabilityCVE-2013-1855Fix available4.3 Medium
- rubyonrails rails, ruby on rails, redhat enterprise linux +2 moreActive Record Improper Input ValidationCVE-2013-1854Fix available5.0 Medium
- rubyonrails rails, ruby on rails +1 moreActive Record contains deserialization of arbitrary YAMLCVE-2013-0277Fix available10.0 High
- rubyonrails railsActiveRecord vulnerable to modification of protected model attributesCVE-2013-0276Fix available4.3 Medium
- rubyonrails rails, ruby on rails +1 moreactivesupport in Rails vulnerable to incorrect data conversionCVE-2013-0333Public exploitFix availableEPSS 95.6%7.5 High
- rubyonrails rails, ruby on rails, debian linux +2 moreActive Record allows bypassing of database-query restrictionsCVE-2013-0155Fix available6.4 Medium
- rubyonrails rails, ruby on rails, debian linux +2 moreactionpack Improper Input Validation vulnerabilityCVE-2013-0156Public exploitFix availableEPSS 99.0%7.5 High
- rubyonrails railsAuthlogic Information Exposure vulnerabilityCVE-2012-6497Fix available5.0 Medium
- rubyonrails rails, ruby on rails +1 moreActive Record contains SQL InjectionCVE-2012-6496Fix available7.5 High
- Show moreLoading…