Skip to contentRubyonrails vulnerabilities
Newest
- rubyonrails rails, fedoraproject fedora, rails https://github.com/rails/rails +2 moreUntrusted users can run pending migrations in production in RailsCVE-2020-8185Fix available6.5 Medium
- rubyonrails rails, debian linux +1 moreCSRF Vulnerability in rails-ujsCVE-2020-8167Fix available6.5 Medium
- rubyonrails rails, debian linux, rails https://github.com/rails/rails +2 moreAbility to forge per-form CSRF tokens in RailsCVE-2020-8166Fix available4.3 Medium
- rubyonrails rails, debian linux, rails https://github.com/rails/rails +2 moreCircumvention of file size limits in ActiveStorageCVE-2020-8162Public exploitFix available7.5 High
- rubyonrails rails, debian linux, opensuse backports sle +2 more +4 morePossible Strong Parameters Bypass in ActionPackCVE-2020-8164Fix available7.5 High
- rubyonrails rails, debian linux, opensuse leap +1 more +3 moreActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStoreCVE-2020-8165Public exploitFix availableEPSS 45.7%9.8 Critical
- debian linux, rubyonrails actionpack page-caching +1 moreArbitrary file write in actionpack-page_caching gemCVE-2020-8159Fix available9.8 Critical
- rubyonrails active resource, fedoraproject fedora +1 moreInformation disclosure issue in Active ResourceCVE-2020-8151Fix available7.5 High
- rails actionview, debian linux, fedoraproject fedora +1 more +3 morePossible XSS vulnerability in ActionViewCVE-2020-5267Public exploitFix available4.0 Medium
- rails, debian linux +1 moreThe encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.CVE-2010-32996.5 Medium
- rubyonrails rails, debian linux, fedoraproject fedora +1 more +3 moreUse of Insufficiently Random Values in Railties Allows Remote Code ExecutionCVE-2019-5420Public exploitFix availableEPSS 89.3%9.8 Critical
- debian linux, fedoraproject fedora, opensuse leap +5 more +7 morePath Traversal in Action ViewCVE-2019-5418In KEVPublic exploitFix availableEPSS 98.5%7.5 High
- rubyonrails rails, debian linux, fedoraproject fedora +4 more +6 moreDenial of Service Vulnerability in Action ViewCVE-2019-5419Fix available7.5 High
- rails https://github.com/rails/rails, rubyonrails rails +1 moreExposure of Sensitive Information to an Unauthorized Actor in activestorageCVE-2018-16477Fix available6.5 Medium
- rails https://github.com/rails/rails, redhat cloudforms, rubyonrails rails +2 moreImproper Access Control in activejobCVE-2018-16476Fix available7.5 High
- rails rails-html-sanitizer, rubyonrails html sanitizer +1 morerails-html-sanitizer Cross-site Scripting vulnerabilityCVE-2018-3741Fix available6.1 Medium
- rubyonrails ruby on rails** DISPUTED ** SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and...CVE-2017-17920Disputed8.1 High
- rubyonrails ruby on rails** DISPUTED ** SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and...CVE-2017-17919Disputed8.1 High
- rubyonrails rails** DISPUTED ** SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and...CVE-2017-17917Public exploitDisputed8.1 High
- rubyonrails rails** DISPUTED ** SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and...CVE-2017-17916Disputed8.1 High
- rubyonrails railsActiveRecord in Ruby on Rails allows database-query bypassCVE-2016-6317Public exploitFix available7.5 High
- rubyonrails rails, ruby on rails, debian linux +2 moreactionview Cross-site Scripting vulnerabilityCVE-2016-6316Fix available6.1 Medium
- rubyonrails rails, ruby on rails, debian linux +2 moreactionpack allows remote code execution via application's unrestricted use of render methodCVE-2016-2098Public exploitFix availableEPSS 81.4%7.3 High
- rubyonrails rails, ruby on rails +1 moreactionview contains Path Traversal vulnerabilityCVE-2016-2097Fix available5.3 Medium
- rubyonrails html sanitizerrails-html-sanitizer Cross-site Scripting vulnerabilityCVE-2015-7580Fix available6.1 Medium
- rubyonrails html sanitizerrails-html-sanitizer Cross-site Scripting vulnerabilityCVE-2015-7579Fix available6.1 Medium
- rubyonrails html sanitizerrails-html-sanitizer Cross-site Scripting vulnerabilityCVE-2015-7578Fix available6.1 Medium
- rubyonrails rails, debian linux, fedoraproject fedora +1 more +3 moreactivemodel contains Improper Input ValidationCVE-2016-0753Fix available5.3 Medium
- rails ruby on rails, rubyonrails rails, debian linux +4 more +6 moreDirectory traversal vulnerability in Action View in Ruby on RailsCVE-2016-0752In KEVPublic exploitFix availableEPSS 95.5%7.5 High
- rubyonrails rails, ruby on rails +1 moreactionpack is vulnerable to denial of service via a crafted HTTP Accept headerCVE-2016-0751Fix available7.5 High
- rubyonrails railsactionpack is vulnerable to denial of service because of a wildcard controller routeCVE-2015-7581Fix available7.5 High
- rubyonrails rails, ruby on rails +1 moreActive Record Improper Access ControlCVE-2015-7577Fix available5.3 Medium
- rubyonrails rails, ruby on rails +1 moreactionpack is vulnerable to remote bypass authenticationCVE-2015-7576Fix available3.7 Low
- rubyonrails rails, opensuse +1 moreactivesupport vulnerable to Denial of Service via large XML document depthCVE-2015-3227Fix available5.0 Medium
- rubyonrails rails, ruby on rails +1 moreactivesupport Cross-site Scripting vulnerabilityCVE-2015-3226Fix available4.3 Medium
- rubyonrails web consoleWeb Console (Ruby gem) contains whitelisted_ips bypassCVE-2015-3224Public exploitFix availableEPSS 48.8%4.3 Medium
- rubyonrails jquery-rails, jquery-ujs, fedoraproject fedora +1 more +3 morejquery-rails and jquery-ujs subject to Exposure of Sensitive InformationCVE-2015-1840Fix available5.0 Medium
- rubyonrails rails, ruby on rails, opensuse +2 moreDirectory traversal vulnerability in actionpackCVE-2014-7829Fix available5.0 Medium
- rubyonrails railsThe str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent...CVE-2014-39165.0 Medium
- rubyonrails rails, ruby on rails, opensuse +2 moreactionpack vulnerable to Path TraversalCVE-2014-7818Fix available4.3 Medium
- rubyonrails railsActive Record subject to strong parameters protection bypassCVE-2014-3514Fix available7.5 High
- rubyonrails railsActive Record contains SQL Injection via improper range quotingCVE-2014-3483Fix available7.5 High
- rubyonrails rails, ruby on rails +1 moreSQL Injection in Active RecordCVE-2014-3482Fix available7.5 High
- rails ruby on rails, rubyonrails rails, redhat enterprise linux server +1 more +3 moreactionpack Path Traversal vulnerabilityCVE-2014-0130In KEVPublic exploitFix availableEPSS 53.7%7.5 High
- rubyonrails rails, ruby on rails +1 moreactionpack Improper Input Validation vulnerabilityCVE-2014-0082Fix available5.0 Medium
- rubyonrails rails, ruby on rails, opensuse +2 more +4 moreRails vulnerable to Cross-site ScriptingCVE-2014-0081Fix available4.3 Medium
- rubyonrails railsArray data injection vulnerability in activerecordCVE-2014-0080Fix available6.8 Medium
- rubyonrails rails, ruby on rails +1 moreactionpack allows bypass of database-query restrictionsCVE-2013-6417Fix available6.4 Medium
- rubyonrails railsactionpack Cross-site Scripting vulnerabilityCVE-2013-6416Fix available4.3 Medium
- rubyonrails rails, ruby on rails +1 moreactionpack vulnerable to Cross-site ScriptingCVE-2013-6415Fix available4.3 Medium
- Show moreLoading…