Search CVE reports
11 – 20 of 26 results
Some fixes available 1 of 7
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large...
10 affected packages
rails, rails-4.0, ruby-actionpack-2.3, ruby-actionpack-3.2, ruby-activerecord-2.3...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| rails | — | — | — | — | Not affected |
| rails-4.0 | — | — | — | — | Not in release |
| ruby-actionpack-2.3 | — | — | — | — | Not in release |
| ruby-actionpack-3.2 | — | — | — | — | Not in release |
| ruby-activerecord-2.3 | — | — | — | — | Not in release |
| ruby-activerecord-3.2 | — | — | — | — | Not in release |
| ruby-activesupport-2.3 | — | — | — | — | Not in release |
| ruby-activesupport-3.2 | — | — | — | — | Not in release |
| ruby-rails-2.3 | — | — | — | — | Not in release |
| ruby-rails-3.2 | — | — | — | — | Not in release |
Some fixes available 1 of 7
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash...
10 affected packages
rails, rails-4.0, ruby-actionpack-2.3, ruby-actionpack-3.2, ruby-activerecord-2.3...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| rails | — | — | — | — | Not affected |
| rails-4.0 | — | — | — | — | Not in release |
| ruby-actionpack-2.3 | — | — | — | — | Not in release |
| ruby-actionpack-3.2 | — | — | — | — | Not in release |
| ruby-activerecord-2.3 | — | — | — | — | Not in release |
| ruby-activerecord-3.2 | — | — | — | — | Not in release |
| ruby-activesupport-2.3 | — | — | — | — | Not in release |
| ruby-activesupport-3.2 | — | — | — | — | Not in release |
| ruby-rails-2.3 | — | — | — | — | Not in release |
| ruby-rails-3.2 | — | — | — | — | Not in release |
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when...
11 affected packages
rails, rails-3.2, rails-4.0, ruby-actionpack-2.3, ruby-actionpack-3.2...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| rails | — | — | — | — | Not affected |
| rails-3.2 | — | — | — | — | Not in release |
| rails-4.0 | — | — | — | — | Not in release |
| ruby-actionpack-2.3 | — | — | — | — | Not in release |
| ruby-actionpack-3.2 | — | — | — | — | Not in release |
| ruby-activerecord-2.3 | — | — | — | — | Not in release |
| ruby-activerecord-3.2 | — | — | — | — | Not in release |
| ruby-activesupport-2.3 | — | — | — | — | Not in release |
| ruby-activesupport-3.2 | — | — | — | — | Not in release |
| ruby-rails-2.3 | — | — | — | — | Not in release |
| ruby-rails-3.2 | — | — | — | — | Not in release |
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when...
11 affected packages
rails, rails-3.2, rails-4.0, ruby-actionpack-2.3, ruby-actionpack-3.2...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| rails | — | — | — | — | Not affected |
| rails-3.2 | — | — | — | — | Not in release |
| rails-4.0 | — | — | — | — | Not in release |
| ruby-actionpack-2.3 | — | — | — | — | Not in release |
| ruby-actionpack-3.2 | — | — | — | — | Not in release |
| ruby-activerecord-2.3 | — | — | — | — | Not in release |
| ruby-activerecord-3.2 | — | — | — | — | Not in release |
| ruby-activesupport-2.3 | — | — | — | — | Not in release |
| ruby-activesupport-3.2 | — | — | — | — | Not in release |
| ruby-rails-2.3 | — | — | — | — | Not in release |
| ruby-rails-3.2 | — | — | — | — | Not in release |
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to...
11 affected packages
rails, rails-3.2, rails-4.0, ruby-actionpack-2.3, ruby-actionpack-3.2...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| rails | — | — | — | — | — |
| rails-3.2 | — | — | — | — | — |
| rails-4.0 | — | — | — | — | — |
| ruby-actionpack-2.3 | — | — | — | — | — |
| ruby-actionpack-3.2 | — | — | — | — | — |
| ruby-activerecord-2.3 | — | — | — | — | — |
| ruby-activerecord-3.2 | — | — | — | — | — |
| ruby-activesupport-2.3 | — | — | — | — | — |
| ruby-activesupport-3.2 | — | — | — | — | — |
| ruby-rails-2.3 | — | — | — | — | — |
| ruby-rails-3.2 | — | — | — | — | — |
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which...
9 affected packages
rails, ruby-actionpack-2.3, ruby-actionpack-3.2, ruby-activerecord-2.3, ruby-activerecord-3.2...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| rails | — | — | — | — | Not affected |
| ruby-actionpack-2.3 | — | — | — | — | Not in release |
| ruby-actionpack-3.2 | — | — | — | — | Not in release |
| ruby-activerecord-2.3 | — | — | — | — | Not in release |
| ruby-activerecord-3.2 | — | — | — | — | Not in release |
| ruby-activesupport-2.3 | — | — | — | — | Not in release |
| ruby-activesupport-3.2 | — | — | — | — | Not in release |
| ruby-rails-2.3 | — | — | — | — | Not in release |
| ruby-rails-3.2 | — | — | — | — | Not in release |
Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a...
9 affected packages
rails, ruby-actionpack-2.3, ruby-actionpack-3.2, ruby-activerecord-2.3, ruby-activerecord-3.2...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| rails | — | — | — | — | — |
| ruby-actionpack-2.3 | — | — | — | — | — |
| ruby-actionpack-3.2 | — | — | — | — | — |
| ruby-activerecord-2.3 | — | — | — | — | — |
| ruby-activerecord-3.2 | — | — | — | — | — |
| ruby-activesupport-2.3 | — | — | — | — | — |
| ruby-activesupport-3.2 | — | — | — | — | — |
| ruby-rails-2.3 | — | — | — | — | — |
| ruby-rails-3.2 | — | — | — | — | — |
Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web...
9 affected packages
rails, ruby-actionpack-2.3, ruby-actionpack-3.2, ruby-activerecord-2.3, ruby-activerecord-3.2...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| rails | — | — | — | — | Not affected |
| ruby-actionpack-2.3 | — | — | — | — | Not in release |
| ruby-actionpack-3.2 | — | — | — | — | Not in release |
| ruby-activerecord-2.3 | — | — | — | — | Not in release |
| ruby-activerecord-3.2 | — | — | — | — | Not in release |
| ruby-activesupport-2.3 | — | — | — | — | Not in release |
| ruby-activesupport-3.2 | — | — | — | — | Not in release |
| ruby-rails-2.3 | — | — | — | — | Not in release |
| ruby-rails-3.2 | — | — | — | — | Not in release |
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address...
12 affected packages
rails, rails-4.0, ruby-actionmailer-2.3, ruby-actionmailer-3.2, ruby-actionpack-2.3...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| rails | — | — | — | — | — |
| rails-4.0 | — | — | — | — | — |
| ruby-actionmailer-2.3 | — | — | — | — | — |
| ruby-actionmailer-3.2 | — | — | — | — | — |
| ruby-actionpack-2.3 | — | — | — | — | — |
| ruby-actionpack-3.2 | — | — | — | — | — |
| ruby-activerecord-2.3 | — | — | — | — | — |
| ruby-activerecord-3.2 | — | — | — | — | — |
| ruby-activesupport-2.3 | — | — | — | — | — |
| ruby-activesupport-3.2 | — | — | — | — | — |
| ruby-rails-2.3 | — | — | — | — | — |
| ruby-rails-3.2 | — | — | — | — | — |
Some fixes available 1 of 35
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle...
9 affected packages
rails, ruby-actionpack-2.3, ruby-actionpack-3.2, ruby-activerecord-2.3, ruby-activerecord-3.2...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| rails | — | — | — | — | Not affected |
| ruby-actionpack-2.3 | — | — | — | — | Not in release |
| ruby-actionpack-3.2 | — | — | — | — | Not in release |
| ruby-activerecord-2.3 | — | — | — | — | Not in release |
| ruby-activerecord-3.2 | — | — | — | — | Not in release |
| ruby-activesupport-2.3 | — | — | — | — | Not in release |
| ruby-activesupport-3.2 | — | — | — | — | Not in release |
| ruby-rails-2.3 | — | — | — | — | Not in release |
| ruby-rails-3.2 | — | — | — | — | Not in release |