Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
11 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Possible XSS Vulnerability in Action Controller There is a possible XSS vulnerability when using the translation helpers (translate, t, etc) in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2024-26143. Versions Affected: = 7.0.0. Not affected: < 7.0.0 Fixed Versions: 7.1.3.1, 7.0.8.1 Impact ------ Applications using translation methods like translate, or t on a controller, with a key ending in "html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. For example, impacted code will look something like this: To reiterate the pre-conditions, applications must: Use a translation function from a controller (i.e. not I18n.t, or t from a view) Use a key that ends in html Use a default value where the default value is untrusted and unescaped input Send the text to the victim (whether that's part of a template, or a render call) All users running an affected release…
Recommended action: Upgrade to 7.1.3.1 or 7.0.8.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOADPATH variable, a different vulnerability than CVE-2006-4112.
Recommended action: Upgrade to 1.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.fromxml (Hash#fromxml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
Recommended action: Upgrade to 1.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
Recommended action: Upgrade to 1.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The example code for the digest authentication functionality (httpauthentication.rb) in Ruby on Rails before 2.3.3 defines an authenticateorrequestwithhttpdigest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
Recommended action: Upgrade to 2.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the striptags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/actioncontroller/vendor/html-scanner/html/node.rb.
Recommended action: Upgrade to 2.3.5 or 2.2.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.
Recommended action: Upgrade to 1.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the tojson (ActiveRecord::Base#tojson) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.
Recommended action: Upgrade to 1.2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirectto function.
Recommended action: Upgrade to 2.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
Recommended action: Upgrade to 1.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is an XSS vulnerability in the numbertocurrency, numbertopercentage and numbertohuman helpers in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0081. Versions Affected: All. Fixed Versions: 4.1.0.beta2, 4.0.3, 3.2.17. Impact ------ These helpers allows users to nicely format a numeric value. Some of the parameters to the helper (format, negativeformat and units) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack. All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately. Releases -------- The 4.1.0.rc1, 4.0.3 and 3.2.17 releases are available at the normal locations. Workarounds ----------- The workaround for this issue is to escape the value passed to the parameter. For example, replace code like this: With code like this Patches ------- To aid users who aren't able to upgrade…
Recommended action: Upgrade to 4.0.3 or 3.2.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.