Ruby On Rails
Monthly
Unauthenticated remote code execution is achievable in Square Squash (all versions through commit e73f280) through a two-stage YAML deserialization path in the symbolication API. An attacker first stores crafted YAML under a chosen symbolication UUID using the unauthenticated POST /api/1.0/symbolication endpoint; the payload only detonates when occurrences referencing that UUID are later processed by the symbolication worker, at which point the stored value is passed to YAML.load with SafeYAML running in unsafe mode, permitting arbitrary Ruby object instantiation and code execution. Publicly available exploit code exists, and no CISA KEV listing confirms active exploitation; exploitation is deferred rather than immediate, which is why the assessed complexity is high (AC:H) despite requiring no authentication or user interaction.
Basecamp's Upright authentication library contains a login cross-site request forgery (CSRF) flaw in the static-credentials session callback implemented in app/controllers/upright/sessions_controller.rb, where the login action is not protected by an anti-CSRF token. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R, unauthenticated remote attackers can exploit it, but success depends on victim interaction - the victim must load or be redirected to an attacker-controlled page that submits the forged login request while Upright's static-credentials session flow is exposed. The practical consequence is that the victim is silently logged into the attacker's session rather than having their own account compromised, so our independent assessment rates the impact as partial (C:L/I:L/A:N) even though MITRE assigned 8.8 (C:H/I:H/A:H); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Zammad versions prior to 7.0.2 contain an insecure direct object reference (CWE-639) in the knowledge base answer attachment endpoints, allowing an authenticated user with limited knowledge-base permissions to create, delete, or clone attachments on answers outside their assigned access scope. The flaw stems from controller policies that authorized actions broadly by role rather than validating the specific answer object, so an agent (or similarly scoped user) could reach attachments they should not be able to modify or even see. The vendor fixed the issue in 7.0.2 by delegating authorization to the per-answer policy; no public exploit code was identified at time of analysis, and the impact is confined to the confidentiality and integrity of knowledge base attachments rather than code execution or availability.
Authenticated store customers can seize other shoppers' guest carts in Spree Commerce by calling PATCH /api/v3/store/carts/:id/associate with a derivable, reversible prefixed cart ID, gaining access to the cart's billing and shipping address data and disrupting the guest's in-progress checkout. The flaw affects the 5.4.x line from 5.4.0 and the 5.5.x line up to but not including the fixed releases 5.4.4 and 5.5.4, and only manifests on stores that permit guest checkout and where an eligible guest cart containing address data exists. Rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), this is a genuine but moderate IDOR-style authorization weakness rather than an unauthenticated takeover; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 87.4%.
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.
Playlist enumeration in Black Candy through 3.2.1 allows any authenticated user to retrieve the names of every playlist hosted on the instance, including those belonging to other accounts. The playlist search code paths (SearchController and Search::PlaylistsController) do not scope results to the session user, so blank or targeted query parameters return cross-user playlist names; exploitation requires a valid account (CVSS 4.0 PR:L, independently assessed CVSS 3.1 5.3 with C:L/I:N/A:N) and network reachability to the web interface. Exposure is confined to playlist names - no playlist content, credentials, integrity, or availability impact - and no public exploit has been identified at time of analysis.
Open redirect in e621ng before 26.09.16 lets remote attackers rewrite pagination and navigation links to attacker-controlled origins: query parameters named host, protocol, and port are handed to Rails' url_for, which treats them as URL-generation options rather than ordinary search filters, so the Previous/Next and numbered-page links rendered by PaginatorComponent, several controllers, and the search-trend views point at a malicious domain while the page itself still loads from the legitimate instance. No authentication is required (PR:N) and the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation hinges on user interaction - the victim must open an attacker-supplied URL and then click a poisoned link, which is why the issue carries a modest CVSS 4.0 score of 5.3 and an assessed limited-severity rating. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor has released a fix in 26.09.16.
Server-side request forgery in Chatwoot's Shopify OAuth integration allows an authenticated user to make the Chatwoot server issue attacker-influenced outbound HTTP requests through the OAuth callback handler in callbacks_controller.rb, affecting versions up to 4.17.1 (4.17.0 and 4.17.1 confirmed). The CVSS 4.0 vector carries PR:L, so a valid Chatwoot account is required, and the assessed impact is low (limited confidentiality effect with no scope change), consistent with a constrained or blind SSRF rather than arbitrary internal data retrieval. Publicly available exploit code exists and the issue was reported to the project without a vendor response, but there is no evidence of confirmed active exploitation (not in CISA KEV); the overall risk is low-priority.
SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.
Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.8%.
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable.
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity.
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 18.2%.
SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Unauthenticated remote code execution is achievable in Square Squash (all versions through commit e73f280) through a two-stage YAML deserialization path in the symbolication API. An attacker first stores crafted YAML under a chosen symbolication UUID using the unauthenticated POST /api/1.0/symbolication endpoint; the payload only detonates when occurrences referencing that UUID are later processed by the symbolication worker, at which point the stored value is passed to YAML.load with SafeYAML running in unsafe mode, permitting arbitrary Ruby object instantiation and code execution. Publicly available exploit code exists, and no CISA KEV listing confirms active exploitation; exploitation is deferred rather than immediate, which is why the assessed complexity is high (AC:H) despite requiring no authentication or user interaction.
Basecamp's Upright authentication library contains a login cross-site request forgery (CSRF) flaw in the static-credentials session callback implemented in app/controllers/upright/sessions_controller.rb, where the login action is not protected by an anti-CSRF token. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R, unauthenticated remote attackers can exploit it, but success depends on victim interaction - the victim must load or be redirected to an attacker-controlled page that submits the forged login request while Upright's static-credentials session flow is exposed. The practical consequence is that the victim is silently logged into the attacker's session rather than having their own account compromised, so our independent assessment rates the impact as partial (C:L/I:L/A:N) even though MITRE assigned 8.8 (C:H/I:H/A:H); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Zammad versions prior to 7.0.2 contain an insecure direct object reference (CWE-639) in the knowledge base answer attachment endpoints, allowing an authenticated user with limited knowledge-base permissions to create, delete, or clone attachments on answers outside their assigned access scope. The flaw stems from controller policies that authorized actions broadly by role rather than validating the specific answer object, so an agent (or similarly scoped user) could reach attachments they should not be able to modify or even see. The vendor fixed the issue in 7.0.2 by delegating authorization to the per-answer policy; no public exploit code was identified at time of analysis, and the impact is confined to the confidentiality and integrity of knowledge base attachments rather than code execution or availability.
Authenticated store customers can seize other shoppers' guest carts in Spree Commerce by calling PATCH /api/v3/store/carts/:id/associate with a derivable, reversible prefixed cart ID, gaining access to the cart's billing and shipping address data and disrupting the guest's in-progress checkout. The flaw affects the 5.4.x line from 5.4.0 and the 5.5.x line up to but not including the fixed releases 5.4.4 and 5.5.4, and only manifests on stores that permit guest checkout and where an eligible guest cart containing address data exists. Rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), this is a genuine but moderate IDOR-style authorization weakness rather than an unauthenticated takeover; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 87.4%.
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.
Playlist enumeration in Black Candy through 3.2.1 allows any authenticated user to retrieve the names of every playlist hosted on the instance, including those belonging to other accounts. The playlist search code paths (SearchController and Search::PlaylistsController) do not scope results to the session user, so blank or targeted query parameters return cross-user playlist names; exploitation requires a valid account (CVSS 4.0 PR:L, independently assessed CVSS 3.1 5.3 with C:L/I:N/A:N) and network reachability to the web interface. Exposure is confined to playlist names - no playlist content, credentials, integrity, or availability impact - and no public exploit has been identified at time of analysis.
Open redirect in e621ng before 26.09.16 lets remote attackers rewrite pagination and navigation links to attacker-controlled origins: query parameters named host, protocol, and port are handed to Rails' url_for, which treats them as URL-generation options rather than ordinary search filters, so the Previous/Next and numbered-page links rendered by PaginatorComponent, several controllers, and the search-trend views point at a malicious domain while the page itself still loads from the legitimate instance. No authentication is required (PR:N) and the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation hinges on user interaction - the victim must open an attacker-supplied URL and then click a poisoned link, which is why the issue carries a modest CVSS 4.0 score of 5.3 and an assessed limited-severity rating. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor has released a fix in 26.09.16.
Server-side request forgery in Chatwoot's Shopify OAuth integration allows an authenticated user to make the Chatwoot server issue attacker-influenced outbound HTTP requests through the OAuth callback handler in callbacks_controller.rb, affecting versions up to 4.17.1 (4.17.0 and 4.17.1 confirmed). The CVSS 4.0 vector carries PR:L, so a valid Chatwoot account is required, and the assessed impact is low (limited confidentiality effect with no scope change), consistent with a constrained or blind SSRF rather than arbitrary internal data retrieval. Publicly available exploit code exists and the issue was reported to the project without a vendor response, but there is no evidence of confirmed active exploitation (not in CISA KEV); the overall risk is low-priority.
SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.
Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.8%.
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable.
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity.
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 18.2%.
SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.