Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:gem/actionpack@3.2.0
Typegem
Namespace
Nameactionpack
Version3.2.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version8.1.2.1
Latest_non_vulnerable_version8.1.2.1
Affected_by_vulnerabilities
0
url VCID-1b9z-efz6-9fdu
vulnerability_id VCID-1b9z-efz6-9fdu
summary 
actionpack Improper Input Validation vulnerability
The template selection functionality in `actionpack/lib/action_view/template/resolver.rb` in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/cbbbba6e4f7eaf61?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/cbbbba6e4f7eaf61?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-2929
reference_id
reference_type
scores
0
value 0.00814
scoring_system epss
scoring_elements 0.7458
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-2929
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=731432
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=731432
5
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
6
reference_url https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552
7
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-2929.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-2929.yml
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-2929
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-2929
9
reference_url https://rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
10
reference_url http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
11
reference_url http://www.openwall.com/lists/oss-security/2011/08/17/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/17/1
12
reference_url http://www.openwall.com/lists/oss-security/2011/08/19/11
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/19/11
13
reference_url http://www.openwall.com/lists/oss-security/2011/08/20/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/20/1
14
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/13
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/13
15
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/14
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/14
16
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/5
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/5
17
reference_url https://github.com/advisories/GHSA-r7q2-5gqg-6c7q
reference_id GHSA-r7q2-5gqg-6c7q
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-r7q2-5gqg-6c7q
18
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
aliases CVE-2011-2929, GHSA-r7q2-5gqg-6c7q
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1b9z-efz6-9fdu
1
url VCID-1xbd-73qv-mff9
vulnerability_id VCID-1xbd-73qv-mff9
summary 
actionpack Improper Authentication vulnerability
The `decode_credentials` method in `actionpack/lib/action_controller/metal/http_authentication.rb` in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a `with_http_digest` helper method, as demonstrated by the `authenticate_or_request_with_http_digest` method.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
1
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3424.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3424.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-3424
reference_id
reference_type
scores
0
value 0.00981
scoring_system epss
scoring_elements 0.7707
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-3424
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rails/rails/commit/3719bd3e95523c5518507dbe44f260f252930600
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/3719bd3e95523c5518507dbe44f260f252930600
6
reference_url https://groups.google.com/group/rubyonrails-security/msg/244d32f2fa25147d?hl=en&dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/244d32f2fa25147d?hl=en&dmode=source&output=gplain
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-3424
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-3424
8
reference_url http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=843711
reference_id 843711
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=843711
10
reference_url https://github.com/advisories/GHSA-92w9-2pqw-rhjj
reference_id GHSA-92w9-2pqw-rhjj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-92w9-2pqw-rhjj
11
reference_url https://access.redhat.com/errata/RHSA-2012:1542
reference_id RHSA-2012:1542
reference_type
scores
url https://access.redhat.com/errata/RHSA-2012:1542
12
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
fixed_packages
0
url pkg:gem/actionpack@3.2.7
purl pkg:gem/actionpack@3.2.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-3rn4-abmh-nkhv
3
vulnerability VCID-4bzb-ft3d-dkgg
4
vulnerability VCID-58sa-6uag-z7hp
5
vulnerability VCID-5pfg-7ntp-eff4
6
vulnerability VCID-5psk-hzaf-1kbz
7
vulnerability VCID-832g-x9kb-3bbx
8
vulnerability VCID-8nkw-8mka-1ygk
9
vulnerability VCID-98gu-r7wd-cuah
10
vulnerability VCID-9gqn-8g4t-wfby
11
vulnerability VCID-a6wp-n5yh-ybcv
12
vulnerability VCID-b4sv-b9pz-r7er
13
vulnerability VCID-bfbp-7umh-2fcp
14
vulnerability VCID-brwd-e9kx-xuc2
15
vulnerability VCID-cs1f-uhb2-xkcm
16
vulnerability VCID-dd87-gevs-juhe
17
vulnerability VCID-eeru-6pyc-8bcd
18
vulnerability VCID-ejgq-s79w-abd6
19
vulnerability VCID-g13k-qvy7-q3fk
20
vulnerability VCID-g2a6-uem4-uuce
21
vulnerability VCID-jpj6-wzp3-m3e4
22
vulnerability VCID-k6aw-heeb-wke2
23
vulnerability VCID-mnh7-4rvx-suay
24
vulnerability VCID-n7kh-9mpq-13c7
25
vulnerability VCID-nax4-x97j-9fgr
26
vulnerability VCID-nmz3-ux68-dkfd
27
vulnerability VCID-nnka-c23v-qub7
28
vulnerability VCID-p1yd-keq8-rkh3
29
vulnerability VCID-qth9-abgp-wyaq
30
vulnerability VCID-r6mr-ay8d-nqdd
31
vulnerability VCID-rgw4-mrr9-euda
32
vulnerability VCID-sg9h-7dqr-xugu
33
vulnerability VCID-v2hk-dfbe-5khc
34
vulnerability VCID-v3u5-6bpb-qfgf
35
vulnerability VCID-vhjv-9864-tbcs
36
vulnerability VCID-vs1a-m7ya-rue8
37
vulnerability VCID-y13c-awe3-2bc1
38
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.7
aliases CVE-2012-3424, GHSA-92w9-2pqw-rhjj, OSV-84243
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1xbd-73qv-mff9
2
url VCID-3edd-m27s-a3ek
vulnerability_id VCID-3edd-m27s-a3ek
summary 
actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain `['xyz', nil]` values, a related issue to CVE-2012-2660.
references
0
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
1
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
2
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
3
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
4
reference_url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
6
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-2694.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-2694.json
7
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-2694
reference_id
reference_type
scores
0
value 0.0022
scoring_system epss
scoring_elements 0.44664
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-2694
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/2f3bc0467311781ac1ceb2c8c2b09002c8fe143a
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/2f3bc0467311781ac1ceb2c8c2b09002c8fe143a
10
reference_url https://github.com/rails/rails/commit/c202638225519b5e1a03ebe523b109c948fb0e52
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/c202638225519b5e1a03ebe523b109c948fb0e52
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2694.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2694.yml
12
reference_url https://groups.google.com/group/rubyonrails-security/msg/e2d3a87f2c211def?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/e2d3a87f2c211def?dmode=source&output=gplain
13
reference_url https://groups.google.com/g/rubyonrails-security/c/jILZ34tAHF4/m/7x0hLH-o0-IJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/jILZ34tAHF4/m/7x0hLH-o0-IJ
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-2694
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-2694
15
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=831581
reference_id 831581
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=831581
16
reference_url https://github.com/advisories/GHSA-q34c-48gc-m9g8
reference_id GHSA-q34c-48gc-m9g8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-q34c-48gc-m9g8
17
reference_url https://access.redhat.com/errata/RHSA-2012:1542
reference_id RHSA-2012:1542
reference_type
scores
url https://access.redhat.com/errata/RHSA-2012:1542
18
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
fixed_packages
0
url pkg:gem/actionpack@3.2.6
purl pkg:gem/actionpack@3.2.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-1xbd-73qv-mff9
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4bzb-ft3d-dkgg
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5pfg-7ntp-eff4
7
vulnerability VCID-5psk-hzaf-1kbz
8
vulnerability VCID-832g-x9kb-3bbx
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-brwd-e9kx-xuc2
16
vulnerability VCID-cs1f-uhb2-xkcm
17
vulnerability VCID-dd87-gevs-juhe
18
vulnerability VCID-eeru-6pyc-8bcd
19
vulnerability VCID-ejgq-s79w-abd6
20
vulnerability VCID-g13k-qvy7-q3fk
21
vulnerability VCID-g2a6-uem4-uuce
22
vulnerability VCID-jpj6-wzp3-m3e4
23
vulnerability VCID-k6aw-heeb-wke2
24
vulnerability VCID-mnh7-4rvx-suay
25
vulnerability VCID-n7kh-9mpq-13c7
26
vulnerability VCID-nax4-x97j-9fgr
27
vulnerability VCID-nmz3-ux68-dkfd
28
vulnerability VCID-nnka-c23v-qub7
29
vulnerability VCID-p1yd-keq8-rkh3
30
vulnerability VCID-qth9-abgp-wyaq
31
vulnerability VCID-r6mr-ay8d-nqdd
32
vulnerability VCID-rgw4-mrr9-euda
33
vulnerability VCID-sg9h-7dqr-xugu
34
vulnerability VCID-v2hk-dfbe-5khc
35
vulnerability VCID-v3u5-6bpb-qfgf
36
vulnerability VCID-vhjv-9864-tbcs
37
vulnerability VCID-vs1a-m7ya-rue8
38
vulnerability VCID-y13c-awe3-2bc1
39
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.6
aliases CVE-2012-2694, GHSA-q34c-48gc-m9g8
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3edd-m27s-a3ek
3
url VCID-3rn4-abmh-nkhv
vulnerability_id VCID-3rn4-abmh-nkhv
summary 
actionpack allows bypass of database-query restrictions
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
1
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
2
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
3
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
4
reference_url http://rhn.redhat.com/errata/RHSA-2013-1794.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-1794.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2014-0008.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0008.html
6
reference_url http://rhn.redhat.com/errata/RHSA-2014-0469.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0469.html
7
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6417.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6417.json
8
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-6417
reference_id
reference_type
scores
0
value 0.00512
scoring_system epss
scoring_elements 0.66784
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-6417
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
14
reference_url http://seclists.org/oss-sec/2013/q4/403
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/403
15
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
16
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6417.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6417.yml
17
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ
18
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/niK4drpSHT4
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/niK4drpSHT4
19
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-6417
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-6417
20
reference_url https://puppet.com/security/cve/cve-2013-6417
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://puppet.com/security/cve/cve-2013-6417
21
reference_url https://web.archive.org/web/20160806051251/https://puppet.com/security/cve/cve-2013-6417
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160806051251/https://puppet.com/security/cve/cve-2013-6417
22
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
23
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
24
reference_url http://www.debian.org/security/2014/dsa-2888
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2014/dsa-2888
25
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036409
reference_id 1036409
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036409
26
reference_url https://github.com/advisories/GHSA-wpw7-wxjm-cw8r
reference_id GHSA-wpw7-wxjm-cw8r
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wpw7-wxjm-cw8r
27
reference_url https://access.redhat.com/errata/RHSA-2013:1794
reference_id RHSA-2013:1794
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:1794
28
reference_url https://access.redhat.com/errata/RHSA-2014:0008
reference_id RHSA-2014:0008
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0008
29
reference_url https://access.redhat.com/errata/RHSA-2014:0469
reference_id RHSA-2014:0469
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0469
fixed_packages
0
url pkg:gem/actionpack@3.2.16
purl pkg:gem/actionpack@3.2.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-b4sv-b9pz-r7er
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-jpj6-wzp3-m3e4
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-mnh7-4rvx-suay
18
vulnerability VCID-n7kh-9mpq-13c7
19
vulnerability VCID-nmz3-ux68-dkfd
20
vulnerability VCID-p1yd-keq8-rkh3
21
vulnerability VCID-qth9-abgp-wyaq
22
vulnerability VCID-r6mr-ay8d-nqdd
23
vulnerability VCID-sg9h-7dqr-xugu
24
vulnerability VCID-v2hk-dfbe-5khc
25
vulnerability VCID-v3u5-6bpb-qfgf
26
vulnerability VCID-vs1a-m7ya-rue8
27
vulnerability VCID-y13c-awe3-2bc1
28
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.16
1
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-vs1a-m7ya-rue8
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-6417, GHSA-wpw7-wxjm-cw8r, OSV-100527
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3rn4-abmh-nkhv
4
url VCID-4bzb-ft3d-dkgg
vulnerability_id VCID-4bzb-ft3d-dkgg
summary 
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_tag_helper.rb` in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the `prompt` field to the `select_tag` helper.
references
0
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3463.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3463.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-3463
reference_id
reference_type
scores
0
value 0.00333
scoring_system epss
scoring_elements 0.56331
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-3463
3
reference_url https://github.com/rails/rails/commit/6d0526db91afb0675c2ad3d871529d1536303c64
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/6d0526db91afb0675c2ad3d871529d1536303c64
4
reference_url https://groups.google.com/forum/?fromgroups=#!searchin/rubyonrails-security/3463/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ
reference_id
reference_type
scores
url https://groups.google.com/forum/?fromgroups=#!searchin/rubyonrails-security/3463/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ
5
reference_url https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source&output=gplain
6
reference_url https://groups.google.com/g/rubyonrails-security/c/fV3QUToSMSw/m/eHBSFOUYHpYJ?pli=1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/fV3QUToSMSw/m/eHBSFOUYHpYJ?pli=1
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-3463
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-3463
8
reference_url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released
9
reference_url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=847196
reference_id 847196
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=847196
11
reference_url https://github.com/advisories/GHSA-98mf-8f57-64qf
reference_id GHSA-98mf-8f57-64qf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-98mf-8f57-64qf
12
reference_url https://access.redhat.com/errata/RHSA-2012:1542
reference_id RHSA-2012:1542
reference_type
scores
url https://access.redhat.com/errata/RHSA-2012:1542
13
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
fixed_packages
0
url pkg:gem/actionpack@3.2.8
purl pkg:gem/actionpack@3.2.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-3rn4-abmh-nkhv
3
vulnerability VCID-58sa-6uag-z7hp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-5psk-hzaf-1kbz
6
vulnerability VCID-832g-x9kb-3bbx
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-9gqn-8g4t-wfby
10
vulnerability VCID-a6wp-n5yh-ybcv
11
vulnerability VCID-b4sv-b9pz-r7er
12
vulnerability VCID-bfbp-7umh-2fcp
13
vulnerability VCID-brwd-e9kx-xuc2
14
vulnerability VCID-cs1f-uhb2-xkcm
15
vulnerability VCID-dd87-gevs-juhe
16
vulnerability VCID-eeru-6pyc-8bcd
17
vulnerability VCID-ejgq-s79w-abd6
18
vulnerability VCID-g13k-qvy7-q3fk
19
vulnerability VCID-g2a6-uem4-uuce
20
vulnerability VCID-jpj6-wzp3-m3e4
21
vulnerability VCID-k6aw-heeb-wke2
22
vulnerability VCID-mnh7-4rvx-suay
23
vulnerability VCID-n7kh-9mpq-13c7
24
vulnerability VCID-nax4-x97j-9fgr
25
vulnerability VCID-nmz3-ux68-dkfd
26
vulnerability VCID-nnka-c23v-qub7
27
vulnerability VCID-p1yd-keq8-rkh3
28
vulnerability VCID-qth9-abgp-wyaq
29
vulnerability VCID-r6mr-ay8d-nqdd
30
vulnerability VCID-sg9h-7dqr-xugu
31
vulnerability VCID-v2hk-dfbe-5khc
32
vulnerability VCID-v3u5-6bpb-qfgf
33
vulnerability VCID-vhjv-9864-tbcs
34
vulnerability VCID-vs1a-m7ya-rue8
35
vulnerability VCID-y13c-awe3-2bc1
36
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.8
aliases CVE-2012-3463, GHSA-98mf-8f57-64qf, OSV-84515
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4bzb-ft3d-dkgg
5
url VCID-58sa-6uag-z7hp
vulnerability_id VCID-58sa-6uag-z7hp
summary 
actionpack Improper Input Validation vulnerability
`active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
references
0
reference_url http://rhn.redhat.com/errata/RHSA-2013-0153.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0153.html
1
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
2
reference_url http://rhn.redhat.com/errata/RHSA-2013-0155.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0155.html
3
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-0156.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-0156.json
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-0156
reference_id
reference_type
scores
0
value 0.91907
scoring_system epss
scoring_elements 0.99708
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-0156
5
reference_url https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156
7
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
8
reference_url https://groups.google.com/forum/?fromgroups=#!searchin/rubyonrails-security/2013-0156/rubyonrails-security/61bkgvnSGTQ/nehwjA8tQ8EJ
reference_id
reference_type
scores
url https://groups.google.com/forum/?fromgroups=#!searchin/rubyonrails-security/2013-0156/rubyonrails-security/61bkgvnSGTQ/nehwjA8tQ8EJ
9
reference_url https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-0156
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-0156
11
reference_url https://web.archive.org/web/20140111025708/http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20140111025708/http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
12
reference_url https://web.archive.org/web/20160415043747/https://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160415043747/https://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
13
reference_url https://web.archive.org/web/20160806154149/https://puppet.com/security/cve/cve-2013-0156
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160806154149/https://puppet.com/security/cve/cve-2013-0156
14
reference_url http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released
15
reference_url http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
16
reference_url http://www.debian.org/security/2013/dsa-2604
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2013/dsa-2604
17
reference_url http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
18
reference_url http://www.insinuator.net/2013/01/rails-yaml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.insinuator.net/2013/01/rails-yaml
19
reference_url http://www.insinuator.net/2013/01/rails-yaml/
reference_id
reference_type
scores
url http://www.insinuator.net/2013/01/rails-yaml/
20
reference_url http://www.kb.cert.org/vuls/id/380039
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.kb.cert.org/vuls/id/380039
21
reference_url http://www.kb.cert.org/vuls/id/628463
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.kb.cert.org/vuls/id/628463
22
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697722
reference_id 697722
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697722
23
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=892870
reference_id 892870
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=892870
24
reference_url https://web.archive.org/web/20160806154149/https://puppet.com/security/cve/cve-2013-0156/
reference_id CVE-2013-0156
reference_type
scores
url https://web.archive.org/web/20160806154149/https://puppet.com/security/cve/cve-2013-0156/
25
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/24019.rb
reference_id CVE-2013-0156;OSVDB-89026
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/24019.rb
26
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/27527.rb
reference_id CVE-2013-0156;OSVDB-89026
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/27527.rb
27
reference_url https://github.com/advisories/GHSA-jmgw-6vjg-jjwg
reference_id GHSA-jmgw-6vjg-jjwg
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-jmgw-6vjg-jjwg
28
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
29
reference_url https://access.redhat.com/errata/RHSA-2013:0153
reference_id RHSA-2013:0153
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0153
30
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
31
reference_url https://access.redhat.com/errata/RHSA-2013:0155
reference_id RHSA-2013:0155
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0155
fixed_packages
0
url pkg:gem/actionpack@3.2.11
purl pkg:gem/actionpack@3.2.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-3rn4-abmh-nkhv
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-5psk-hzaf-1kbz
5
vulnerability VCID-832g-x9kb-3bbx
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-9gqn-8g4t-wfby
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-cs1f-uhb2-xkcm
14
vulnerability VCID-dd87-gevs-juhe
15
vulnerability VCID-eeru-6pyc-8bcd
16
vulnerability VCID-ejgq-s79w-abd6
17
vulnerability VCID-g13k-qvy7-q3fk
18
vulnerability VCID-g2a6-uem4-uuce
19
vulnerability VCID-jpj6-wzp3-m3e4
20
vulnerability VCID-k6aw-heeb-wke2
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nax4-x97j-9fgr
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-nnka-c23v-qub7
26
vulnerability VCID-p1yd-keq8-rkh3
27
vulnerability VCID-qth9-abgp-wyaq
28
vulnerability VCID-r6mr-ay8d-nqdd
29
vulnerability VCID-sg9h-7dqr-xugu
30
vulnerability VCID-v2hk-dfbe-5khc
31
vulnerability VCID-v3u5-6bpb-qfgf
32
vulnerability VCID-vhjv-9864-tbcs
33
vulnerability VCID-vs1a-m7ya-rue8
34
vulnerability VCID-y13c-awe3-2bc1
35
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.11
aliases CVE-2013-0156, GHSA-jmgw-6vjg-jjwg, OSV-89026
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-58sa-6uag-z7hp
6
url VCID-5a2t-fre4-zkay
vulnerability_id VCID-5a2t-fre4-zkay
summary 
Cross-site Scripting in actionpack
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_options_helper.rb` in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/6fca4f5c47705488?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/6fca4f5c47705488?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075740.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075740.html
3
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-1099.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-1099.json
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-1099
reference_id
reference_type
scores
0
value 0.00399
scoring_system epss
scoring_elements 0.60937
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-1099
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=799276
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=799276
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1099
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1099
7
reference_url https://github.com/advisories/GHSA-2xjj-5x6h-8vmf
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-2xjj-5x6h-8vmf
8
reference_url https://github.com/rails/rails/commit/9435f5a479317458c558ae743b7d876dd5a5db20
reference_id
reference_type
scores
url https://github.com/rails/rails/commit/9435f5a479317458c558ae743b7d876dd5a5db20
9
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-1099.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-1099.yml
10
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/OSVDB-79727.yml
reference_id
reference_type
scores
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/OSVDB-79727.yml
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-1099
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-1099
12
reference_url http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released
13
reference_url http://www.debian.org/security/2012/dsa-2466
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2012/dsa-2466
14
reference_url http://www.openwall.com/lists/oss-security/2012/03/02/6
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2012/03/02/6
15
reference_url http://www.openwall.com/lists/oss-security/2012/03/03/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2012/03/03/1
fixed_packages
0
url pkg:gem/actionpack@3.2.2
purl pkg:gem/actionpack@3.2.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-1xbd-73qv-mff9
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4bzb-ft3d-dkgg
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5pfg-7ntp-eff4
7
vulnerability VCID-5psk-hzaf-1kbz
8
vulnerability VCID-832g-x9kb-3bbx
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-brwd-e9kx-xuc2
16
vulnerability VCID-cs1f-uhb2-xkcm
17
vulnerability VCID-dd87-gevs-juhe
18
vulnerability VCID-eeru-6pyc-8bcd
19
vulnerability VCID-ejgq-s79w-abd6
20
vulnerability VCID-g13k-qvy7-q3fk
21
vulnerability VCID-g2a6-uem4-uuce
22
vulnerability VCID-jpj6-wzp3-m3e4
23
vulnerability VCID-k6aw-heeb-wke2
24
vulnerability VCID-mnh7-4rvx-suay
25
vulnerability VCID-n7kh-9mpq-13c7
26
vulnerability VCID-nax4-x97j-9fgr
27
vulnerability VCID-nmz3-ux68-dkfd
28
vulnerability VCID-nnka-c23v-qub7
29
vulnerability VCID-p1yd-keq8-rkh3
30
vulnerability VCID-qth9-abgp-wyaq
31
vulnerability VCID-r6mr-ay8d-nqdd
32
vulnerability VCID-rgw4-mrr9-euda
33
vulnerability VCID-sg9h-7dqr-xugu
34
vulnerability VCID-v2hk-dfbe-5khc
35
vulnerability VCID-v3u5-6bpb-qfgf
36
vulnerability VCID-vhjv-9864-tbcs
37
vulnerability VCID-vs1a-m7ya-rue8
38
vulnerability VCID-y13c-awe3-2bc1
39
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.2
aliases CVE-2012-1099, GHSA-2xjj-5x6h-8vmf, OSV-79727
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5a2t-fre4-zkay
7
url VCID-5pfg-7ntp-eff4
vulnerability_id VCID-5pfg-7ntp-eff4
summary 
Cross-site Scripting vulnerability in i18n translations helper method
Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5?pli=1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5?pli=1
1
reference_url http://groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain
2
reference_url http://openwall.com/lists/oss-security/2011/11/18/8
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://openwall.com/lists/oss-security/2011/11/18/8
3
reference_url http://osvdb.org/77199
reference_id
reference_type
scores
url http://osvdb.org/77199
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-4319.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-4319.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-4319
reference_id
reference_type
scores
0
value 0.00607
scoring_system epss
scoring_elements 0.70015
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-4319
6
reference_url https://exchange.xforce.ibmcloud.com/vulnerabilities/71364
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://exchange.xforce.ibmcloud.com/vulnerabilities/71364
7
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
8
reference_url https://github.com/rails/rails/commit/2d5b105d4bcb652550dda8b5613376d1b8beb70c
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/2d5b105d4bcb652550dda8b5613376d1b8beb70c
9
reference_url https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade
10
reference_url https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade#diff-79e8a3e6d1d2808c4f93f63b3928a5a1
reference_id
reference_type
scores
url https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade#diff-79e8a3e6d1d2808c4f93f63b3928a5a1
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-4319.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-4319.yml
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/OSVDB-77199.yml
reference_id
reference_type
scores
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/OSVDB-77199.yml
13
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/K2HXD7c8fMU
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/K2HXD7c8fMU
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-4319
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-4319
15
reference_url https://web.archive.org/web/20200228155840/http://www.securityfocus.com/bid/50722
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200228155840/http://www.securityfocus.com/bid/50722
16
reference_url https://web.archive.org/web/20210307005941/http://www.securitytracker.com/id?1026342
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210307005941/http://www.securitytracker.com/id?1026342
17
reference_url http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released
18
reference_url http://weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released
19
reference_url http://www.securityfocus.com/bid/50722
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/50722
20
reference_url http://www.securitytracker.com/id?1026342
reference_id
reference_type
scores
url http://www.securitytracker.com/id?1026342
21
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=755004
reference_id 755004
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=755004
22
reference_url https://github.com/advisories/GHSA-xxr8-833v-c7wc
reference_id GHSA-xxr8-833v-c7wc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-xxr8-833v-c7wc
fixed_packages
aliases CVE-2011-4319, GHSA-xxr8-833v-c7wc, OSV-77199
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5pfg-7ntp-eff4
8
url VCID-5psk-hzaf-1kbz
vulnerability_id VCID-5psk-hzaf-1kbz
summary 
actionpack vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/translation_helper.rb` in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
references
0
reference_url http://rhn.redhat.com/errata/RHSA-2013-1794.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-1794.html
1
reference_url http://rhn.redhat.com/errata/RHSA-2014-0008.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0008.html
2
reference_url http://rhn.redhat.com/errata/RHSA-2014-1863.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-1863.html
3
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4491.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4491.json
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-4491
reference_id
reference_type
scores
0
value 0.00713
scoring_system epss
scoring_elements 0.72631
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-4491
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
10
reference_url http://seclists.org/oss-sec/2013/q4/401
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/401
11
reference_url https://github.com/advisories/GHSA-699m-mcjm-9cw8
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-699m-mcjm-9cw8
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-4491.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-4491.yml
13
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-4491
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-4491
15
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
16
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
17
reference_url http://www.debian.org/security/2014/dsa-2888
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2014/dsa-2888
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036922
reference_id 1036922
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036922
19
reference_url https://access.redhat.com/errata/RHSA-2013:1794
reference_id RHSA-2013:1794
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:1794
20
reference_url https://access.redhat.com/errata/RHSA-2014:0008
reference_id RHSA-2014:0008
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0008
fixed_packages
0
url pkg:gem/actionpack@3.2.16
purl pkg:gem/actionpack@3.2.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-b4sv-b9pz-r7er
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-jpj6-wzp3-m3e4
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-mnh7-4rvx-suay
18
vulnerability VCID-n7kh-9mpq-13c7
19
vulnerability VCID-nmz3-ux68-dkfd
20
vulnerability VCID-p1yd-keq8-rkh3
21
vulnerability VCID-qth9-abgp-wyaq
22
vulnerability VCID-r6mr-ay8d-nqdd
23
vulnerability VCID-sg9h-7dqr-xugu
24
vulnerability VCID-v2hk-dfbe-5khc
25
vulnerability VCID-v3u5-6bpb-qfgf
26
vulnerability VCID-vs1a-m7ya-rue8
27
vulnerability VCID-y13c-awe3-2bc1
28
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.16
1
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-vs1a-m7ya-rue8
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-4491, GHSA-699m-mcjm-9cw8, OSV-100528
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5psk-hzaf-1kbz
9
url VCID-832g-x9kb-3bbx
vulnerability_id VCID-832g-x9kb-3bbx
summary 
actionview contains Path Traversal vulnerability
There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all possible scenarios. This vulnerability has been assigned the CVE identifier CVE-2016-2097.

Versions Affected:  3.2.x, 4.0.x, 4.1.x
Not affected:       4.2+
Fixed Versions:     3.2.22.2, 4.1.14.2

Impact
------
Applications that pass unverified user input to the `render` method in a controller may be vulnerable to an information leak vulnerability.

Impacted code will look something like this:

```ruby
def index
  render params[:id]
end
```

Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
A workaround to this issue is to not pass arbitrary user input to the `render` method. Instead, verify that data before passing it to the `render` method.

For example, change this:

```ruby
def index
  render params[:id]
end
```

To this:

```ruby
def index
  render verify_template(params[:id])
end

private
def verify_template(name)
  # add verification logic particular to your application here
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for it. It is in git-am format and consist of a single changeset.

* 3-2-render_data_leak_2.patch - Patch for 3.2 series
* 4-1-render_data_leak_2.patch - Patch for 4.1 series

Credits
-------
Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this and working with us in the patch!
references
0
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
1
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
2
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
3
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2097.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2097.json
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-2097
reference_id
reference_type
scores
0
value 0.01912
scoring_system epss
scoring_elements 0.83603
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-2097
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2097
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2097
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2098
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2098
7
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:N/C:P/I:P/A:P
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/8a1d3ea617ffb0c8ae8467fa439bf63a3bfc4324
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/8a1d3ea617ffb0c8ae8467fa439bf63a3bfc4324
10
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2097.yml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2097.yml
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2016-2097.yml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2016-2097.yml
12
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/ddY6HgqB2z4
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements
1
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/ddY6HgqB2z4
13
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/ddY6HgqB2z4
reference_id
reference_type
scores
url https://groups.google.com/forum/#!topic/ruby-security-ann/ddY6HgqB2z4
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-2097
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-2097
15
reference_url https://web.archive.org/web/20160322002234/http://www.securitytracker.com/id/1035122
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160322002234/http://www.securitytracker.com/id/1035122
16
reference_url https://web.archive.org/web/20200228015320/http://www.securityfocus.com/bid/83726
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200228015320/http://www.securityfocus.com/bid/83726
17
reference_url https://web.archive.org/web/20201221115217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201221115217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ
18
reference_url http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released
19
reference_url http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
20
reference_url http://www.debian.org/security/2016/dsa-3509
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2016/dsa-3509
21
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1310043
reference_id 1310043
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1310043
22
reference_url https://github.com/advisories/GHSA-vx9j-46rh-fqr8
reference_id GHSA-vx9j-46rh-fqr8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vx9j-46rh-fqr8
23
reference_url https://access.redhat.com/errata/RHSA-2016:0454
reference_id RHSA-2016:0454
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0454
24
reference_url https://access.redhat.com/errata/RHSA-2016:0455
reference_id RHSA-2016:0455
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0455
25
reference_url https://access.redhat.com/errata/RHSA-2016:0456
reference_id RHSA-2016:0456
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0456
fixed_packages
0
url pkg:gem/actionpack@3.2.22.2
purl pkg:gem/actionpack@3.2.22.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-b4sv-b9pz-r7er
7
vulnerability VCID-bfbp-7umh-2fcp
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-mnh7-4rvx-suay
15
vulnerability VCID-n7kh-9mpq-13c7
16
vulnerability VCID-nmz3-ux68-dkfd
17
vulnerability VCID-p1yd-keq8-rkh3
18
vulnerability VCID-qth9-abgp-wyaq
19
vulnerability VCID-v2hk-dfbe-5khc
20
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.22.2
1
url pkg:gem/actionpack@4.1.14.2
purl pkg:gem/actionpack@4.1.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-dd87-gevs-juhe
8
vulnerability VCID-eeru-6pyc-8bcd
9
vulnerability VCID-ejgq-s79w-abd6
10
vulnerability VCID-g13k-qvy7-q3fk
11
vulnerability VCID-g2a6-uem4-uuce
12
vulnerability VCID-k6aw-heeb-wke2
13
vulnerability VCID-mnh7-4rvx-suay
14
vulnerability VCID-n7kh-9mpq-13c7
15
vulnerability VCID-nmz3-ux68-dkfd
16
vulnerability VCID-p1yd-keq8-rkh3
17
vulnerability VCID-qth9-abgp-wyaq
18
vulnerability VCID-v2hk-dfbe-5khc
19
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.14.2
aliases CVE-2016-2097, GHSA-vx9j-46rh-fqr8
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-832g-x9kb-3bbx
10
url VCID-8nkw-8mka-1ygk
vulnerability_id VCID-8nkw-8mka-1ygk
summary 
actionpack Improper Input Validation vulnerability
The `to_s` method in `actionpack/lib/action_dispatch/middleware/remote_ip.rb` in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
references
0
reference_url http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html
reference_id
reference_type
scores
url http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-3187
reference_id
reference_type
scores
0
value 0.08484
scoring_system epss
scoring_elements 0.92485
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-3187
2
reference_url https://bugzilla.novell.com/show_bug.cgi?id=673010
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.novell.com/show_bug.cgi?id=673010
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3187
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3187
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-3187.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-3187.yml
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-3187
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-3187
7
reference_url https://web.archive.org/web/20111209181000/http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20111209181000/http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html
8
reference_url http://webservsec.blogspot.com/2011/02/ruby-on-rails-vulnerability.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://webservsec.blogspot.com/2011/02/ruby-on-rails-vulnerability.html
9
reference_url http://www.openwall.com/lists/oss-security/2011/08/17/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/17/1
10
reference_url http://www.openwall.com/lists/oss-security/2011/08/19/11
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/19/11
11
reference_url http://www.openwall.com/lists/oss-security/2011/08/20/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/20/1
12
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/13
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/13
13
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/14
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/14
14
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/5
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/5
15
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/35352.rb
reference_id CVE-2011-3187;OSVDB-73733
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/35352.rb
16
reference_url https://www.securityfocus.com/bid/46423/info
reference_id CVE-2011-3187;OSVDB-73733
reference_type exploit
scores
url https://www.securityfocus.com/bid/46423/info
17
reference_url https://github.com/advisories/GHSA-3vfw-7rcp-3xgm
reference_id GHSA-3vfw-7rcp-3xgm
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3vfw-7rcp-3xgm
fixed_packages
aliases CVE-2011-3187, GHSA-3vfw-7rcp-3xgm
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8nkw-8mka-1ygk
11
url VCID-98gu-r7wd-cuah
vulnerability_id VCID-98gu-r7wd-cuah
summary 
ReDoS based DoS vulnerability in Action Dispatch
There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.

Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact

Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious X_FORWARDED_HOST headers before they reach the application.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series
    7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22792.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22792.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-22792
reference_id
reference_type
scores
0
value 0.02326
scoring_system epss
scoring_elements 0.85075
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-22792
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22942
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22942
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21831
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21831
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27777
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27777
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22792
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22792
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22794
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22794
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796
12
reference_url https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-24T20:30:13Z/
url https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115
13
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
14
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
15
reference_url https://github.com/rails/rails/releases/tag/v7.0.4.1
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v7.0.4.1
16
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22792.yml
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22792.yml
17
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-22792
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-22792
18
reference_url https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
19
reference_url https://security.netapp.com/advisory/ntap-20240202-0007
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20240202-0007
20
reference_url https://www.debian.org/security/2023/dsa-5372
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-24T20:30:13Z/
url https://www.debian.org/security/2023/dsa-5372
21
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1030050
reference_id 1030050
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1030050
22
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2164800
reference_id 2164800
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2164800
23
reference_url https://github.com/advisories/GHSA-p84v-45xj-wwqj
reference_id GHSA-p84v-45xj-wwqj
reference_type
scores
url https://github.com/advisories/GHSA-p84v-45xj-wwqj
24
reference_url https://security.netapp.com/advisory/ntap-20240202-0007/
reference_id ntap-20240202-0007
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-24T20:30:13Z/
url https://security.netapp.com/advisory/ntap-20240202-0007/
25
reference_url https://access.redhat.com/errata/RHSA-2023:6818
reference_id RHSA-2023:6818
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:6818
fixed_packages
0
url pkg:gem/actionpack@5.2.8
purl pkg:gem/actionpack@5.2.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-nmz3-ux68-dkfd
5
vulnerability VCID-qth9-abgp-wyaq
6
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.2.8
1
url pkg:gem/actionpack@5.2.8.15
purl pkg:gem/actionpack@5.2.8.15
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.2.8.15
2
url pkg:gem/actionpack@6.1.7.1
purl pkg:gem/actionpack@6.1.7.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-nmz3-ux68-dkfd
5
vulnerability VCID-qth9-abgp-wyaq
6
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.7.1
3
url pkg:gem/actionpack@7.0.4.1
purl pkg:gem/actionpack@7.0.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-nmz3-ux68-dkfd
5
vulnerability VCID-qth9-abgp-wyaq
6
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.4.1
aliases CVE-2023-22792, GHSA-p84v-45xj-wwqj, GMS-2023-58
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-98gu-r7wd-cuah
12
url VCID-9gqn-8g4t-wfby
vulnerability_id VCID-9gqn-8g4t-wfby
summary 
actionpack Cross-site Scripting vulnerability
The `sanitize_css` method in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle `\n` (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
1
reference_url http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html
2
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
3
reference_url http://rhn.redhat.com/errata/RHSA-2013-0698.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0698.html
4
reference_url http://rhn.redhat.com/errata/RHSA-2014-1863.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-1863.html
5
reference_url https://access.redhat.com/errata/RHSA-2013:0698
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2013:0698
6
reference_url https://access.redhat.com/errata/RHSA-2014:1863
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2014:1863
7
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1855.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1855.json
8
reference_url https://access.redhat.com/security/cve/CVE-2013-1855
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/security/cve/CVE-2013-1855
9
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-1855
reference_id
reference_type
scores
0
value 0.00536
scoring_system epss
scoring_elements 0.67744
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-1855
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=921331
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=921331
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1855
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1855
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-1855.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-1855.yml
13
reference_url https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8
reference_id
reference_type
scores
url https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8
14
reference_url https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain
15
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-1855
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-1855
16
reference_url http://support.apple.com/kb/HT5784
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://support.apple.com/kb/HT5784
17
reference_url https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
18
reference_url https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
19
reference_url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released
20
reference_url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
21
reference_url https://github.com/advisories/GHSA-q759-hwvc-m3jg
reference_id GHSA-q759-hwvc-m3jg
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-q759-hwvc-m3jg
22
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
0
url pkg:gem/actionpack@3.2.13
purl pkg:gem/actionpack@3.2.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-3rn4-abmh-nkhv
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-5psk-hzaf-1kbz
5
vulnerability VCID-832g-x9kb-3bbx
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-9gqn-8g4t-wfby
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-cs1f-uhb2-xkcm
14
vulnerability VCID-dd87-gevs-juhe
15
vulnerability VCID-eeru-6pyc-8bcd
16
vulnerability VCID-ejgq-s79w-abd6
17
vulnerability VCID-g13k-qvy7-q3fk
18
vulnerability VCID-g2a6-uem4-uuce
19
vulnerability VCID-jpj6-wzp3-m3e4
20
vulnerability VCID-k6aw-heeb-wke2
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nax4-x97j-9fgr
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-nnka-c23v-qub7
26
vulnerability VCID-p1yd-keq8-rkh3
27
vulnerability VCID-qth9-abgp-wyaq
28
vulnerability VCID-r6mr-ay8d-nqdd
29
vulnerability VCID-sg9h-7dqr-xugu
30
vulnerability VCID-v2hk-dfbe-5khc
31
vulnerability VCID-v3u5-6bpb-qfgf
32
vulnerability VCID-vhjv-9864-tbcs
33
vulnerability VCID-vs1a-m7ya-rue8
34
vulnerability VCID-y13c-awe3-2bc1
35
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.13
aliases CVE-2013-1855, GHSA-q759-hwvc-m3jg, OSV-91452
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9gqn-8g4t-wfby
13
url VCID-a6wp-n5yh-ybcv
vulnerability_id VCID-a6wp-n5yh-ybcv
summary 
Improper Input Validation in actionpack
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
1
reference_url http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
2
reference_url http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup
3
reference_url http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
reference_id
reference_type
scores
url http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2008-7248.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2008-7248.json
5
reference_url https://access.redhat.com/security/cve/CVE-2008-7248
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/security/cve/CVE-2008-7248
6
reference_url https://api.first.org/data/v1/epss?cve=CVE-2008-7248
reference_id
reference_type
scores
0
value 0.11409
scoring_system epss
scoring_elements 0.93687
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2008-7248
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=544329
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=544329
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7248
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7248
9
reference_url http://secunia.com/advisories/36600
reference_id
reference_type
scores
url http://secunia.com/advisories/36600
10
reference_url http://secunia.com/advisories/38915
reference_id
reference_type
scores
url http://secunia.com/advisories/38915
11
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
12
reference_url https://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a
13
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2008-7248.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2008-7248.yml
14
reference_url https://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
15
reference_url https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
16
reference_url https://nvd.nist.gov/vuln/detail/CVE-2008-7248
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2008-7248
17
reference_url https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup
18
reference_url https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
reference_id
reference_type
scores
url https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
19
reference_url https://web.archive.org/web/20090906010200/https://www.vupen.com/english/advisories/2009/2544
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20090906010200/https://www.vupen.com/english/advisories/2009/2544
20
reference_url https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
21
reference_url https://www.openwall.com/lists/oss-security/2009/11/28/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.openwall.com/lists/oss-security/2009/11/28/1
22
reference_url https://www.openwall.com/lists/oss-security/2009/12/02/2
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.openwall.com/lists/oss-security/2009/12/02/2
23
reference_url https://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
24
reference_url http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
25
reference_url http://www.openwall.com/lists/oss-security/2009/11/28/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2009/11/28/1
26
reference_url http://www.openwall.com/lists/oss-security/2009/12/02/2
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2009/12/02/2
27
reference_url http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
reference_id
reference_type
scores
url http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
28
reference_url http://www.vupen.com/english/advisories/2009/2544
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2009/2544
29
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=558685
reference_id 558685
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=558685
30
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/33402.txt
reference_id CVE-2008-7248;OSVDB-61124
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/33402.txt
31
reference_url https://www.securityfocus.com/bid/37322/info
reference_id CVE-2008-7248;OSVDB-61124
reference_type exploit
scores
url https://www.securityfocus.com/bid/37322/info
32
reference_url https://github.com/advisories/GHSA-8fqx-7pv4-3jwm
reference_id GHSA-8fqx-7pv4-3jwm
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8fqx-7pv4-3jwm
33
reference_url https://security.gentoo.org/glsa/200912-02
reference_id GLSA-200912-02
reference_type
scores
url https://security.gentoo.org/glsa/200912-02
fixed_packages
aliases CVE-2008-7248, GHSA-8fqx-7pv4-3jwm
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-a6wp-n5yh-ybcv
14
url VCID-b4sv-b9pz-r7er
vulnerability_id VCID-b4sv-b9pz-r7er
summary 
actionview Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
references
0
reference_url http://rhn.redhat.com/errata/RHSA-2016-1855.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-1855.html
1
reference_url http://rhn.redhat.com/errata/RHSA-2016-1856.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-1856.html
2
reference_url http://rhn.redhat.com/errata/RHSA-2016-1857.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-1857.html
3
reference_url http://rhn.redhat.com/errata/RHSA-2016-1858.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-1858.html
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-6316.json
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-6316.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-6316
reference_id
reference_type
scores
0
value 0.01626
scoring_system epss
scoring_elements 0.82169
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-6316
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6316
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6316
7
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:N/C:N/I:P/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
8
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml
9
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk
10
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-6316
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-6316
12
reference_url https://web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430
13
reference_url https://web.archive.org/web/20200812154343/https://puppet.com/security/cve/cve-2016-6316
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200812154343/https://puppet.com/security/cve/cve-2016-6316
14
reference_url http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
15
reference_url http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/
16
reference_url http://www.debian.org/security/2016/dsa-3651
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2016/dsa-3651
17
reference_url http://www.openwall.com/lists/oss-security/2016/08/11/3
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2016/08/11/3
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1365008
reference_id 1365008
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1365008
19
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834155
reference_id 834155
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834155
20
reference_url https://github.com/advisories/GHSA-pc3m-v286-2jwj
reference_id GHSA-pc3m-v286-2jwj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-pc3m-v286-2jwj
21
reference_url https://access.redhat.com/errata/RHSA-2016:1855
reference_id RHSA-2016:1855
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:1855
22
reference_url https://access.redhat.com/errata/RHSA-2016:1856
reference_id RHSA-2016:1856
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:1856
23
reference_url https://access.redhat.com/errata/RHSA-2016:1857
reference_id RHSA-2016:1857
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:1857
24
reference_url https://access.redhat.com/errata/RHSA-2016:1858
reference_id RHSA-2016:1858
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:1858
fixed_packages
0
url pkg:gem/actionpack@3.2.22.3
purl pkg:gem/actionpack@3.2.22.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-dd87-gevs-juhe
8
vulnerability VCID-eeru-6pyc-8bcd
9
vulnerability VCID-ejgq-s79w-abd6
10
vulnerability VCID-g13k-qvy7-q3fk
11
vulnerability VCID-g2a6-uem4-uuce
12
vulnerability VCID-k6aw-heeb-wke2
13
vulnerability VCID-mnh7-4rvx-suay
14
vulnerability VCID-n7kh-9mpq-13c7
15
vulnerability VCID-nmz3-ux68-dkfd
16
vulnerability VCID-p1yd-keq8-rkh3
17
vulnerability VCID-qth9-abgp-wyaq
18
vulnerability VCID-v2hk-dfbe-5khc
19
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.22.3
aliases CVE-2016-6316, GHSA-pc3m-v286-2jwj
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-b4sv-b9pz-r7er
15
url VCID-bfbp-7umh-2fcp
vulnerability_id VCID-bfbp-7umh-2fcp
summary 
actionpack and activesupport vulnerable to information leaks
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
references
0
reference_url http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2009-3086
reference_id
reference_type
scores
0
value 0.00556
scoring_system epss
scoring_elements 0.68454
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2009-3086
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3086
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3086
3
reference_url http://secunia.com/advisories/36600
reference_id
reference_type
scores
url http://secunia.com/advisories/36600
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rails/rails/commit/1f07a89c5946910fc28ea5ccd1da6af8a0f972a0
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/1f07a89c5946910fc28ea5ccd1da6af8a0f972a0
6
reference_url https://github.com/rails/rails/commit/674f780d59a5a7ec0301755d43a7b277a3ad2978
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/674f780d59a5a7ec0301755d43a7b277a3ad2978
7
reference_url https://github.com/rails/rails/commit/d460c9a25560f43e7c3789abadf7b455053eb686
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/d460c9a25560f43e7c3789abadf7b455053eb686
8
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2009-3086.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2009-3086.yml
9
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2009-3086.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2009-3086.yml
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2009-3086
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2009-3086
11
reference_url https://web.archive.org/web/20090906010200/http://www.vupen.com/english/advisories/2009/2544
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20090906010200/http://www.vupen.com/english/advisories/2009/2544
12
reference_url https://web.archive.org/web/20090907001716/http://secunia.com/advisories/36600
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20090907001716/http://secunia.com/advisories/36600
13
reference_url https://web.archive.org/web/20200229150042/http://www.securityfocus.com/bid/37427
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200229150042/http://www.securityfocus.com/bid/37427
14
reference_url http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails
15
reference_url http://www.debian.org/security/2011/dsa-2260
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2011/dsa-2260
16
reference_url http://www.securityfocus.com/bid/37427
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/37427
17
reference_url http://www.vupen.com/english/advisories/2009/2544
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2009/2544
18
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
reference_id 545063
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
19
reference_url https://github.com/advisories/GHSA-fg9w-g6m4-557j
reference_id GHSA-fg9w-g6m4-557j
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-fg9w-g6m4-557j
20
reference_url https://security.gentoo.org/glsa/200912-02
reference_id GLSA-200912-02
reference_type
scores
url https://security.gentoo.org/glsa/200912-02
fixed_packages
aliases CVE-2009-3086, GHSA-fg9w-g6m4-557j
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bfbp-7umh-2fcp
16
url VCID-brwd-e9kx-xuc2
vulnerability_id VCID-brwd-e9kx-xuc2
summary 
actionpack allows remote code execution via application's unrestricted use of render method
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
references
0
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
1
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
2
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
3
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
4
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
5
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
6
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2098.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2098.json
7
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-2098
reference_id
reference_type
scores
0
value 0.84091
scoring_system epss
scoring_elements 0.99319
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-2098
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2097
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2097
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2098
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2098
10
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2098.yml
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2098.yml
12
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3
scoring_elements
1
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q
13
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/ly-IH-fxr_Q
reference_id
reference_type
scores
url https://groups.google.com/forum/#!topic/ruby-security-ann/ly-IH-fxr_Q
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-2098
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-2098
15
reference_url https://web.archive.org/web/20200228015318/http://www.securityfocus.com/bid/83725
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200228015318/http://www.securityfocus.com/bid/83725
16
reference_url https://web.archive.org/web/20210612214217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210612214217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
17
reference_url https://web.archive.org/web/20211205173437/https://securitytracker.com/id/1035122
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20211205173437/https://securitytracker.com/id/1035122
18
reference_url https://www.exploit-db.com/exploits/40086
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.exploit-db.com/exploits/40086
19
reference_url https://www.exploit-db.com/exploits/40086/
reference_id
reference_type
scores
url https://www.exploit-db.com/exploits/40086/
20
reference_url http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released
21
reference_url http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
22
reference_url http://www.debian.org/security/2016/dsa-3509
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2016/dsa-3509
23
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1310054
reference_id 1310054
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1310054
24
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/ruby/remote/40086.rb
reference_id CVE-2016-2098
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/ruby/remote/40086.rb
25
reference_url https://github.com/advisories/GHSA-78rc-8c29-p45g
reference_id GHSA-78rc-8c29-p45g
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-78rc-8c29-p45g
26
reference_url https://access.redhat.com/errata/RHSA-2016:0454
reference_id RHSA-2016:0454
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0454
27
reference_url https://access.redhat.com/errata/RHSA-2016:0455
reference_id RHSA-2016:0455
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0455
28
reference_url https://access.redhat.com/errata/RHSA-2016:0456
reference_id RHSA-2016:0456
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0456
fixed_packages
0
url pkg:gem/actionpack@3.2.22.2
purl pkg:gem/actionpack@3.2.22.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-b4sv-b9pz-r7er
7
vulnerability VCID-bfbp-7umh-2fcp
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-mnh7-4rvx-suay
15
vulnerability VCID-n7kh-9mpq-13c7
16
vulnerability VCID-nmz3-ux68-dkfd
17
vulnerability VCID-p1yd-keq8-rkh3
18
vulnerability VCID-qth9-abgp-wyaq
19
vulnerability VCID-v2hk-dfbe-5khc
20
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.22.2
1
url pkg:gem/actionpack@4.1.14.2
purl pkg:gem/actionpack@4.1.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-dd87-gevs-juhe
8
vulnerability VCID-eeru-6pyc-8bcd
9
vulnerability VCID-ejgq-s79w-abd6
10
vulnerability VCID-g13k-qvy7-q3fk
11
vulnerability VCID-g2a6-uem4-uuce
12
vulnerability VCID-k6aw-heeb-wke2
13
vulnerability VCID-mnh7-4rvx-suay
14
vulnerability VCID-n7kh-9mpq-13c7
15
vulnerability VCID-nmz3-ux68-dkfd
16
vulnerability VCID-p1yd-keq8-rkh3
17
vulnerability VCID-qth9-abgp-wyaq
18
vulnerability VCID-v2hk-dfbe-5khc
19
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.14.2
2
url pkg:gem/actionpack@4.2.5.2
purl pkg:gem/actionpack@4.2.5.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-dd87-gevs-juhe
8
vulnerability VCID-eeru-6pyc-8bcd
9
vulnerability VCID-ejgq-s79w-abd6
10
vulnerability VCID-g13k-qvy7-q3fk
11
vulnerability VCID-g2a6-uem4-uuce
12
vulnerability VCID-k6aw-heeb-wke2
13
vulnerability VCID-mnh7-4rvx-suay
14
vulnerability VCID-n7kh-9mpq-13c7
15
vulnerability VCID-nmz3-ux68-dkfd
16
vulnerability VCID-p1yd-keq8-rkh3
17
vulnerability VCID-qth9-abgp-wyaq
18
vulnerability VCID-v2hk-dfbe-5khc
19
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.5.2
aliases CVE-2016-2098, GHSA-78rc-8c29-p45g
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-brwd-e9kx-xuc2
17
url VCID-cs1f-uhb2-xkcm
vulnerability_id VCID-cs1f-uhb2-xkcm
summary 
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the simple_format helper in `actionpack/lib/action_view/helpers/text_helper.rb` in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6416.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6416.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-6416
reference_id
reference_type
scores
0
value 0.00236
scoring_system epss
scoring_elements 0.46624
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-6416
2
reference_url http://seclists.org/oss-sec/2013/q4/404
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/404
3
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
4
reference_url https://github.com/rails/rails/commit/4b4f5847f64f81c961625e647711ef9f6ad1a454
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/4b4f5847f64f81c961625e647711ef9f6ad1a454
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6416.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6416.yml
6
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/5ZI1-H5OoIM/ZNq4FoR2GnIJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/5ZI1-H5OoIM/ZNq4FoR2GnIJ
7
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/5ZI1-H5OoIM
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/5ZI1-H5OoIM
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-6416
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-6416
9
reference_url https://web.archive.org/web/20200228165109/http://www.securityfocus.com/bid/64071
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200228165109/http://www.securityfocus.com/bid/64071
10
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
11
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036914
reference_id 1036914
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036914
13
reference_url https://github.com/advisories/GHSA-w37c-q653-qg95
reference_id GHSA-w37c-q653-qg95
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-w37c-q653-qg95
fixed_packages
0
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-vs1a-m7ya-rue8
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-6416, GHSA-w37c-q653-qg95, OSV-100526
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cs1f-uhb2-xkcm
18
url VCID-dd87-gevs-juhe
vulnerability_id VCID-dd87-gevs-juhe
summary 
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
There is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2024-41128.

Impact
------

Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.


Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Users on Ruby 3.2 are unaffected by this issue.


Credits
-------

Thanks to [scyoon](https://hackerone.com/scyoon) for the report and patches!
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41128.json
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41128.json
1
reference_url https://access.redhat.com/security/cve/cve-2024-41128
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://access.redhat.com/security/cve/cve-2024-41128
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-41128
reference_id
reference_type
scores
0
value 0.00774
scoring_system epss
scoring_elements 0.73902
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-41128
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2319036
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://bugzilla.redhat.com/show_bug.cgi?id=2319036
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41128
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41128
5
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
6
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
7
reference_url https://github.com/rails/rails/commit/27121e80f6dbb260f5a9f0452cd8411cb681f075
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://github.com/rails/rails/commit/27121e80f6dbb260f5a9f0452cd8411cb681f075
8
reference_url https://github.com/rails/rails/commit/b0fe99fa854ec8ff4498e75779b458392d1560ef
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://github.com/rails/rails/commit/b0fe99fa854ec8ff4498e75779b458392d1560ef
9
reference_url https://github.com/rails/rails/commit/b1241f468d1b32235f438c2e2203386e6efd3891
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://github.com/rails/rails/commit/b1241f468d1b32235f438c2e2203386e6efd3891
10
reference_url https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd
11
reference_url https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-41128.yml
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-41128.yml
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-41128
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-41128
14
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085376
reference_id 1085376
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085376
15
reference_url https://github.com/advisories/GHSA-x76w-6vjr-8xgj
reference_id GHSA-x76w-6vjr-8xgj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-x76w-6vjr-8xgj
16
reference_url https://usn.ubuntu.com/7290-1/
reference_id USN-7290-1
reference_type
scores
url https://usn.ubuntu.com/7290-1/
fixed_packages
0
url pkg:gem/actionpack@6.1.7.9
purl pkg:gem/actionpack@6.1.7.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.7.9
1
url pkg:gem/actionpack@7.0.8.5
purl pkg:gem/actionpack@7.0.8.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.8.5
2
url pkg:gem/actionpack@7.1.4.1
purl pkg:gem/actionpack@7.1.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.1.4.1
3
url pkg:gem/actionpack@7.2.1.1
purl pkg:gem/actionpack@7.2.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.2.1.1
4
url pkg:gem/actionpack@8.0.0.beta1
purl pkg:gem/actionpack@8.0.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dd87-gevs-juhe
1
vulnerability VCID-eeru-6pyc-8bcd
2
vulnerability VCID-nmz3-ux68-dkfd
3
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@8.0.0.beta1
aliases CVE-2024-41128, GHSA-x76w-6vjr-8xgj
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dd87-gevs-juhe
19
url VCID-eeru-6pyc-8bcd
vulnerability_id VCID-eeru-6pyc-8bcd
summary 
Possible ReDoS vulnerability in HTTP Token authentication in Action Controller
There is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. This vulnerability has been assigned the CVE identifier CVE-2024-47887.

Impact
------

For applications using HTTP Token authentication via `authenticate_or_request_with_http_token` or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Users on Ruby 3.2 are unaffected by this issue.


Credits
-------
Thanks to [scyoon](https://hackerone.com/scyoon) for reporting
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-47887.json
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-47887.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-47887
reference_id
reference_type
scores
0
value 0.00333
scoring_system epss
scoring_elements 0.56344
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-47887
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47887
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47887
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T16:34:50Z/
url https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
6
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-47887.yml
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-47887.yml
7
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085376
reference_id 1085376
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085376
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2319034
reference_id 2319034
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2319034
9
reference_url https://github.com/rails/rails/commit/56b2fc3302836405b496e196a8d5fc0195e55049
reference_id 56b2fc3302836405b496e196a8d5fc0195e55049
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T16:34:50Z/
url https://github.com/rails/rails/commit/56b2fc3302836405b496e196a8d5fc0195e55049
10
reference_url https://github.com/rails/rails/commit/7c1398854d51f9bb193fb79f226647351133d08a
reference_id 7c1398854d51f9bb193fb79f226647351133d08a
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T16:34:50Z/
url https://github.com/rails/rails/commit/7c1398854d51f9bb193fb79f226647351133d08a
11
reference_url https://github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545
reference_id 8e057db25bff1dc7a98e9ae72e0083825b9ac545
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T16:34:50Z/
url https://github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545
12
reference_url https://github.com/rails/rails/commit/f4dc83d8926509d0958ec21fcdbc2e7df3d32ce2
reference_id f4dc83d8926509d0958ec21fcdbc2e7df3d32ce2
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T16:34:50Z/
url https://github.com/rails/rails/commit/f4dc83d8926509d0958ec21fcdbc2e7df3d32ce2
13
reference_url https://github.com/advisories/GHSA-vfg9-r3fq-jvx4
reference_id GHSA-vfg9-r3fq-jvx4
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vfg9-r3fq-jvx4
14
reference_url https://usn.ubuntu.com/7290-1/
reference_id USN-7290-1
reference_type
scores
url https://usn.ubuntu.com/7290-1/
fixed_packages
0
url pkg:gem/actionpack@6.1.7.9
purl pkg:gem/actionpack@6.1.7.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.7.9
1
url pkg:gem/actionpack@7.0.8.5
purl pkg:gem/actionpack@7.0.8.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.8.5
2
url pkg:gem/actionpack@7.1.4.1
purl pkg:gem/actionpack@7.1.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.1.4.1
3
url pkg:gem/actionpack@7.2.1.1
purl pkg:gem/actionpack@7.2.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.2.1.1
4
url pkg:gem/actionpack@8.0.0.beta1
purl pkg:gem/actionpack@8.0.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dd87-gevs-juhe
1
vulnerability VCID-eeru-6pyc-8bcd
2
vulnerability VCID-nmz3-ux68-dkfd
3
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@8.0.0.beta1
aliases CVE-2024-47887, GHSA-vfg9-r3fq-jvx4
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-eeru-6pyc-8bcd
20
url VCID-ejgq-s79w-abd6
vulnerability_id VCID-ejgq-s79w-abd6
summary 
rails Cross-site Scripting vulnerability
The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html
3
reference_url http://openwall.com/lists/oss-security/2011/06/09/2
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://openwall.com/lists/oss-security/2011/06/09/2
4
reference_url http://openwall.com/lists/oss-security/2011/06/13/9
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://openwall.com/lists/oss-security/2011/06/13/9
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-2197
reference_id
reference_type
scores
0
value 0.00442
scoring_system epss
scoring_elements 0.63551
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-2197
6
reference_url http://secunia.com/advisories/44789
reference_id
reference_type
scores
url http://secunia.com/advisories/44789
7
reference_url https://gist.github.com/NZKoz/b2ceb626fc2bcdfe497f
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://gist.github.com/NZKoz/b2ceb626fc2bcdfe497f
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/53a2c0baf2b128dd4808eca313256f6f4bb8c4cd
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/53a2c0baf2b128dd4808eca313256f6f4bb8c4cd
10
reference_url https://github.com/rails/rails/commit/ed3796434af6069ced6a641293cf88eef3b284da
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/ed3796434af6069ced6a641293cf88eef3b284da
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2197.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2197.yml
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-2197
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-2197
13
reference_url http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications
14
reference_url https://github.com/advisories/GHSA-v9v4-7jp6-8c73
reference_id GHSA-v9v4-7jp6-8c73
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-v9v4-7jp6-8c73
fixed_packages
aliases CVE-2011-2197, GHSA-v9v4-7jp6-8c73
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ejgq-s79w-abd6
21
url VCID-g13k-qvy7-q3fk
vulnerability_id VCID-g13k-qvy7-q3fk
summary 
Rails actionpack gem vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the `mail_to` helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
3
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-0446
reference_id
reference_type
scores
0
value 0.0067
scoring_system epss
scoring_elements 0.71678
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-0446
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0446
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0446
6
reference_url http://secunia.com/advisories/43274
reference_id
reference_type
scores
url http://secunia.com/advisories/43274
7
reference_url http://secunia.com/advisories/43666
reference_id
reference_type
scores
url http://secunia.com/advisories/43666
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/abe97736b8316f1b714cac56c115c0779aa73217
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/abe97736b8316f1b714cac56c115c0779aa73217
10
reference_url https://github.com/rails/rails/commit/e3dd2107c57a8efaaea5d61cf8da65f7444760b2
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/e3dd2107c57a8efaaea5d61cf8da65f7444760b2
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0446.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0446.yml
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2011-0446.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2011-0446.yml
13
reference_url https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-0446
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-0446
15
reference_url https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43274
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43274
16
reference_url https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43666
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43666
17
reference_url https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
18
reference_url https://web.archive.org/web/20200812054342/http://www.securitytracker.com/id?1025064
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200812054342/http://www.securitytracker.com/id?1025064
19
reference_url http://www.debian.org/security/2011/dsa-2247
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2011/dsa-2247
20
reference_url http://www.securityfocus.com/bid/46291
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/46291
21
reference_url http://www.securitytracker.com/id?1025064
reference_id
reference_type
scores
url http://www.securitytracker.com/id?1025064
22
reference_url http://www.vupen.com/english/advisories/2011/0587
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2011/0587
23
reference_url http://www.vupen.com/english/advisories/2011/0877
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2011/0877
24
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614864
reference_id 614864
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614864
25
reference_url https://github.com/advisories/GHSA-75w6-p6mg-vh8j
reference_id GHSA-75w6-p6mg-vh8j
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-75w6-p6mg-vh8j
26
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
aliases CVE-2011-0446, GHSA-75w6-p6mg-vh8j
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g13k-qvy7-q3fk
22
url VCID-g2a6-uem4-uuce
vulnerability_id VCID-g2a6-uem4-uuce
summary 
actionpack Cross-Site Request Forgery vulnerability
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
3
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-0447
reference_id
reference_type
scores
0
value 0.00991
scoring_system epss
scoring_elements 0.77177
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-0447
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0447
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0447
6
reference_url http://secunia.com/advisories/43274
reference_id
reference_type
scores
url http://secunia.com/advisories/43274
7
reference_url http://secunia.com/advisories/43666
reference_id
reference_type
scores
url http://secunia.com/advisories/43666
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034
10
reference_url https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-0447
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-0447
13
reference_url https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
14
reference_url https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060
15
reference_url http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
16
reference_url http://www.debian.org/security/2011/dsa-2247
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2011/dsa-2247
17
reference_url http://www.securityfocus.com/bid/46291
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/46291
18
reference_url http://www.securitytracker.com/id?1025060
reference_id
reference_type
scores
url http://www.securitytracker.com/id?1025060
19
reference_url http://www.vupen.com/english/advisories/2011/0587
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2011/0587
20
reference_url http://www.vupen.com/english/advisories/2011/0877
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2011/0877
21
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614864
reference_id 614864
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614864
22
reference_url https://github.com/advisories/GHSA-24fg-p96v-hxh8
reference_id GHSA-24fg-p96v-hxh8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-24fg-p96v-hxh8
23
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
aliases CVE-2011-0447, GHSA-24fg-p96v-hxh8
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g2a6-uem4-uuce
23
url VCID-jpj6-wzp3-m3e4
vulnerability_id VCID-jpj6-wzp3-m3e4
summary 
actionpack Improper Input Validation vulnerability
`actionpack/lib/action_view/template/text.rb` in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the `:text` option to the `render` method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
1
reference_url http://openwall.com/lists/oss-security/2014/02/18/10
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://openwall.com/lists/oss-security/2014/02/18/10
2
reference_url http://rhn.redhat.com/errata/RHSA-2014-0215.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0215.html
3
reference_url http://rhn.redhat.com/errata/RHSA-2014-0306.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0306.html
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0082.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0082.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-0082
reference_id
reference_type
scores
0
value 0.06456
scoring_system epss
scoring_elements 0.91211
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-0082
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0081
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0081
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0082
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0082
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0130
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0130
9
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
10
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0082.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0082.yml
11
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/LMxO_3_eCuc
reference_id
reference_type
scores
url https://groups.google.com/forum/#!topic/rubyonrails-security/LMxO_3_eCuc
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-0082
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-0082
13
reference_url https://web.archive.org/web/20201207044540/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201207044540/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ
14
reference_url https://web.archive.org/web/20220315115444/https://puppet.com/security/cve/cve-2014-0082
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20220315115444/https://puppet.com/security/cve/cve-2014-0082
15
reference_url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release
16
reference_url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
reference_id
reference_type
scores
url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
17
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1065538
reference_id 1065538
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1065538
18
reference_url https://github.com/advisories/GHSA-7cgp-c3g7-qvrw
reference_id GHSA-7cgp-c3g7-qvrw
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7cgp-c3g7-qvrw
19
reference_url https://access.redhat.com/errata/RHSA-2014:0215
reference_id RHSA-2014:0215
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0215
20
reference_url https://access.redhat.com/errata/RHSA-2014:0306
reference_id RHSA-2014:0306
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0306
fixed_packages
0
url pkg:gem/actionpack@3.2.17
purl pkg:gem/actionpack@3.2.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-b4sv-b9pz-r7er
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-mnh7-4rvx-suay
17
vulnerability VCID-n7kh-9mpq-13c7
18
vulnerability VCID-nmz3-ux68-dkfd
19
vulnerability VCID-p1yd-keq8-rkh3
20
vulnerability VCID-qth9-abgp-wyaq
21
vulnerability VCID-r6mr-ay8d-nqdd
22
vulnerability VCID-sg9h-7dqr-xugu
23
vulnerability VCID-v2hk-dfbe-5khc
24
vulnerability VCID-v3u5-6bpb-qfgf
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.17
1
url pkg:gem/actionpack@4.0.0.beta1
purl pkg:gem/actionpack@4.0.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-3rn4-abmh-nkhv
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-5psk-hzaf-1kbz
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-9gqn-8g4t-wfby
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-cs1f-uhb2-xkcm
12
vulnerability VCID-dd87-gevs-juhe
13
vulnerability VCID-eeru-6pyc-8bcd
14
vulnerability VCID-ejgq-s79w-abd6
15
vulnerability VCID-g13k-qvy7-q3fk
16
vulnerability VCID-g2a6-uem4-uuce
17
vulnerability VCID-jpj6-wzp3-m3e4
18
vulnerability VCID-k6aw-heeb-wke2
19
vulnerability VCID-m156-zkzd-57g9
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7kh-9mpq-13c7
22
vulnerability VCID-nax4-x97j-9fgr
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-nnka-c23v-qub7
25
vulnerability VCID-p1yd-keq8-rkh3
26
vulnerability VCID-qth9-abgp-wyaq
27
vulnerability VCID-r6mr-ay8d-nqdd
28
vulnerability VCID-sg9h-7dqr-xugu
29
vulnerability VCID-v2hk-dfbe-5khc
30
vulnerability VCID-v3u5-6bpb-qfgf
31
vulnerability VCID-vhjv-9864-tbcs
32
vulnerability VCID-vs1a-m7ya-rue8
33
vulnerability VCID-y13c-awe3-2bc1
34
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.0.beta1
2
url pkg:gem/actionpack@4.0.0
purl pkg:gem/actionpack@4.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-5az9-zqff-5kav
5
vulnerability VCID-5pfg-7ntp-eff4
6
vulnerability VCID-5psk-hzaf-1kbz
7
vulnerability VCID-6z21-pd9d-pfgk
8
vulnerability VCID-832g-x9kb-3bbx
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-8p57-4fhz-v3gh
11
vulnerability VCID-98gu-r7wd-cuah
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-bfbp-7umh-2fcp
14
vulnerability VCID-brwd-e9kx-xuc2
15
vulnerability VCID-cs1f-uhb2-xkcm
16
vulnerability VCID-dd87-gevs-juhe
17
vulnerability VCID-eeru-6pyc-8bcd
18
vulnerability VCID-ejgq-s79w-abd6
19
vulnerability VCID-g13k-qvy7-q3fk
20
vulnerability VCID-g2a6-uem4-uuce
21
vulnerability VCID-hh65-ycrj-d7gz
22
vulnerability VCID-hvua-jhzn-97fr
23
vulnerability VCID-k651-yq6k-cyc9
24
vulnerability VCID-k6aw-heeb-wke2
25
vulnerability VCID-m156-zkzd-57g9
26
vulnerability VCID-mnh7-4rvx-suay
27
vulnerability VCID-n7kh-9mpq-13c7
28
vulnerability VCID-nax4-x97j-9fgr
29
vulnerability VCID-nmz3-ux68-dkfd
30
vulnerability VCID-nnka-c23v-qub7
31
vulnerability VCID-p1yd-keq8-rkh3
32
vulnerability VCID-p2yz-5pzq-nyag
33
vulnerability VCID-qth9-abgp-wyaq
34
vulnerability VCID-r6mr-ay8d-nqdd
35
vulnerability VCID-rnnm-ck7u-fydy
36
vulnerability VCID-sg9h-7dqr-xugu
37
vulnerability VCID-v2hk-dfbe-5khc
38
vulnerability VCID-v3u5-6bpb-qfgf
39
vulnerability VCID-v4sh-tkkf-xfeh
40
vulnerability VCID-vs1a-m7ya-rue8
41
vulnerability VCID-y13c-awe3-2bc1
42
vulnerability VCID-z16b-zfgu-13a9
43
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.0
aliases CVE-2014-0082, GHSA-7cgp-c3g7-qvrw, OSV-103440
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jpj6-wzp3-m3e4
24
url VCID-k6aw-heeb-wke2
vulnerability_id VCID-k6aw-heeb-wke2
summary 
ReDoS based DoS vulnerability in Action Dispatch
There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795.

Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1

Impact

A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious If-None-Match headers before they reach the application.

Users on Ruby 3.2.0 or greater are not affected by this vulnerability.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Avoid-regex-backtracking-on-If-None-Match-header.patch - Patch for 6.1 series
    7-0-Avoid-regex-backtracking-on-If-None-Match-header.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22795.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22795.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-22795
reference_id
reference_type
scores
0
value 0.01339
scoring_system epss
scoring_elements 0.80309
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-22795
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22942
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22942
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21831
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21831
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27777
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27777
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22792
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22792
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22794
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22794
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796
12
reference_url https://discuss.rubyonrails.org/t/cve-2023-22795-possible-redos-based-dos-vulnerability-in-action-dispatch/82118
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://discuss.rubyonrails.org/t/cve-2023-22795-possible-redos-based-dos-vulnerability-in-action-dispatch/82118
13
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
14
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
15
reference_url https://github.com/rails/rails/commit/8d82687f3b04b2803320b64f985308239a8c3d2f
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/8d82687f3b04b2803320b64f985308239a8c3d2f
16
reference_url https://github.com/rails/rails/commit/8dc45950619a4c64d16fb9370570c996d201f9b0
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/8dc45950619a4c64d16fb9370570c996d201f9b0
17
reference_url https://github.com/rails/rails/commit/cd461c3e64e09cdcb1e379d1c35423c5e2caa592
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/cd461c3e64e09cdcb1e379d1c35423c5e2caa592
18
reference_url https://github.com/rails/rails/releases/tag/v6.1.7.1
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v6.1.7.1
19
reference_url https://github.com/rails/rails/releases/tag/v7.0.4.1
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v7.0.4.1
20
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22795.yml
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22795.yml
21
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-22795
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-22795
22
reference_url https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
23
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1030050
reference_id 1030050
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1030050
24
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2164799
reference_id 2164799
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2164799
25
reference_url https://github.com/advisories/GHSA-8xww-x3g3-6jcv
reference_id GHSA-8xww-x3g3-6jcv
reference_type
scores
url https://github.com/advisories/GHSA-8xww-x3g3-6jcv
26
reference_url https://access.redhat.com/errata/RHSA-2023:6818
reference_id RHSA-2023:6818
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:6818
fixed_packages
0
url pkg:gem/actionpack@5.2.8
purl pkg:gem/actionpack@5.2.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-nmz3-ux68-dkfd
5
vulnerability VCID-qth9-abgp-wyaq
6
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.2.8
1
url pkg:gem/actionpack@6.1.7.1
purl pkg:gem/actionpack@6.1.7.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-nmz3-ux68-dkfd
5
vulnerability VCID-qth9-abgp-wyaq
6
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.7.1
2
url pkg:gem/actionpack@7.0.4.1
purl pkg:gem/actionpack@7.0.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-nmz3-ux68-dkfd
5
vulnerability VCID-qth9-abgp-wyaq
6
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.4.1
aliases CVE-2023-22795, GHSA-8xww-x3g3-6jcv, GMS-2023-56
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-k6aw-heeb-wke2
25
url VCID-mnh7-4rvx-suay
vulnerability_id VCID-mnh7-4rvx-suay
summary 
Action Pack contains database-query restrictions bypass
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain `[nil]` values, a related issue to CVE-2012-2694.
references
0
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
1
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
2
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
3
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
4
reference_url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
6
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-2660.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-2660.json
7
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-2660
reference_id
reference_type
scores
0
value 0.00159
scoring_system epss
scoring_elements 0.3656
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-2660
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/61eed87ce32caf534bf1f52dd8134097b4ad9e1b
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/61eed87ce32caf534bf1f52dd8134097b4ad9e1b
10
reference_url https://github.com/rails/rails/commit/dff6db18840e2fd1dd3f3e4ef0ae7a9a3986d01d#diff-3179d24efacadd64068c4d9c1184eac3
reference_id
reference_type
scores
url https://github.com/rails/rails/commit/dff6db18840e2fd1dd3f3e4ef0ae7a9a3986d01d#diff-3179d24efacadd64068c4d9c1184eac3
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2660.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2660.yml
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2012-2660.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2012-2660.yml
13
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/OSVDB-82610.yml
reference_id
reference_type
scores
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/OSVDB-82610.yml
14
reference_url https://groups.google.com/forum/#!original/rubyonrails-security/8SA-M3as7A8/Mr9fi9X4kNgJ
reference_id
reference_type
scores
url https://groups.google.com/forum/#!original/rubyonrails-security/8SA-M3as7A8/Mr9fi9X4kNgJ
15
reference_url https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain
16
reference_url https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ
17
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-2660
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-2660
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=827353
reference_id 827353
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=827353
19
reference_url https://github.com/advisories/GHSA-hgpp-pp89-4fgf
reference_id GHSA-hgpp-pp89-4fgf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-hgpp-pp89-4fgf
20
reference_url https://access.redhat.com/errata/RHSA-2012:1542
reference_id RHSA-2012:1542
reference_type
scores
url https://access.redhat.com/errata/RHSA-2012:1542
21
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
fixed_packages
0
url pkg:gem/actionpack@3.2.4
purl pkg:gem/actionpack@3.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-1xbd-73qv-mff9
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4bzb-ft3d-dkgg
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5pfg-7ntp-eff4
7
vulnerability VCID-5psk-hzaf-1kbz
8
vulnerability VCID-832g-x9kb-3bbx
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-brwd-e9kx-xuc2
16
vulnerability VCID-cs1f-uhb2-xkcm
17
vulnerability VCID-dd87-gevs-juhe
18
vulnerability VCID-eeru-6pyc-8bcd
19
vulnerability VCID-ejgq-s79w-abd6
20
vulnerability VCID-g13k-qvy7-q3fk
21
vulnerability VCID-g2a6-uem4-uuce
22
vulnerability VCID-jpj6-wzp3-m3e4
23
vulnerability VCID-k6aw-heeb-wke2
24
vulnerability VCID-mnh7-4rvx-suay
25
vulnerability VCID-n7kh-9mpq-13c7
26
vulnerability VCID-nax4-x97j-9fgr
27
vulnerability VCID-nmz3-ux68-dkfd
28
vulnerability VCID-nnka-c23v-qub7
29
vulnerability VCID-p1yd-keq8-rkh3
30
vulnerability VCID-qth9-abgp-wyaq
31
vulnerability VCID-r6mr-ay8d-nqdd
32
vulnerability VCID-rgw4-mrr9-euda
33
vulnerability VCID-sg9h-7dqr-xugu
34
vulnerability VCID-v2hk-dfbe-5khc
35
vulnerability VCID-v3u5-6bpb-qfgf
36
vulnerability VCID-vhjv-9864-tbcs
37
vulnerability VCID-vs1a-m7ya-rue8
38
vulnerability VCID-y13c-awe3-2bc1
39
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.4
aliases CVE-2012-2660, GHSA-hgpp-pp89-4fgf, OSV-82610
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mnh7-4rvx-suay
26
url VCID-n7kh-9mpq-13c7
vulnerability_id VCID-n7kh-9mpq-13c7
summary 
Cross site scripting that affects rails
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.
references
0
reference_url http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
1
reference_url http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source
2
reference_url http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
3
reference_url http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3009.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3009.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2009-3009
reference_id
reference_type
scores
0
value 0.01632
scoring_system epss
scoring_elements 0.8221
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2009-3009
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3009
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3009
7
reference_url http://secunia.com/advisories/36600
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://secunia.com/advisories/36600
8
reference_url http://secunia.com/advisories/36717
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://secunia.com/advisories/36717
9
reference_url http://securitytracker.com/id?1022824
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://securitytracker.com/id?1022824
10
reference_url https://exchange.xforce.ibmcloud.com/vulnerabilities/53036
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://exchange.xforce.ibmcloud.com/vulnerabilities/53036
11
reference_url https://github.com/advisories/GHSA-8qrh-h9m2-5fvf
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-8qrh-h9m2-5fvf
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2009-3009.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2009-3009.yml
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2009-3009
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2009-3009
14
reference_url http://support.apple.com/kb/HT4077
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://support.apple.com/kb/HT4077
15
reference_url http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails
16
reference_url http://www.debian.org/security/2009/dsa-1887
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2009/dsa-1887
17
reference_url http://www.osvdb.org/57666
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.osvdb.org/57666
18
reference_url http://www.securityfocus.com/bid/36278
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/36278
19
reference_url http://www.vupen.com/english/advisories/2009/2544
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.vupen.com/english/advisories/2009/2544
20
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=520843
reference_id 520843
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=520843
21
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
reference_id 545063
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
22
reference_url https://security.gentoo.org/glsa/200912-02
reference_id GLSA-200912-02
reference_type
scores
url https://security.gentoo.org/glsa/200912-02
fixed_packages
aliases CVE-2009-3009, GHSA-8qrh-h9m2-5fvf, OSV-57666
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n7kh-9mpq-13c7
27
url VCID-nax4-x97j-9fgr
vulnerability_id VCID-nax4-x97j-9fgr
summary 
actionpack Improper Input Validation vulnerability
`actionpack/lib/action_view/lookup_context.rb` in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
1
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
2
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
3
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
4
reference_url http://rhn.redhat.com/errata/RHSA-2013-1794.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-1794.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2014-0008.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0008.html
6
reference_url http://rhn.redhat.com/errata/RHSA-2014-1863.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-1863.html
7
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6414.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6414.json
8
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-6414
reference_id
reference_type
scores
0
value 0.70843
scoring_system epss
scoring_elements 0.98724
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-6414
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
14
reference_url http://seclists.org/oss-sec/2013/q4/400
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/400
15
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
16
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6414.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6414.yml
17
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/A-ebV4WxzKg/KNPTbX8XAQUJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/A-ebV4WxzKg/KNPTbX8XAQUJ
18
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/A-ebV4WxzKg
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/A-ebV4WxzKg
19
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-6414
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-6414
20
reference_url https://puppet.com/security/cve/cve-2013-6414
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://puppet.com/security/cve/cve-2013-6414
21
reference_url https://web.archive.org/web/20160421165124/http://secunia.com/advisories/57836
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160421165124/http://secunia.com/advisories/57836
22
reference_url https://web.archive.org/web/20160808161629/https://puppet.com/security/cve/cve-2013-6414
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160808161629/https://puppet.com/security/cve/cve-2013-6414
23
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
24
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
25
reference_url http://www.debian.org/security/2014/dsa-2888
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2014/dsa-2888
26
reference_url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release
27
reference_url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
reference_id
reference_type
scores
url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
28
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036483
reference_id 1036483
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036483
29
reference_url https://github.com/advisories/GHSA-mpxf-gcw2-pw5q
reference_id GHSA-mpxf-gcw2-pw5q
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mpxf-gcw2-pw5q
30
reference_url https://access.redhat.com/errata/RHSA-2013:1794
reference_id RHSA-2013:1794
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:1794
31
reference_url https://access.redhat.com/errata/RHSA-2014:0008
reference_id RHSA-2014:0008
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0008
fixed_packages
0
url pkg:gem/actionpack@3.2.16
purl pkg:gem/actionpack@3.2.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-b4sv-b9pz-r7er
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-jpj6-wzp3-m3e4
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-mnh7-4rvx-suay
18
vulnerability VCID-n7kh-9mpq-13c7
19
vulnerability VCID-nmz3-ux68-dkfd
20
vulnerability VCID-p1yd-keq8-rkh3
21
vulnerability VCID-qth9-abgp-wyaq
22
vulnerability VCID-r6mr-ay8d-nqdd
23
vulnerability VCID-sg9h-7dqr-xugu
24
vulnerability VCID-v2hk-dfbe-5khc
25
vulnerability VCID-v3u5-6bpb-qfgf
26
vulnerability VCID-vs1a-m7ya-rue8
27
vulnerability VCID-y13c-awe3-2bc1
28
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.16
1
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-vs1a-m7ya-rue8
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-6414, GHSA-mpxf-gcw2-pw5q, OSV-100525
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nax4-x97j-9fgr
28
url VCID-nmz3-ux68-dkfd
vulnerability_id VCID-nmz3-ux68-dkfd
summary Rails: Action Pack: Action Pack: Cross-Site Scripting (XSS) via improper exception message escaping
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33167.json
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33167.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-33167
reference_id
reference_type
scores
0
value 0.00021
scoring_system epss
scoring_elements 0.06147
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-33167
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
4
reference_url https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T18:44:05Z/
url https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0
5
reference_url https://github.com/rails/rails/releases/tag/v8.1.2.1
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T18:44:05Z/
url https://github.com/rails/rails/releases/tag/v8.1.2.1
6
reference_url https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T18:44:05Z/
url https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
7
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2026-33167.yml
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2026-33167.yml
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-33167
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-33167
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2450552
reference_id 2450552
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2450552
fixed_packages
0
url pkg:gem/actionpack@8.1.2.1
purl pkg:gem/actionpack@8.1.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@8.1.2.1
aliases CVE-2026-33167, GHSA-pgm4-439c-5jp6
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nmz3-ux68-dkfd
29
url VCID-nnka-c23v-qub7
vulnerability_id VCID-nnka-c23v-qub7
summary 
actionpack vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the `number_to_currency` helper in `actionpack/lib/action_view/helpers/number_helper.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
1
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00080.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00080.html
2
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
3
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
4
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
5
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
6
reference_url http://rhn.redhat.com/errata/RHSA-2013-1794.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-1794.html
7
reference_url http://rhn.redhat.com/errata/RHSA-2014-0008.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0008.html
8
reference_url http://rhn.redhat.com/errata/RHSA-2014-1863.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-1863.html
9
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6415.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6415.json
10
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-6415
reference_id
reference_type
scores
0
value 0.01506
scoring_system epss
scoring_elements 0.8147
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-6415
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
14
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
15
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
16
reference_url http://seclists.org/oss-sec/2013/q4/402
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/402
17
reference_url https://github.com/advisories/GHSA-6h5q-96hp-9jgm
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-6h5q-96hp-9jgm
18
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6415.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6415.yml
19
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ
20
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/9WiRn2nhfq0
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/9WiRn2nhfq0
21
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-6415
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-6415
22
reference_url https://puppet.com/security/cve/cve-2013-6415
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://puppet.com/security/cve/cve-2013-6415
23
reference_url https://web.archive.org/web/20131206180005/http://www.securityfocus.com/bid/64077
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20131206180005/http://www.securityfocus.com/bid/64077
24
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
25
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
26
reference_url http://www.debian.org/security/2014/dsa-2888
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2014/dsa-2888
27
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036910
reference_id 1036910
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036910
28
reference_url https://access.redhat.com/errata/RHSA-2013:1794
reference_id RHSA-2013:1794
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:1794
29
reference_url https://access.redhat.com/errata/RHSA-2014:0008
reference_id RHSA-2014:0008
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0008
fixed_packages
0
url pkg:gem/actionpack@3.2.16
purl pkg:gem/actionpack@3.2.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-b4sv-b9pz-r7er
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-jpj6-wzp3-m3e4
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-mnh7-4rvx-suay
18
vulnerability VCID-n7kh-9mpq-13c7
19
vulnerability VCID-nmz3-ux68-dkfd
20
vulnerability VCID-p1yd-keq8-rkh3
21
vulnerability VCID-qth9-abgp-wyaq
22
vulnerability VCID-r6mr-ay8d-nqdd
23
vulnerability VCID-sg9h-7dqr-xugu
24
vulnerability VCID-v2hk-dfbe-5khc
25
vulnerability VCID-v3u5-6bpb-qfgf
26
vulnerability VCID-vs1a-m7ya-rue8
27
vulnerability VCID-y13c-awe3-2bc1
28
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.16
1
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-vs1a-m7ya-rue8
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-6415, GHSA-6h5q-96hp-9jgm, OSV-100524
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nnka-c23v-qub7
30
url VCID-p1yd-keq8-rkh3
vulnerability_id VCID-p1yd-keq8-rkh3
summary 
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the `strip_tags` helper in `actionpack/lib/action_controller/vendor/html-scanner/html/node.rb` in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/fd41ab62966e0fd1?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/fd41ab62966e0fd1?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065137.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065137.html
3
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-2931
reference_id
reference_type
scores
0
value 0.00813
scoring_system epss
scoring_elements 0.7456
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-2931
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=731436
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=731436
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2931
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2931
7
reference_url http://secunia.com/advisories/45921
reference_id
reference_type
scores
url http://secunia.com/advisories/45921
8
reference_url https://github.com/advisories/GHSA-v5jg-558j-q67c
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-v5jg-558j-q67c
9
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
10
reference_url https://github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037a
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037a
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-2931.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-2931.yml
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-2931
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-2931
13
reference_url http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
14
reference_url http://www.debian.org/security/2011/dsa-2301
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2011/dsa-2301
15
reference_url http://www.openwall.com/lists/oss-security/2011/08/17/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/17/1
16
reference_url http://www.openwall.com/lists/oss-security/2011/08/19/11
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/19/11
17
reference_url http://www.openwall.com/lists/oss-security/2011/08/20/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/20/1
18
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/13
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/13
19
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/14
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/14
20
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/5
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/5
21
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
aliases CVE-2011-2931, GHSA-v5jg-558j-q67c
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p1yd-keq8-rkh3
31
url VCID-qth9-abgp-wyaq
vulnerability_id VCID-qth9-abgp-wyaq
summary 
Possible Content Security Policy bypass in Action Dispatch
There is a possible Cross Site Scripting (XSS) vulnerability  in the `content_security_policy` helper in Action Pack.

Impact
------
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits
-------
Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-54133.json
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-54133.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-54133
reference_id
reference_type
scores
0
value 0.0019
scoring_system epss
scoring_elements 0.40653
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-54133
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54133
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54133
3
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
4
reference_url https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/
url https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49
5
reference_url https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/
url https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a
6
reference_url https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/
url https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542
7
reference_url https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/
url https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d
8
reference_url https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/
url https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v
9
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-54133.yml
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-54133.yml
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-54133
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-54133
11
reference_url https://security.netapp.com/advisory/ntap-20250306-0010
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20250306-0010
12
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089755
reference_id 1089755
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089755
13
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2331619
reference_id 2331619
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2331619
fixed_packages
0
url pkg:gem/actionpack@7.0.8.7
purl pkg:gem/actionpack@7.0.8.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.8.7
1
url pkg:gem/actionpack@7.1.5.1
purl pkg:gem/actionpack@7.1.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.1.5.1
2
url pkg:gem/actionpack@7.2.2.1
purl pkg:gem/actionpack@7.2.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.2.2.1
3
url pkg:gem/actionpack@8.0.0.1
purl pkg:gem/actionpack@8.0.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@8.0.0.1
aliases CVE-2024-54133, GHSA-vfm5-rmrh-j26v
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qth9-abgp-wyaq
32
url VCID-r6mr-ay8d-nqdd
vulnerability_id VCID-r6mr-ay8d-nqdd
summary 
actionpack is vulnerable to denial of service via a crafted HTTP Accept header
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
references
0
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
2
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
3
reference_url http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
4
reference_url http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2016-0296.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-0296.html
6
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0751.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0751.json
7
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-0751
reference_id
reference_type
scores
0
value 0.08895
scoring_system epss
scoring_elements 0.92689
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-0751
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3226
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3226
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3227
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3227
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7576
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7576
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7577
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7577
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7581
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7581
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0751
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0751
14
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0752
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0752
15
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0753
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0753
16
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:N/C:N/I:N/A:P
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
17
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
18
reference_url https://github.com/rails/rails/commit/127967b735813cd4f263df7a50426d74e7e9cc17
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/127967b735813cd4f263df7a50426d74e7e9cc17
19
reference_url https://github.com/rails/rails/commit/221937c8ba1d291430ceddebbd4bdef7d3cb47d6
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/221937c8ba1d291430ceddebbd4bdef7d3cb47d6
20
reference_url https://github.com/rails/rails/commit/37047b779a177b911c7161052cfc34a30e1db0af
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/37047b779a177b911c7161052cfc34a30e1db0af
21
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0751.yml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0751.yml
22
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9oLY_FCzvoc/5CDXbvpYEgAJ
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9oLY_FCzvoc/5CDXbvpYEgAJ
23
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc
24
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-0751
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-0751
25
reference_url https://web.archive.org/web/20160128201702/http://www.securitytracker.com/id/1034816
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160128201702/http://www.securitytracker.com/id/1034816
26
reference_url https://web.archive.org/web/20200227181647/http://www.securityfocus.com/bid/81800
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200227181647/http://www.securityfocus.com/bid/81800
27
reference_url http://www.debian.org/security/2016/dsa-3464
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2016/dsa-3464
28
reference_url http://www.openwall.com/lists/oss-security/2016/01/25/9
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2016/01/25/9
29
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1301946
reference_id 1301946
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1301946
30
reference_url https://github.com/advisories/GHSA-ffpv-c4hm-3x6v
reference_id GHSA-ffpv-c4hm-3x6v
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-ffpv-c4hm-3x6v
31
reference_url https://access.redhat.com/errata/RHSA-2016:0296
reference_id RHSA-2016:0296
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0296
32
reference_url https://access.redhat.com/errata/RHSA-2016:0454
reference_id RHSA-2016:0454
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0454
33
reference_url https://access.redhat.com/errata/RHSA-2016:0455
reference_id RHSA-2016:0455
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0455
fixed_packages
0
url pkg:gem/actionpack@3.2.22.1
purl pkg:gem/actionpack@3.2.22.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-b4sv-b9pz-r7er
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-mnh7-4rvx-suay
17
vulnerability VCID-n7kh-9mpq-13c7
18
vulnerability VCID-nmz3-ux68-dkfd
19
vulnerability VCID-p1yd-keq8-rkh3
20
vulnerability VCID-qth9-abgp-wyaq
21
vulnerability VCID-v2hk-dfbe-5khc
22
vulnerability VCID-v4sh-tkkf-xfeh
23
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.22.1
1
url pkg:gem/actionpack@4.1.14.1
purl pkg:gem/actionpack@4.1.14.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-bfbp-7umh-2fcp
8
vulnerability VCID-brwd-e9kx-xuc2
9
vulnerability VCID-dd87-gevs-juhe
10
vulnerability VCID-eeru-6pyc-8bcd
11
vulnerability VCID-ejgq-s79w-abd6
12
vulnerability VCID-g13k-qvy7-q3fk
13
vulnerability VCID-g2a6-uem4-uuce
14
vulnerability VCID-k6aw-heeb-wke2
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-v2hk-dfbe-5khc
21
vulnerability VCID-v4sh-tkkf-xfeh
22
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.14.1
2
url pkg:gem/actionpack@4.2.5.1
purl pkg:gem/actionpack@4.2.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-mnh7-4rvx-suay
15
vulnerability VCID-n7kh-9mpq-13c7
16
vulnerability VCID-nmz3-ux68-dkfd
17
vulnerability VCID-p1yd-keq8-rkh3
18
vulnerability VCID-qth9-abgp-wyaq
19
vulnerability VCID-v2hk-dfbe-5khc
20
vulnerability VCID-v4sh-tkkf-xfeh
21
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.5.1
3
url pkg:gem/actionpack@5.0.0.beta1.1
purl pkg:gem/actionpack@5.0.0.beta1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-dd87-gevs-juhe
8
vulnerability VCID-eeru-6pyc-8bcd
9
vulnerability VCID-ejgq-s79w-abd6
10
vulnerability VCID-g13k-qvy7-q3fk
11
vulnerability VCID-g2a6-uem4-uuce
12
vulnerability VCID-k6aw-heeb-wke2
13
vulnerability VCID-mnh7-4rvx-suay
14
vulnerability VCID-n7kh-9mpq-13c7
15
vulnerability VCID-nmz3-ux68-dkfd
16
vulnerability VCID-p1yd-keq8-rkh3
17
vulnerability VCID-qth9-abgp-wyaq
18
vulnerability VCID-v2hk-dfbe-5khc
19
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.0.0.beta1.1
aliases CVE-2016-0751, GHSA-ffpv-c4hm-3x6v
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-r6mr-ay8d-nqdd
33
url VCID-rgw4-mrr9-euda
vulnerability_id VCID-rgw4-mrr9-euda
summary 
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/sanitize_helper.rb` in the `strip_tags` helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.
references
0
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3465.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3465.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-3465
reference_id
reference_type
scores
0
value 0.00333
scoring_system epss
scoring_elements 0.56331
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-3465
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3465
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3465
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rails/rails/commit/cf48c9c7dcbef8543171f7f7de8d3d9a16b58e77
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/cf48c9c7dcbef8543171f7f7de8d3d9a16b58e77
6
reference_url https://github.com/rails/rails/commit/e91e4e8bbee12ce1496bf384c04da6be296b687a
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/e91e4e8bbee12ce1496bf384c04da6be296b687a
7
reference_url https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-3465
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-3465
9
reference_url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=847200
reference_id 847200
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=847200
11
reference_url https://github.com/advisories/GHSA-7g65-ghrg-hpf5
reference_id GHSA-7g65-ghrg-hpf5
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7g65-ghrg-hpf5
12
reference_url https://access.redhat.com/errata/RHSA-2012:1542
reference_id RHSA-2012:1542
reference_type
scores
url https://access.redhat.com/errata/RHSA-2012:1542
13
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
fixed_packages
0
url pkg:gem/actionpack@3.2.8
purl pkg:gem/actionpack@3.2.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-3rn4-abmh-nkhv
3
vulnerability VCID-58sa-6uag-z7hp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-5psk-hzaf-1kbz
6
vulnerability VCID-832g-x9kb-3bbx
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-9gqn-8g4t-wfby
10
vulnerability VCID-a6wp-n5yh-ybcv
11
vulnerability VCID-b4sv-b9pz-r7er
12
vulnerability VCID-bfbp-7umh-2fcp
13
vulnerability VCID-brwd-e9kx-xuc2
14
vulnerability VCID-cs1f-uhb2-xkcm
15
vulnerability VCID-dd87-gevs-juhe
16
vulnerability VCID-eeru-6pyc-8bcd
17
vulnerability VCID-ejgq-s79w-abd6
18
vulnerability VCID-g13k-qvy7-q3fk
19
vulnerability VCID-g2a6-uem4-uuce
20
vulnerability VCID-jpj6-wzp3-m3e4
21
vulnerability VCID-k6aw-heeb-wke2
22
vulnerability VCID-mnh7-4rvx-suay
23
vulnerability VCID-n7kh-9mpq-13c7
24
vulnerability VCID-nax4-x97j-9fgr
25
vulnerability VCID-nmz3-ux68-dkfd
26
vulnerability VCID-nnka-c23v-qub7
27
vulnerability VCID-p1yd-keq8-rkh3
28
vulnerability VCID-qth9-abgp-wyaq
29
vulnerability VCID-r6mr-ay8d-nqdd
30
vulnerability VCID-sg9h-7dqr-xugu
31
vulnerability VCID-v2hk-dfbe-5khc
32
vulnerability VCID-v3u5-6bpb-qfgf
33
vulnerability VCID-vhjv-9864-tbcs
34
vulnerability VCID-vs1a-m7ya-rue8
35
vulnerability VCID-y13c-awe3-2bc1
36
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.8
aliases CVE-2012-3465, GHSA-7g65-ghrg-hpf5, OSV-84513
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-rgw4-mrr9-euda
34
url VCID-sg9h-7dqr-xugu
vulnerability_id VCID-sg9h-7dqr-xugu
summary 
actionpack vulnerable to Path Traversal
Directory traversal vulnerability in `actionpack/lib/action_dispatch/middleware/static.rb` in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when `serve_static_assets` is enabled, allows remote attackers to determine the existence of files outside the application root via a `/..%2F` sequence.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-7818.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-7818.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-7818
reference_id
reference_type
scores
0
value 0.0022
scoring_system epss
scoring_elements 0.44666
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-7818
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7818
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7818
4
reference_url https://github.com/advisories/GHSA-29gr-w57f-rpfw
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-29gr-w57f-rpfw
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-7818.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-7818.yml
6
reference_url https://groups.google.com/forum/message/raw?msg=rubyonrails-security/dCp7duBiQgo/v_R_8PFs5IwJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=rubyonrails-security/dCp7duBiQgo/v_R_8PFs5IwJ
7
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-7818
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-7818
9
reference_url https://puppet.com/security/cve/cve-2014-7829
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://puppet.com/security/cve/cve-2014-7829
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1161499
reference_id 1161499
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1161499
11
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770934
reference_id 770934
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770934
fixed_packages
0
url pkg:gem/actionpack@3.2.20
purl pkg:gem/actionpack@3.2.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-b4sv-b9pz-r7er
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-mnh7-4rvx-suay
17
vulnerability VCID-n7kh-9mpq-13c7
18
vulnerability VCID-nmz3-ux68-dkfd
19
vulnerability VCID-p1yd-keq8-rkh3
20
vulnerability VCID-qth9-abgp-wyaq
21
vulnerability VCID-r6mr-ay8d-nqdd
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-y13c-awe3-2bc1
25
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.20
1
url pkg:gem/actionpack@4.0.11
purl pkg:gem/actionpack@4.0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-v2hk-dfbe-5khc
22
vulnerability VCID-v3u5-6bpb-qfgf
23
vulnerability VCID-y13c-awe3-2bc1
24
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.11
2
url pkg:gem/actionpack@4.1.0.beta1
purl pkg:gem/actionpack@4.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-vs1a-m7ya-rue8
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.0.beta1
3
url pkg:gem/actionpack@4.1.7
purl pkg:gem/actionpack@4.1.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-v2hk-dfbe-5khc
22
vulnerability VCID-v3u5-6bpb-qfgf
23
vulnerability VCID-y13c-awe3-2bc1
24
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.7
4
url pkg:gem/actionpack@4.2.0.beta1
purl pkg:gem/actionpack@4.2.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-y13c-awe3-2bc1
25
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.0.beta1
5
url pkg:gem/actionpack@4.2.0.beta3
purl pkg:gem/actionpack@4.2.0.beta3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-v2hk-dfbe-5khc
22
vulnerability VCID-v3u5-6bpb-qfgf
23
vulnerability VCID-y13c-awe3-2bc1
24
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.0.beta3
aliases CVE-2014-7818, GHSA-29gr-w57f-rpfw
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-sg9h-7dqr-xugu
35
url VCID-v2hk-dfbe-5khc
vulnerability_id VCID-v2hk-dfbe-5khc
summary 
Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch
# Possible ReDoS vulnerability in Accept header parsing in Action Dispatch

There is a possible ReDoS vulnerability in the Accept header parsing routines
of Action Dispatch. This vulnerability has been assigned the CVE identifier
CVE-2024-26142.

Versions Affected:  >= 7.1.0, < 7.1.3.1
Not affected:       < 7.1.0
Fixed Versions:     7.1.3.1

Impact
------
Carefully crafted Accept headers can cause Accept header parsing in Action
Dispatch to take an unexpected amount of time, possibly resulting in a DoS
vulnerability.  All users running an affected release should either upgrade or
use one of the workarounds immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby
3.2 or newer are unaffected.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
There are no feasible workarounds for this issue.

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 7-1-accept-redox.patch - Patch for 7.1 series

Credits
-------
Thanks [svalkanov](https://hackerone.com/svalkanov) for the report and patch!
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-26142.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-26142.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-26142
reference_id
reference_type
scores
0
value 0.03542
scoring_system epss
scoring_elements 0.87875
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-26142
2
reference_url https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-28T20:01:00Z/
url https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-28T20:01:00Z/
url https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
6
reference_url https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system cvssv3.1_qr
scoring_elements
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-28T20:01:00Z/
url https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
7
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-28T20:01:00Z/
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-26142
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-26142
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2266324
reference_id 2266324
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2266324
10
reference_url https://github.com/advisories/GHSA-jjhx-jhvp-74wq
reference_id GHSA-jjhx-jhvp-74wq
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-jjhx-jhvp-74wq
11
reference_url https://security.netapp.com/advisory/ntap-20240503-0003/
reference_id ntap-20240503-0003
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-28T20:01:00Z/
url https://security.netapp.com/advisory/ntap-20240503-0003/
fixed_packages
0
url pkg:gem/actionpack@7.1.3.1
purl pkg:gem/actionpack@7.1.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dd87-gevs-juhe
1
vulnerability VCID-eeru-6pyc-8bcd
2
vulnerability VCID-nmz3-ux68-dkfd
3
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.1.3.1
aliases CVE-2024-26142, GHSA-jjhx-jhvp-74wq
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v2hk-dfbe-5khc
36
url VCID-v3u5-6bpb-qfgf
vulnerability_id VCID-v3u5-6bpb-qfgf
summary Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-7829.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-7829.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-7829
reference_id
reference_type
scores
0
value 0.00265
scoring_system epss
scoring_elements 0.50107
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-7829
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7829
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7829
4
reference_url https://github.com/advisories/GHSA-h56m-vwxc-3qpw
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-h56m-vwxc-3qpw
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-7829.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-7829.yml
6
reference_url https://groups.google.com/forum/message/raw?msg=rubyonrails-security/rMTQy4oRCGk/loS_CRS8mNEJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=rubyonrails-security/rMTQy4oRCGk/loS_CRS8mNEJ
7
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-7829
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-7829
9
reference_url https://puppet.com/security/cve/cve-2014-7829
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://puppet.com/security/cve/cve-2014-7829
10
reference_url https://web.archive.org/web/20160403085126/http://www.securityfocus.com/bid/71183
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160403085126/http://www.securityfocus.com/bid/71183
11
reference_url http://weblog.rubyonrails.org/2014/11/19/Rails-4-0-11-1-and-4-1-7-1-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2014/11/19/Rails-4-0-11-1-and-4-1-7-1-have-been-released/
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1164659
reference_id 1164659
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1164659
13
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770934
reference_id 770934
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770934
fixed_packages
0
url pkg:gem/actionpack@3.2.21
purl pkg:gem/actionpack@3.2.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-b4sv-b9pz-r7er
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-mnh7-4rvx-suay
17
vulnerability VCID-n7kh-9mpq-13c7
18
vulnerability VCID-nmz3-ux68-dkfd
19
vulnerability VCID-p1yd-keq8-rkh3
20
vulnerability VCID-qth9-abgp-wyaq
21
vulnerability VCID-r6mr-ay8d-nqdd
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-y13c-awe3-2bc1
24
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.21
1
url pkg:gem/actionpack@4.0.11.1
purl pkg:gem/actionpack@4.0.11.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-v2hk-dfbe-5khc
22
vulnerability VCID-y13c-awe3-2bc1
23
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.11.1
2
url pkg:gem/actionpack@4.0.12
purl pkg:gem/actionpack@4.0.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-v2hk-dfbe-5khc
22
vulnerability VCID-v3u5-6bpb-qfgf
23
vulnerability VCID-y13c-awe3-2bc1
24
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.12
3
url pkg:gem/actionpack@4.1.0.beta1
purl pkg:gem/actionpack@4.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-vs1a-m7ya-rue8
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.0.beta1
4
url pkg:gem/actionpack@4.1.7.1
purl pkg:gem/actionpack@4.1.7.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-v2hk-dfbe-5khc
22
vulnerability VCID-y13c-awe3-2bc1
23
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.7.1
5
url pkg:gem/actionpack@4.1.8
purl pkg:gem/actionpack@4.1.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-v2hk-dfbe-5khc
22
vulnerability VCID-v3u5-6bpb-qfgf
23
vulnerability VCID-y13c-awe3-2bc1
24
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.8
6
url pkg:gem/actionpack@4.2.0.beta1
purl pkg:gem/actionpack@4.2.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-y13c-awe3-2bc1
25
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.0.beta1
7
url pkg:gem/actionpack@4.2.0.beta4
purl pkg:gem/actionpack@4.2.0.beta4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-v2hk-dfbe-5khc
22
vulnerability VCID-v3u5-6bpb-qfgf
23
vulnerability VCID-y13c-awe3-2bc1
24
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.0.beta4
aliases CVE-2014-7829, GHSA-h56m-vwxc-3qpw
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v3u5-6bpb-qfgf
37
url VCID-v4sh-tkkf-xfeh
vulnerability_id VCID-v4sh-tkkf-xfeh
summary 
High severity vulnerability that affects actionpack
Withdrawn, accidental duplicate publish.

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
references
0
reference_url https://github.com/advisories/GHSA-hx46-vwmx-wx95
reference_id
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-hx46-vwmx-wx95
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-2098
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-2098
fixed_packages
0
url pkg:gem/actionpack@3.2.22.2
purl pkg:gem/actionpack@3.2.22.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-b4sv-b9pz-r7er
7
vulnerability VCID-bfbp-7umh-2fcp
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-mnh7-4rvx-suay
15
vulnerability VCID-n7kh-9mpq-13c7
16
vulnerability VCID-nmz3-ux68-dkfd
17
vulnerability VCID-p1yd-keq8-rkh3
18
vulnerability VCID-qth9-abgp-wyaq
19
vulnerability VCID-v2hk-dfbe-5khc
20
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.22.2
1
url pkg:gem/actionpack@4.1.14.2
purl pkg:gem/actionpack@4.1.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-dd87-gevs-juhe
8
vulnerability VCID-eeru-6pyc-8bcd
9
vulnerability VCID-ejgq-s79w-abd6
10
vulnerability VCID-g13k-qvy7-q3fk
11
vulnerability VCID-g2a6-uem4-uuce
12
vulnerability VCID-k6aw-heeb-wke2
13
vulnerability VCID-mnh7-4rvx-suay
14
vulnerability VCID-n7kh-9mpq-13c7
15
vulnerability VCID-nmz3-ux68-dkfd
16
vulnerability VCID-p1yd-keq8-rkh3
17
vulnerability VCID-qth9-abgp-wyaq
18
vulnerability VCID-v2hk-dfbe-5khc
19
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.14.2
2
url pkg:gem/actionpack@4.2.5.2
purl pkg:gem/actionpack@4.2.5.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-dd87-gevs-juhe
8
vulnerability VCID-eeru-6pyc-8bcd
9
vulnerability VCID-ejgq-s79w-abd6
10
vulnerability VCID-g13k-qvy7-q3fk
11
vulnerability VCID-g2a6-uem4-uuce
12
vulnerability VCID-k6aw-heeb-wke2
13
vulnerability VCID-mnh7-4rvx-suay
14
vulnerability VCID-n7kh-9mpq-13c7
15
vulnerability VCID-nmz3-ux68-dkfd
16
vulnerability VCID-p1yd-keq8-rkh3
17
vulnerability VCID-qth9-abgp-wyaq
18
vulnerability VCID-v2hk-dfbe-5khc
19
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.5.2
aliases GHSA-hx46-vwmx-wx95
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v4sh-tkkf-xfeh
38
url VCID-vhjv-9864-tbcs
vulnerability_id VCID-vhjv-9864-tbcs
summary 
actionpack Cross-site Scripting vulnerability
The sanitize helper in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded `:` (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a `&#x3a;` sequence.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
1
reference_url http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html
2
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
3
reference_url http://rhn.redhat.com/errata/RHSA-2013-0698.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0698.html
4
reference_url http://rhn.redhat.com/errata/RHSA-2014-1863.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-1863.html
5
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1857.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1857.json
6
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-1857
reference_id
reference_type
scores
0
value 0.00625
scoring_system epss
scoring_elements 0.7051
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-1857
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1857
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1857
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI
reference_id
reference_type
scores
url https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI
10
reference_url https://groups.google.com/group/rubyonrails-security/msg/78b9817a5943f6d6?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/78b9817a5943f6d6?dmode=source&output=gplain
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-1857
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-1857
12
reference_url http://support.apple.com/kb/HT5784
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://support.apple.com/kb/HT5784
13
reference_url https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
14
reference_url https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
15
reference_url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released
16
reference_url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
17
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=921335
reference_id 921335
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=921335
18
reference_url https://github.com/advisories/GHSA-j838-vfpq-fmf2
reference_id GHSA-j838-vfpq-fmf2
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-j838-vfpq-fmf2
19
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
0
url pkg:gem/actionpack@3.2.13
purl pkg:gem/actionpack@3.2.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-3rn4-abmh-nkhv
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-5psk-hzaf-1kbz
5
vulnerability VCID-832g-x9kb-3bbx
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-9gqn-8g4t-wfby
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-cs1f-uhb2-xkcm
14
vulnerability VCID-dd87-gevs-juhe
15
vulnerability VCID-eeru-6pyc-8bcd
16
vulnerability VCID-ejgq-s79w-abd6
17
vulnerability VCID-g13k-qvy7-q3fk
18
vulnerability VCID-g2a6-uem4-uuce
19
vulnerability VCID-jpj6-wzp3-m3e4
20
vulnerability VCID-k6aw-heeb-wke2
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nax4-x97j-9fgr
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-nnka-c23v-qub7
26
vulnerability VCID-p1yd-keq8-rkh3
27
vulnerability VCID-qth9-abgp-wyaq
28
vulnerability VCID-r6mr-ay8d-nqdd
29
vulnerability VCID-sg9h-7dqr-xugu
30
vulnerability VCID-v2hk-dfbe-5khc
31
vulnerability VCID-v3u5-6bpb-qfgf
32
vulnerability VCID-vhjv-9864-tbcs
33
vulnerability VCID-vs1a-m7ya-rue8
34
vulnerability VCID-y13c-awe3-2bc1
35
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.13
aliases CVE-2013-1857, GHSA-j838-vfpq-fmf2, OSV-91454
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vhjv-9864-tbcs
39
url VCID-vs1a-m7ya-rue8
vulnerability_id VCID-vs1a-m7ya-rue8
summary 
Rails vulnerable to Cross-site Scripting
There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0081.

Versions Affected:  All.
Fixed Versions:     4.1.0.beta2, 4.0.3, 3.2.17.

Impact
------
These helpers allows users to nicely format a numeric value. Some of the parameters to the helper (format, negative_format and units) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack.

All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately.

Releases
--------
The 4.1.0.rc1, 4.0.3 and 3.2.17 releases are available at the normal locations.

Workarounds
-----------

The workaround for this issue is to escape the value passed to the parameter.
For example, replace code like this:

```ruby
<%= number_to_currency(1.02, format: params[:format]) %>
```

With code like this

```ruby
<%= number_to_currency(1.02, format: h(params[:format])) %>
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 4-1-beta-number_helpers_xss.patch - Patch for 4.1-beta series
* 4-0-number_helpers_xss.patch - Patch for 4.0 series
* 3-2-number_helpers_xss.patch - Patch for 3.2 series

Please note that only the 4.0.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------

Thanks to Kevin Reintjes for reporting the issue to us.

-- 
Aaron Patterson
http://tenderlovemaking.com/
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
1
reference_url http://openwall.com/lists/oss-security/2014/02/18/8
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://openwall.com/lists/oss-security/2014/02/18/8
2
reference_url http://rhn.redhat.com/errata/RHSA-2014-0215.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0215.html
3
reference_url http://rhn.redhat.com/errata/RHSA-2014-0306.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0306.html
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0081.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0081.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-0081
reference_id
reference_type
scores
0
value 0.00885
scoring_system epss
scoring_elements 0.75766
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-0081
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0081
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0081
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0082
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0082
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0130
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0130
9
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
10
reference_url https://github.com/rails/rails/commit/08d0a11a3f62718d601d39e617c834759cf59bbb
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/08d0a11a3f62718d601d39e617c834759cf59bbb
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0081.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0081.yml
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2014-0081.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2014-0081.yml
13
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/tfp6gZCtzr4
reference_id
reference_type
scores
url https://groups.google.com/forum/#!topic/rubyonrails-security/tfp6gZCtzr4
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-0081
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-0081
15
reference_url https://web.archive.org/web/20140911141416/http://www.securitytracker.com/id/1029782
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20140911141416/http://www.securitytracker.com/id/1029782
16
reference_url https://web.archive.org/web/20170307202606/http://www.securityfocus.com/bid/65647
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20170307202606/http://www.securityfocus.com/bid/65647
17
reference_url https://web.archive.org/web/20201207045136/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201207045136/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1065520
reference_id 1065520
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1065520
19
reference_url https://github.com/advisories/GHSA-m46p-ggm5-5j83
reference_id GHSA-m46p-ggm5-5j83
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-m46p-ggm5-5j83
20
reference_url https://access.redhat.com/errata/RHSA-2014:0215
reference_id RHSA-2014:0215
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0215
21
reference_url https://access.redhat.com/errata/RHSA-2014:0306
reference_id RHSA-2014:0306
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0306
fixed_packages
0
url pkg:gem/actionpack@3.2.17
purl pkg:gem/actionpack@3.2.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-b4sv-b9pz-r7er
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-mnh7-4rvx-suay
17
vulnerability VCID-n7kh-9mpq-13c7
18
vulnerability VCID-nmz3-ux68-dkfd
19
vulnerability VCID-p1yd-keq8-rkh3
20
vulnerability VCID-qth9-abgp-wyaq
21
vulnerability VCID-r6mr-ay8d-nqdd
22
vulnerability VCID-sg9h-7dqr-xugu
23
vulnerability VCID-v2hk-dfbe-5khc
24
vulnerability VCID-v3u5-6bpb-qfgf
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.17
1
url pkg:gem/actionpack@4.0.3
purl pkg:gem/actionpack@4.0.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-y13c-awe3-2bc1
25
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.3
2
url pkg:gem/actionpack@4.1.0.beta1
purl pkg:gem/actionpack@4.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-vs1a-m7ya-rue8
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.0.beta1
3
url pkg:gem/actionpack@4.1.1
purl pkg:gem/actionpack@4.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-y13c-awe3-2bc1
25
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.1
aliases CVE-2014-0081, GHSA-m46p-ggm5-5j83, OSV-103439
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vs1a-m7ya-rue8
40
url VCID-y13c-awe3-2bc1
vulnerability_id VCID-y13c-awe3-2bc1
summary 
actionpack is vulnerable to remote bypass authentication
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
references
0
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
3
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178068.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178068.html
4
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
5
reference_url http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
6
reference_url http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
7
reference_url http://rhn.redhat.com/errata/RHSA-2016-0296.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-0296.html
8
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-7576.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-7576.json
9
reference_url https://api.first.org/data/v1/epss?cve=CVE-2015-7576
reference_id
reference_type
scores
0
value 0.01119
scoring_system epss
scoring_elements 0.78538
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2015-7576
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3226
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3226
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3227
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3227
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7576
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7576
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7577
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7577
14
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7581
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7581
15
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0751
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0751
16
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0752
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0752
17
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0753
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0753
18
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:N/C:P/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
19
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
20
reference_url https://github.com/rails/rails/commit/17e6f1507b7f2c2a883c180f4f9548445d6dfbd
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/17e6f1507b7f2c2a883c180f4f9548445d6dfbd
21
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2015-7576.yml
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2015-7576.yml
22
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/ANv0HDHEC3k/T8Hgq-hYEgAJ
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/ANv0HDHEC3k/T8Hgq-hYEgAJ
23
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements
1
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k
24
reference_url https://nvd.nist.gov/vuln/detail/CVE-2015-7576
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2015-7576
25
reference_url https://web.archive.org/web/20160405205300/http://www.securitytracker.com/id/1034816
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160405205300/http://www.securitytracker.com/id/1034816
26
reference_url https://web.archive.org/web/20200228001849/http://www.securityfocus.com/bid/81803
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200228001849/http://www.securityfocus.com/bid/81803
27
reference_url http://www.debian.org/security/2016/dsa-3464
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2016/dsa-3464
28
reference_url http://www.openwall.com/lists/oss-security/2016/01/25/8
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2016/01/25/8
29
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1301933
reference_id 1301933
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1301933
30
reference_url https://github.com/advisories/GHSA-p692-7mm3-3fxg
reference_id GHSA-p692-7mm3-3fxg
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-p692-7mm3-3fxg
31
reference_url https://access.redhat.com/errata/RHSA-2016:0296
reference_id RHSA-2016:0296
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0296
32
reference_url https://access.redhat.com/errata/RHSA-2016:0454
reference_id RHSA-2016:0454
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0454
33
reference_url https://access.redhat.com/errata/RHSA-2016:0455
reference_id RHSA-2016:0455
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0455
fixed_packages
0
url pkg:gem/actionpack@3.2.22.1
purl pkg:gem/actionpack@3.2.22.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-b4sv-b9pz-r7er
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-mnh7-4rvx-suay
17
vulnerability VCID-n7kh-9mpq-13c7
18
vulnerability VCID-nmz3-ux68-dkfd
19
vulnerability VCID-p1yd-keq8-rkh3
20
vulnerability VCID-qth9-abgp-wyaq
21
vulnerability VCID-v2hk-dfbe-5khc
22
vulnerability VCID-v4sh-tkkf-xfeh
23
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.22.1
1
url pkg:gem/actionpack@4.1.14.1
purl pkg:gem/actionpack@4.1.14.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-832g-x9kb-3bbx
4
vulnerability VCID-8nkw-8mka-1ygk
5
vulnerability VCID-98gu-r7wd-cuah
6
vulnerability VCID-a6wp-n5yh-ybcv
7
vulnerability VCID-bfbp-7umh-2fcp
8
vulnerability VCID-brwd-e9kx-xuc2
9
vulnerability VCID-dd87-gevs-juhe
10
vulnerability VCID-eeru-6pyc-8bcd
11
vulnerability VCID-ejgq-s79w-abd6
12
vulnerability VCID-g13k-qvy7-q3fk
13
vulnerability VCID-g2a6-uem4-uuce
14
vulnerability VCID-k6aw-heeb-wke2
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-v2hk-dfbe-5khc
21
vulnerability VCID-v4sh-tkkf-xfeh
22
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.14.1
2
url pkg:gem/actionpack@4.2.5.1
purl pkg:gem/actionpack@4.2.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-mnh7-4rvx-suay
15
vulnerability VCID-n7kh-9mpq-13c7
16
vulnerability VCID-nmz3-ux68-dkfd
17
vulnerability VCID-p1yd-keq8-rkh3
18
vulnerability VCID-qth9-abgp-wyaq
19
vulnerability VCID-v2hk-dfbe-5khc
20
vulnerability VCID-v4sh-tkkf-xfeh
21
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.5.1
3
url pkg:gem/actionpack@5.0.0.beta1.1
purl pkg:gem/actionpack@5.0.0.beta1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-dd87-gevs-juhe
8
vulnerability VCID-eeru-6pyc-8bcd
9
vulnerability VCID-ejgq-s79w-abd6
10
vulnerability VCID-g13k-qvy7-q3fk
11
vulnerability VCID-g2a6-uem4-uuce
12
vulnerability VCID-k6aw-heeb-wke2
13
vulnerability VCID-mnh7-4rvx-suay
14
vulnerability VCID-n7kh-9mpq-13c7
15
vulnerability VCID-nmz3-ux68-dkfd
16
vulnerability VCID-p1yd-keq8-rkh3
17
vulnerability VCID-qth9-abgp-wyaq
18
vulnerability VCID-v2hk-dfbe-5khc
19
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.0.0.beta1.1
aliases CVE-2015-7576, GHSA-p692-7mm3-3fxg
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-y13c-awe3-2bc1
41
url VCID-zapd-uts9-zfch
vulnerability_id VCID-zapd-uts9-zfch
summary 
actionpack allows remote attackers to bypass intended access restrictions
`actionpack/lib/action_view/template/resolver.rb` in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-0449
reference_id
reference_type
scores
0
value 0.00555
scoring_system epss
scoring_elements 0.68408
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-0449
3
reference_url http://secunia.com/advisories/43278
reference_id
reference_type
scores
url http://secunia.com/advisories/43278
4
reference_url http://securitytracker.com/id?1025061
reference_id
reference_type
scores
url http://securitytracker.com/id?1025061
5
reference_url https://github.com/rails/rails/commit/6f80224057803f85b3f448936aae89e742452c3b
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/6f80224057803f85b3f448936aae89e742452c3b
6
reference_url https://github.com/rails/rails/tree/main/actionpack
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/tree/main/actionpack
7
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0449.yml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0449.yml
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-0449
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-0449
9
reference_url https://web.archive.org/web/20201207190612/http://securitytracker.com/id?1025061
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201207190612/http://securitytracker.com/id?1025061
10
reference_url http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
11
reference_url http://www.vupen.com/english/advisories/2011/0877
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2011/0877
12
reference_url https://github.com/advisories/GHSA-4ww3-3rxj-8v6q
reference_id GHSA-4ww3-3rxj-8v6q
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4ww3-3rxj-8v6q
13
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
aliases CVE-2011-0449, GHSA-4ww3-3rxj-8v6q
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zapd-uts9-zfch
Fixing_vulnerabilities
0
url VCID-cs1f-uhb2-xkcm
vulnerability_id VCID-cs1f-uhb2-xkcm
summary 
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the simple_format helper in `actionpack/lib/action_view/helpers/text_helper.rb` in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6416.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6416.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-6416
reference_id
reference_type
scores
0
value 0.00236
scoring_system epss
scoring_elements 0.46624
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-6416
2
reference_url http://seclists.org/oss-sec/2013/q4/404
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/404
3
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
4
reference_url https://github.com/rails/rails/commit/4b4f5847f64f81c961625e647711ef9f6ad1a454
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/4b4f5847f64f81c961625e647711ef9f6ad1a454
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6416.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6416.yml
6
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/5ZI1-H5OoIM/ZNq4FoR2GnIJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/5ZI1-H5OoIM/ZNq4FoR2GnIJ
7
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/5ZI1-H5OoIM
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/5ZI1-H5OoIM
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-6416
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-6416
9
reference_url https://web.archive.org/web/20200228165109/http://www.securityfocus.com/bid/64071
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200228165109/http://www.securityfocus.com/bid/64071
10
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
11
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036914
reference_id 1036914
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036914
13
reference_url https://github.com/advisories/GHSA-w37c-q653-qg95
reference_id GHSA-w37c-q653-qg95
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-w37c-q653-qg95
fixed_packages
0
url pkg:gem/actionpack@2.3.2
purl pkg:gem/actionpack@2.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-1xbd-73qv-mff9
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4bzb-ft3d-dkgg
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5a2t-fre4-zkay
7
vulnerability VCID-5pfg-7ntp-eff4
8
vulnerability VCID-5psk-hzaf-1kbz
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-baur-f442-wqgw
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-cs1f-uhb2-xkcm
16
vulnerability VCID-dd87-gevs-juhe
17
vulnerability VCID-eeru-6pyc-8bcd
18
vulnerability VCID-ejgq-s79w-abd6
19
vulnerability VCID-g13k-qvy7-q3fk
20
vulnerability VCID-g2a6-uem4-uuce
21
vulnerability VCID-jpj6-wzp3-m3e4
22
vulnerability VCID-k6aw-heeb-wke2
23
vulnerability VCID-mnh7-4rvx-suay
24
vulnerability VCID-n7kh-9mpq-13c7
25
vulnerability VCID-nax4-x97j-9fgr
26
vulnerability VCID-nmz3-ux68-dkfd
27
vulnerability VCID-nnka-c23v-qub7
28
vulnerability VCID-p1yd-keq8-rkh3
29
vulnerability VCID-qth9-abgp-wyaq
30
vulnerability VCID-r6mr-ay8d-nqdd
31
vulnerability VCID-rgw4-mrr9-euda
32
vulnerability VCID-sg9h-7dqr-xugu
33
vulnerability VCID-v2hk-dfbe-5khc
34
vulnerability VCID-v3u5-6bpb-qfgf
35
vulnerability VCID-vhjv-9864-tbcs
36
vulnerability VCID-vs1a-m7ya-rue8
37
vulnerability VCID-y13c-awe3-2bc1
38
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@2.3.2
1
url pkg:gem/actionpack@3.1.0
purl pkg:gem/actionpack@3.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-1xbd-73qv-mff9
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4bzb-ft3d-dkgg
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5a2t-fre4-zkay
7
vulnerability VCID-5pfg-7ntp-eff4
8
vulnerability VCID-5psk-hzaf-1kbz
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-cs1f-uhb2-xkcm
16
vulnerability VCID-dd87-gevs-juhe
17
vulnerability VCID-eeru-6pyc-8bcd
18
vulnerability VCID-ejgq-s79w-abd6
19
vulnerability VCID-g13k-qvy7-q3fk
20
vulnerability VCID-g2a6-uem4-uuce
21
vulnerability VCID-jpj6-wzp3-m3e4
22
vulnerability VCID-k6aw-heeb-wke2
23
vulnerability VCID-mnh7-4rvx-suay
24
vulnerability VCID-n7kh-9mpq-13c7
25
vulnerability VCID-nax4-x97j-9fgr
26
vulnerability VCID-nmz3-ux68-dkfd
27
vulnerability VCID-nnka-c23v-qub7
28
vulnerability VCID-p1yd-keq8-rkh3
29
vulnerability VCID-qth9-abgp-wyaq
30
vulnerability VCID-r6mr-ay8d-nqdd
31
vulnerability VCID-rgw4-mrr9-euda
32
vulnerability VCID-sg9h-7dqr-xugu
33
vulnerability VCID-v2hk-dfbe-5khc
34
vulnerability VCID-v3u5-6bpb-qfgf
35
vulnerability VCID-vhjv-9864-tbcs
36
vulnerability VCID-vs1a-m7ya-rue8
37
vulnerability VCID-y13c-awe3-2bc1
38
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.0
2
url pkg:gem/actionpack@3.2.0
purl pkg:gem/actionpack@3.2.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-1xbd-73qv-mff9
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4bzb-ft3d-dkgg
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5a2t-fre4-zkay
7
vulnerability VCID-5pfg-7ntp-eff4
8
vulnerability VCID-5psk-hzaf-1kbz
9
vulnerability VCID-832g-x9kb-3bbx
10
vulnerability VCID-8nkw-8mka-1ygk
11
vulnerability VCID-98gu-r7wd-cuah
12
vulnerability VCID-9gqn-8g4t-wfby
13
vulnerability VCID-a6wp-n5yh-ybcv
14
vulnerability VCID-b4sv-b9pz-r7er
15
vulnerability VCID-bfbp-7umh-2fcp
16
vulnerability VCID-brwd-e9kx-xuc2
17
vulnerability VCID-cs1f-uhb2-xkcm
18
vulnerability VCID-dd87-gevs-juhe
19
vulnerability VCID-eeru-6pyc-8bcd
20
vulnerability VCID-ejgq-s79w-abd6
21
vulnerability VCID-g13k-qvy7-q3fk
22
vulnerability VCID-g2a6-uem4-uuce
23
vulnerability VCID-jpj6-wzp3-m3e4
24
vulnerability VCID-k6aw-heeb-wke2
25
vulnerability VCID-mnh7-4rvx-suay
26
vulnerability VCID-n7kh-9mpq-13c7
27
vulnerability VCID-nax4-x97j-9fgr
28
vulnerability VCID-nmz3-ux68-dkfd
29
vulnerability VCID-nnka-c23v-qub7
30
vulnerability VCID-p1yd-keq8-rkh3
31
vulnerability VCID-qth9-abgp-wyaq
32
vulnerability VCID-r6mr-ay8d-nqdd
33
vulnerability VCID-rgw4-mrr9-euda
34
vulnerability VCID-sg9h-7dqr-xugu
35
vulnerability VCID-v2hk-dfbe-5khc
36
vulnerability VCID-v3u5-6bpb-qfgf
37
vulnerability VCID-v4sh-tkkf-xfeh
38
vulnerability VCID-vhjv-9864-tbcs
39
vulnerability VCID-vs1a-m7ya-rue8
40
vulnerability VCID-y13c-awe3-2bc1
41
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.0
3
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-5pfg-7ntp-eff4
3
vulnerability VCID-8nkw-8mka-1ygk
4
vulnerability VCID-98gu-r7wd-cuah
5
vulnerability VCID-a6wp-n5yh-ybcv
6
vulnerability VCID-bfbp-7umh-2fcp
7
vulnerability VCID-brwd-e9kx-xuc2
8
vulnerability VCID-dd87-gevs-juhe
9
vulnerability VCID-eeru-6pyc-8bcd
10
vulnerability VCID-ejgq-s79w-abd6
11
vulnerability VCID-g13k-qvy7-q3fk
12
vulnerability VCID-g2a6-uem4-uuce
13
vulnerability VCID-k6aw-heeb-wke2
14
vulnerability VCID-m156-zkzd-57g9
15
vulnerability VCID-mnh7-4rvx-suay
16
vulnerability VCID-n7kh-9mpq-13c7
17
vulnerability VCID-nmz3-ux68-dkfd
18
vulnerability VCID-p1yd-keq8-rkh3
19
vulnerability VCID-qth9-abgp-wyaq
20
vulnerability VCID-r6mr-ay8d-nqdd
21
vulnerability VCID-sg9h-7dqr-xugu
22
vulnerability VCID-v2hk-dfbe-5khc
23
vulnerability VCID-v3u5-6bpb-qfgf
24
vulnerability VCID-vs1a-m7ya-rue8
25
vulnerability VCID-y13c-awe3-2bc1
26
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-6416, GHSA-w37c-q653-qg95, OSV-100526
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cs1f-uhb2-xkcm
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.0