Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:gem/actionpack@3.0.0.rc
Typegem
Namespace
Nameactionpack
Version3.0.0.rc
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version8.1.2.1
Latest_non_vulnerable_version8.1.2.1
Affected_by_vulnerabilities
0
url VCID-123f-6px7-3qdg
vulnerability_id VCID-123f-6px7-3qdg
summary Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a `..` (dot dot) in a pathname.
references
0
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html
2
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
3
reference_url http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
4
reference_url http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2016-0296.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url http://rhn.redhat.com/errata/RHSA-2016-0296.html
6
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0752.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0752.json
7
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-0752
reference_id
reference_type
scores
0
value 0.90494
scoring_system epss
scoring_elements 0.99626
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-0752
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3226
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3226
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3227
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3227
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7576
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7576
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7577
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7577
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7581
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7581
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0751
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0751
14
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0752
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0752
15
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0753
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0753
16
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:N/C:P/I:P/A:P
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
17
reference_url https://github.com/advisories/GHSA-xrr4-p6fq-hjg7
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-xrr4-p6fq-hjg7
18
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0752.yml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0752.yml
19
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2016-0752.yml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2016-0752.yml
20
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
21
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00
22
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-0752
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-0752
23
reference_url https://web.archive.org/web/20210618005620/https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210618005620/https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
24
reference_url https://web.archive.org/web/20210621170450/http://www.securityfocus.com/bid/81801
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210621170450/http://www.securityfocus.com/bid/81801
25
reference_url https://web.archive.org/web/20210723192420/http://www.securitytracker.com/id/1034816
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210723192420/http://www.securitytracker.com/id/1034816
26
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752
27
reference_url https://www.exploit-db.com/exploits/40561
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.exploit-db.com/exploits/40561
28
reference_url http://www.debian.org/security/2016/dsa-3464
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url http://www.debian.org/security/2016/dsa-3464
29
reference_url http://www.openwall.com/lists/oss-security/2016/01/25/13
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url http://www.openwall.com/lists/oss-security/2016/01/25/13
30
reference_url http://www.securityfocus.com/bid/81801
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url http://www.securityfocus.com/bid/81801
31
reference_url http://www.securitytracker.com/id/1034816
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url http://www.securitytracker.com/id/1034816
32
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1301963
reference_id 1301963
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1301963
33
reference_url https://www.exploit-db.com/exploits/40561/
reference_id 40561
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/
url https://www.exploit-db.com/exploits/40561/
34
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/40561.rb
reference_id CVE-2016-0752
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/40561.rb
35
reference_url https://access.redhat.com/errata/RHSA-2016:0296
reference_id RHSA-2016:0296
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0296
36
reference_url https://access.redhat.com/errata/RHSA-2016:0454
reference_id RHSA-2016:0454
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0454
37
reference_url https://access.redhat.com/errata/RHSA-2016:0455
reference_id RHSA-2016:0455
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0455
fixed_packages
0
url pkg:gem/actionpack@3.2.22.1
purl pkg:gem/actionpack@3.2.22.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-832g-x9kb-3bbx
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-b4sv-b9pz-r7er
10
vulnerability VCID-bfbp-7umh-2fcp
11
vulnerability VCID-brwd-e9kx-xuc2
12
vulnerability VCID-dd87-gevs-juhe
13
vulnerability VCID-eeru-6pyc-8bcd
14
vulnerability VCID-ejgq-s79w-abd6
15
vulnerability VCID-g13k-qvy7-q3fk
16
vulnerability VCID-g2a6-uem4-uuce
17
vulnerability VCID-k6aw-heeb-wke2
18
vulnerability VCID-kshz-ckjc-77ab
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-v2hk-dfbe-5khc
27
vulnerability VCID-v4sh-tkkf-xfeh
28
vulnerability VCID-z16b-zfgu-13a9
29
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.22.1
1
url pkg:gem/actionpack@4.1.14.1
purl pkg:gem/actionpack@4.1.14.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-832g-x9kb-3bbx
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m9ud-s6w6-x7ac
19
vulnerability VCID-mnh7-4rvx-suay
20
vulnerability VCID-n7ga-1sx4-yfcv
21
vulnerability VCID-n7kh-9mpq-13c7
22
vulnerability VCID-nmz3-ux68-dkfd
23
vulnerability VCID-p1yd-keq8-rkh3
24
vulnerability VCID-qth9-abgp-wyaq
25
vulnerability VCID-v2hk-dfbe-5khc
26
vulnerability VCID-v4sh-tkkf-xfeh
27
vulnerability VCID-z16b-zfgu-13a9
28
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.14.1
2
url pkg:gem/actionpack@4.2.5.1
purl pkg:gem/actionpack@4.2.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-a6wp-n5yh-ybcv
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-kshz-ckjc-77ab
17
vulnerability VCID-m9ud-s6w6-x7ac
18
vulnerability VCID-mnh7-4rvx-suay
19
vulnerability VCID-n7ga-1sx4-yfcv
20
vulnerability VCID-n7kh-9mpq-13c7
21
vulnerability VCID-nmz3-ux68-dkfd
22
vulnerability VCID-p1yd-keq8-rkh3
23
vulnerability VCID-qth9-abgp-wyaq
24
vulnerability VCID-v2hk-dfbe-5khc
25
vulnerability VCID-v4sh-tkkf-xfeh
26
vulnerability VCID-z16b-zfgu-13a9
27
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.5.1
aliases CVE-2016-0752, GHSA-xrr4-p6fq-hjg7
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-123f-6px7-3qdg
1
url VCID-1b9z-efz6-9fdu
vulnerability_id VCID-1b9z-efz6-9fdu
summary 
actionpack Improper Input Validation vulnerability
The template selection functionality in `actionpack/lib/action_view/template/resolver.rb` in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/cbbbba6e4f7eaf61?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/cbbbba6e4f7eaf61?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-2929
reference_id
reference_type
scores
0
value 0.00814
scoring_system epss
scoring_elements 0.7458
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-2929
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=731432
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=731432
5
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
6
reference_url https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552
7
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-2929.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-2929.yml
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-2929
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-2929
9
reference_url https://rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
10
reference_url http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
11
reference_url http://www.openwall.com/lists/oss-security/2011/08/17/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/17/1
12
reference_url http://www.openwall.com/lists/oss-security/2011/08/19/11
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/19/11
13
reference_url http://www.openwall.com/lists/oss-security/2011/08/20/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/20/1
14
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/13
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/13
15
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/14
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/14
16
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/5
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/5
17
reference_url https://github.com/advisories/GHSA-r7q2-5gqg-6c7q
reference_id GHSA-r7q2-5gqg-6c7q
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-r7q2-5gqg-6c7q
18
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
0
url pkg:gem/actionpack@3.0.10
purl pkg:gem/actionpack@3.0.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.10
1
url pkg:gem/actionpack@3.1.0
purl pkg:gem/actionpack@3.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.0
aliases CVE-2011-2929, GHSA-r7q2-5gqg-6c7q
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1b9z-efz6-9fdu
2
url VCID-1xbd-73qv-mff9
vulnerability_id VCID-1xbd-73qv-mff9
summary 
actionpack Improper Authentication vulnerability
The `decode_credentials` method in `actionpack/lib/action_controller/metal/http_authentication.rb` in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a `with_http_digest` helper method, as demonstrated by the `authenticate_or_request_with_http_digest` method.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
1
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3424.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3424.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-3424
reference_id
reference_type
scores
0
value 0.00981
scoring_system epss
scoring_elements 0.7707
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-3424
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rails/rails/commit/3719bd3e95523c5518507dbe44f260f252930600
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/3719bd3e95523c5518507dbe44f260f252930600
6
reference_url https://groups.google.com/group/rubyonrails-security/msg/244d32f2fa25147d?hl=en&dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/244d32f2fa25147d?hl=en&dmode=source&output=gplain
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-3424
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-3424
8
reference_url http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=843711
reference_id 843711
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=843711
10
reference_url https://github.com/advisories/GHSA-92w9-2pqw-rhjj
reference_id GHSA-92w9-2pqw-rhjj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-92w9-2pqw-rhjj
11
reference_url https://access.redhat.com/errata/RHSA-2012:1542
reference_id RHSA-2012:1542
reference_type
scores
url https://access.redhat.com/errata/RHSA-2012:1542
12
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
fixed_packages
0
url pkg:gem/actionpack@3.0.16
purl pkg:gem/actionpack@3.0.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4bzb-ft3d-dkgg
5
vulnerability VCID-4w1v-z4zj-6ydp
6
vulnerability VCID-58sa-6uag-z7hp
7
vulnerability VCID-5pfg-7ntp-eff4
8
vulnerability VCID-5psk-hzaf-1kbz
9
vulnerability VCID-6z21-pd9d-pfgk
10
vulnerability VCID-8nkw-8mka-1ygk
11
vulnerability VCID-98gu-r7wd-cuah
12
vulnerability VCID-9gqn-8g4t-wfby
13
vulnerability VCID-a6wp-n5yh-ybcv
14
vulnerability VCID-b4sv-b9pz-r7er
15
vulnerability VCID-bfbp-7umh-2fcp
16
vulnerability VCID-cs1f-uhb2-xkcm
17
vulnerability VCID-dd87-gevs-juhe
18
vulnerability VCID-eeru-6pyc-8bcd
19
vulnerability VCID-ejgq-s79w-abd6
20
vulnerability VCID-g13k-qvy7-q3fk
21
vulnerability VCID-g2a6-uem4-uuce
22
vulnerability VCID-hh65-ycrj-d7gz
23
vulnerability VCID-jpj6-wzp3-m3e4
24
vulnerability VCID-k6aw-heeb-wke2
25
vulnerability VCID-kshz-ckjc-77ab
26
vulnerability VCID-m9ud-s6w6-x7ac
27
vulnerability VCID-mnh7-4rvx-suay
28
vulnerability VCID-n7ga-1sx4-yfcv
29
vulnerability VCID-n7kh-9mpq-13c7
30
vulnerability VCID-nax4-x97j-9fgr
31
vulnerability VCID-nmz3-ux68-dkfd
32
vulnerability VCID-nnka-c23v-qub7
33
vulnerability VCID-p1yd-keq8-rkh3
34
vulnerability VCID-qth9-abgp-wyaq
35
vulnerability VCID-r6mr-ay8d-nqdd
36
vulnerability VCID-rgw4-mrr9-euda
37
vulnerability VCID-sg9h-7dqr-xugu
38
vulnerability VCID-v2hk-dfbe-5khc
39
vulnerability VCID-v3u5-6bpb-qfgf
40
vulnerability VCID-vhjv-9864-tbcs
41
vulnerability VCID-vs1a-m7ya-rue8
42
vulnerability VCID-y13c-awe3-2bc1
43
vulnerability VCID-z16b-zfgu-13a9
44
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.16
1
url pkg:gem/actionpack@3.1.0.beta1
purl pkg:gem/actionpack@3.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.0.beta1
2
url pkg:gem/actionpack@3.1.7
purl pkg:gem/actionpack@3.1.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4bzb-ft3d-dkgg
5
vulnerability VCID-4w1v-z4zj-6ydp
6
vulnerability VCID-58sa-6uag-z7hp
7
vulnerability VCID-5pfg-7ntp-eff4
8
vulnerability VCID-5psk-hzaf-1kbz
9
vulnerability VCID-6z21-pd9d-pfgk
10
vulnerability VCID-8nkw-8mka-1ygk
11
vulnerability VCID-98gu-r7wd-cuah
12
vulnerability VCID-9gqn-8g4t-wfby
13
vulnerability VCID-a6wp-n5yh-ybcv
14
vulnerability VCID-b4sv-b9pz-r7er
15
vulnerability VCID-bfbp-7umh-2fcp
16
vulnerability VCID-cs1f-uhb2-xkcm
17
vulnerability VCID-dd87-gevs-juhe
18
vulnerability VCID-eeru-6pyc-8bcd
19
vulnerability VCID-ejgq-s79w-abd6
20
vulnerability VCID-g13k-qvy7-q3fk
21
vulnerability VCID-g2a6-uem4-uuce
22
vulnerability VCID-hh65-ycrj-d7gz
23
vulnerability VCID-jpj6-wzp3-m3e4
24
vulnerability VCID-k6aw-heeb-wke2
25
vulnerability VCID-kshz-ckjc-77ab
26
vulnerability VCID-m9ud-s6w6-x7ac
27
vulnerability VCID-mnh7-4rvx-suay
28
vulnerability VCID-n7ga-1sx4-yfcv
29
vulnerability VCID-n7kh-9mpq-13c7
30
vulnerability VCID-nax4-x97j-9fgr
31
vulnerability VCID-nmz3-ux68-dkfd
32
vulnerability VCID-nnka-c23v-qub7
33
vulnerability VCID-p1yd-keq8-rkh3
34
vulnerability VCID-qth9-abgp-wyaq
35
vulnerability VCID-r6mr-ay8d-nqdd
36
vulnerability VCID-rgw4-mrr9-euda
37
vulnerability VCID-sg9h-7dqr-xugu
38
vulnerability VCID-v2hk-dfbe-5khc
39
vulnerability VCID-v3u5-6bpb-qfgf
40
vulnerability VCID-vhjv-9864-tbcs
41
vulnerability VCID-vs1a-m7ya-rue8
42
vulnerability VCID-y13c-awe3-2bc1
43
vulnerability VCID-z16b-zfgu-13a9
44
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.7
3
url pkg:gem/actionpack@3.2.0.rc1
purl pkg:gem/actionpack@3.2.0.rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-832g-x9kb-3bbx
13
vulnerability VCID-8nkw-8mka-1ygk
14
vulnerability VCID-98gu-r7wd-cuah
15
vulnerability VCID-9gqn-8g4t-wfby
16
vulnerability VCID-a6wp-n5yh-ybcv
17
vulnerability VCID-b4sv-b9pz-r7er
18
vulnerability VCID-bfbp-7umh-2fcp
19
vulnerability VCID-brwd-e9kx-xuc2
20
vulnerability VCID-cs1f-uhb2-xkcm
21
vulnerability VCID-dd87-gevs-juhe
22
vulnerability VCID-eeru-6pyc-8bcd
23
vulnerability VCID-ejgq-s79w-abd6
24
vulnerability VCID-g13k-qvy7-q3fk
25
vulnerability VCID-g2a6-uem4-uuce
26
vulnerability VCID-hh65-ycrj-d7gz
27
vulnerability VCID-jpj6-wzp3-m3e4
28
vulnerability VCID-k6aw-heeb-wke2
29
vulnerability VCID-kshz-ckjc-77ab
30
vulnerability VCID-m9ud-s6w6-x7ac
31
vulnerability VCID-mnh7-4rvx-suay
32
vulnerability VCID-n7ga-1sx4-yfcv
33
vulnerability VCID-n7kh-9mpq-13c7
34
vulnerability VCID-nax4-x97j-9fgr
35
vulnerability VCID-nmz3-ux68-dkfd
36
vulnerability VCID-nnka-c23v-qub7
37
vulnerability VCID-p1yd-keq8-rkh3
38
vulnerability VCID-qth9-abgp-wyaq
39
vulnerability VCID-r6mr-ay8d-nqdd
40
vulnerability VCID-rgw4-mrr9-euda
41
vulnerability VCID-sg9h-7dqr-xugu
42
vulnerability VCID-v2hk-dfbe-5khc
43
vulnerability VCID-v3u5-6bpb-qfgf
44
vulnerability VCID-vhjv-9864-tbcs
45
vulnerability VCID-vs1a-m7ya-rue8
46
vulnerability VCID-y13c-awe3-2bc1
47
vulnerability VCID-z16b-zfgu-13a9
48
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.0.rc1
4
url pkg:gem/actionpack@3.2.7
purl pkg:gem/actionpack@3.2.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4bzb-ft3d-dkgg
5
vulnerability VCID-4w1v-z4zj-6ydp
6
vulnerability VCID-58sa-6uag-z7hp
7
vulnerability VCID-5pfg-7ntp-eff4
8
vulnerability VCID-5psk-hzaf-1kbz
9
vulnerability VCID-6z21-pd9d-pfgk
10
vulnerability VCID-832g-x9kb-3bbx
11
vulnerability VCID-8nkw-8mka-1ygk
12
vulnerability VCID-98gu-r7wd-cuah
13
vulnerability VCID-9gqn-8g4t-wfby
14
vulnerability VCID-a6wp-n5yh-ybcv
15
vulnerability VCID-b4sv-b9pz-r7er
16
vulnerability VCID-bfbp-7umh-2fcp
17
vulnerability VCID-brwd-e9kx-xuc2
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.7
aliases CVE-2012-3424, GHSA-92w9-2pqw-rhjj, OSV-84243
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1xbd-73qv-mff9
3
url VCID-3edd-m27s-a3ek
vulnerability_id VCID-3edd-m27s-a3ek
summary 
actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain `['xyz', nil]` values, a related issue to CVE-2012-2660.
references
0
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
1
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
2
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
3
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
4
reference_url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
6
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-2694.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-2694.json
7
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-2694
reference_id
reference_type
scores
0
value 0.0022
scoring_system epss
scoring_elements 0.44664
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-2694
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/2f3bc0467311781ac1ceb2c8c2b09002c8fe143a
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/2f3bc0467311781ac1ceb2c8c2b09002c8fe143a
10
reference_url https://github.com/rails/rails/commit/c202638225519b5e1a03ebe523b109c948fb0e52
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/c202638225519b5e1a03ebe523b109c948fb0e52
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2694.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2694.yml
12
reference_url https://groups.google.com/group/rubyonrails-security/msg/e2d3a87f2c211def?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/e2d3a87f2c211def?dmode=source&output=gplain
13
reference_url https://groups.google.com/g/rubyonrails-security/c/jILZ34tAHF4/m/7x0hLH-o0-IJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/jILZ34tAHF4/m/7x0hLH-o0-IJ
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-2694
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-2694
15
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=831581
reference_id 831581
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=831581
16
reference_url https://github.com/advisories/GHSA-q34c-48gc-m9g8
reference_id GHSA-q34c-48gc-m9g8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-q34c-48gc-m9g8
17
reference_url https://access.redhat.com/errata/RHSA-2012:1542
reference_id RHSA-2012:1542
reference_type
scores
url https://access.redhat.com/errata/RHSA-2012:1542
18
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
fixed_packages
0
url pkg:gem/actionpack@3.0.14
purl pkg:gem/actionpack@3.0.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5pfg-7ntp-eff4
9
vulnerability VCID-5psk-hzaf-1kbz
10
vulnerability VCID-6z21-pd9d-pfgk
11
vulnerability VCID-8nkw-8mka-1ygk
12
vulnerability VCID-98gu-r7wd-cuah
13
vulnerability VCID-9gqn-8g4t-wfby
14
vulnerability VCID-a6wp-n5yh-ybcv
15
vulnerability VCID-b4sv-b9pz-r7er
16
vulnerability VCID-bfbp-7umh-2fcp
17
vulnerability VCID-cs1f-uhb2-xkcm
18
vulnerability VCID-dd87-gevs-juhe
19
vulnerability VCID-eeru-6pyc-8bcd
20
vulnerability VCID-ejgq-s79w-abd6
21
vulnerability VCID-g13k-qvy7-q3fk
22
vulnerability VCID-g2a6-uem4-uuce
23
vulnerability VCID-hh65-ycrj-d7gz
24
vulnerability VCID-jpj6-wzp3-m3e4
25
vulnerability VCID-k6aw-heeb-wke2
26
vulnerability VCID-kshz-ckjc-77ab
27
vulnerability VCID-m9ud-s6w6-x7ac
28
vulnerability VCID-mnh7-4rvx-suay
29
vulnerability VCID-n7ga-1sx4-yfcv
30
vulnerability VCID-n7kh-9mpq-13c7
31
vulnerability VCID-nax4-x97j-9fgr
32
vulnerability VCID-nmz3-ux68-dkfd
33
vulnerability VCID-nnka-c23v-qub7
34
vulnerability VCID-p1yd-keq8-rkh3
35
vulnerability VCID-qth9-abgp-wyaq
36
vulnerability VCID-r6mr-ay8d-nqdd
37
vulnerability VCID-rgw4-mrr9-euda
38
vulnerability VCID-sg9h-7dqr-xugu
39
vulnerability VCID-v2hk-dfbe-5khc
40
vulnerability VCID-v3u5-6bpb-qfgf
41
vulnerability VCID-vhjv-9864-tbcs
42
vulnerability VCID-vs1a-m7ya-rue8
43
vulnerability VCID-y13c-awe3-2bc1
44
vulnerability VCID-z16b-zfgu-13a9
45
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.14
1
url pkg:gem/actionpack@3.1.6
purl pkg:gem/actionpack@3.1.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5pfg-7ntp-eff4
9
vulnerability VCID-5psk-hzaf-1kbz
10
vulnerability VCID-6z21-pd9d-pfgk
11
vulnerability VCID-8nkw-8mka-1ygk
12
vulnerability VCID-98gu-r7wd-cuah
13
vulnerability VCID-9gqn-8g4t-wfby
14
vulnerability VCID-a6wp-n5yh-ybcv
15
vulnerability VCID-b4sv-b9pz-r7er
16
vulnerability VCID-bfbp-7umh-2fcp
17
vulnerability VCID-cs1f-uhb2-xkcm
18
vulnerability VCID-dd87-gevs-juhe
19
vulnerability VCID-eeru-6pyc-8bcd
20
vulnerability VCID-ejgq-s79w-abd6
21
vulnerability VCID-g13k-qvy7-q3fk
22
vulnerability VCID-g2a6-uem4-uuce
23
vulnerability VCID-hh65-ycrj-d7gz
24
vulnerability VCID-jpj6-wzp3-m3e4
25
vulnerability VCID-k6aw-heeb-wke2
26
vulnerability VCID-kshz-ckjc-77ab
27
vulnerability VCID-m9ud-s6w6-x7ac
28
vulnerability VCID-mnh7-4rvx-suay
29
vulnerability VCID-n7ga-1sx4-yfcv
30
vulnerability VCID-n7kh-9mpq-13c7
31
vulnerability VCID-nax4-x97j-9fgr
32
vulnerability VCID-nmz3-ux68-dkfd
33
vulnerability VCID-nnka-c23v-qub7
34
vulnerability VCID-p1yd-keq8-rkh3
35
vulnerability VCID-qth9-abgp-wyaq
36
vulnerability VCID-r6mr-ay8d-nqdd
37
vulnerability VCID-rgw4-mrr9-euda
38
vulnerability VCID-sg9h-7dqr-xugu
39
vulnerability VCID-v2hk-dfbe-5khc
40
vulnerability VCID-v3u5-6bpb-qfgf
41
vulnerability VCID-vhjv-9864-tbcs
42
vulnerability VCID-vs1a-m7ya-rue8
43
vulnerability VCID-y13c-awe3-2bc1
44
vulnerability VCID-z16b-zfgu-13a9
45
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.6
2
url pkg:gem/actionpack@3.2.6
purl pkg:gem/actionpack@3.2.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5pfg-7ntp-eff4
9
vulnerability VCID-5psk-hzaf-1kbz
10
vulnerability VCID-6z21-pd9d-pfgk
11
vulnerability VCID-832g-x9kb-3bbx
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-brwd-e9kx-xuc2
19
vulnerability VCID-cs1f-uhb2-xkcm
20
vulnerability VCID-dd87-gevs-juhe
21
vulnerability VCID-eeru-6pyc-8bcd
22
vulnerability VCID-ejgq-s79w-abd6
23
vulnerability VCID-g13k-qvy7-q3fk
24
vulnerability VCID-g2a6-uem4-uuce
25
vulnerability VCID-hh65-ycrj-d7gz
26
vulnerability VCID-jpj6-wzp3-m3e4
27
vulnerability VCID-k6aw-heeb-wke2
28
vulnerability VCID-kshz-ckjc-77ab
29
vulnerability VCID-m9ud-s6w6-x7ac
30
vulnerability VCID-mnh7-4rvx-suay
31
vulnerability VCID-n7ga-1sx4-yfcv
32
vulnerability VCID-n7kh-9mpq-13c7
33
vulnerability VCID-nax4-x97j-9fgr
34
vulnerability VCID-nmz3-ux68-dkfd
35
vulnerability VCID-nnka-c23v-qub7
36
vulnerability VCID-p1yd-keq8-rkh3
37
vulnerability VCID-qth9-abgp-wyaq
38
vulnerability VCID-r6mr-ay8d-nqdd
39
vulnerability VCID-rgw4-mrr9-euda
40
vulnerability VCID-sg9h-7dqr-xugu
41
vulnerability VCID-v2hk-dfbe-5khc
42
vulnerability VCID-v3u5-6bpb-qfgf
43
vulnerability VCID-vhjv-9864-tbcs
44
vulnerability VCID-vs1a-m7ya-rue8
45
vulnerability VCID-y13c-awe3-2bc1
46
vulnerability VCID-z16b-zfgu-13a9
47
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.6
aliases CVE-2012-2694, GHSA-q34c-48gc-m9g8
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3edd-m27s-a3ek
4
url VCID-3rn4-abmh-nkhv
vulnerability_id VCID-3rn4-abmh-nkhv
summary 
actionpack allows bypass of database-query restrictions
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
1
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
2
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
3
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
4
reference_url http://rhn.redhat.com/errata/RHSA-2013-1794.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-1794.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2014-0008.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0008.html
6
reference_url http://rhn.redhat.com/errata/RHSA-2014-0469.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0469.html
7
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6417.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6417.json
8
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-6417
reference_id
reference_type
scores
0
value 0.00512
scoring_system epss
scoring_elements 0.66784
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-6417
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
14
reference_url http://seclists.org/oss-sec/2013/q4/403
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/403
15
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
16
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6417.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6417.yml
17
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ
18
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/niK4drpSHT4
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/niK4drpSHT4
19
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-6417
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-6417
20
reference_url https://puppet.com/security/cve/cve-2013-6417
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://puppet.com/security/cve/cve-2013-6417
21
reference_url https://web.archive.org/web/20160806051251/https://puppet.com/security/cve/cve-2013-6417
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160806051251/https://puppet.com/security/cve/cve-2013-6417
22
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
23
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
24
reference_url http://www.debian.org/security/2014/dsa-2888
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2014/dsa-2888
25
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036409
reference_id 1036409
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036409
26
reference_url https://github.com/advisories/GHSA-wpw7-wxjm-cw8r
reference_id GHSA-wpw7-wxjm-cw8r
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wpw7-wxjm-cw8r
27
reference_url https://access.redhat.com/errata/RHSA-2013:1794
reference_id RHSA-2013:1794
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:1794
28
reference_url https://access.redhat.com/errata/RHSA-2014:0008
reference_id RHSA-2014:0008
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0008
29
reference_url https://access.redhat.com/errata/RHSA-2014:0469
reference_id RHSA-2014:0469
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0469
fixed_packages
0
url pkg:gem/actionpack@3.2.16
purl pkg:gem/actionpack@3.2.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-832g-x9kb-3bbx
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-dd87-gevs-juhe
14
vulnerability VCID-eeru-6pyc-8bcd
15
vulnerability VCID-ejgq-s79w-abd6
16
vulnerability VCID-g13k-qvy7-q3fk
17
vulnerability VCID-g2a6-uem4-uuce
18
vulnerability VCID-hh65-ycrj-d7gz
19
vulnerability VCID-jpj6-wzp3-m3e4
20
vulnerability VCID-k6aw-heeb-wke2
21
vulnerability VCID-kshz-ckjc-77ab
22
vulnerability VCID-m9ud-s6w6-x7ac
23
vulnerability VCID-mnh7-4rvx-suay
24
vulnerability VCID-n7ga-1sx4-yfcv
25
vulnerability VCID-n7kh-9mpq-13c7
26
vulnerability VCID-nmz3-ux68-dkfd
27
vulnerability VCID-p1yd-keq8-rkh3
28
vulnerability VCID-qth9-abgp-wyaq
29
vulnerability VCID-r6mr-ay8d-nqdd
30
vulnerability VCID-sg9h-7dqr-xugu
31
vulnerability VCID-v2hk-dfbe-5khc
32
vulnerability VCID-v3u5-6bpb-qfgf
33
vulnerability VCID-vs1a-m7ya-rue8
34
vulnerability VCID-y13c-awe3-2bc1
35
vulnerability VCID-z16b-zfgu-13a9
36
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.16
1
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-hh65-ycrj-d7gz
17
vulnerability VCID-k6aw-heeb-wke2
18
vulnerability VCID-kshz-ckjc-77ab
19
vulnerability VCID-m156-zkzd-57g9
20
vulnerability VCID-m9ud-s6w6-x7ac
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7ga-1sx4-yfcv
23
vulnerability VCID-n7kh-9mpq-13c7
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-p1yd-keq8-rkh3
26
vulnerability VCID-qth9-abgp-wyaq
27
vulnerability VCID-r6mr-ay8d-nqdd
28
vulnerability VCID-sg9h-7dqr-xugu
29
vulnerability VCID-v2hk-dfbe-5khc
30
vulnerability VCID-v3u5-6bpb-qfgf
31
vulnerability VCID-vs1a-m7ya-rue8
32
vulnerability VCID-y13c-awe3-2bc1
33
vulnerability VCID-z16b-zfgu-13a9
34
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-6417, GHSA-wpw7-wxjm-cw8r, OSV-100527
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3rn4-abmh-nkhv
5
url VCID-4bzb-ft3d-dkgg
vulnerability_id VCID-4bzb-ft3d-dkgg
summary 
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_tag_helper.rb` in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the `prompt` field to the `select_tag` helper.
references
0
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3463.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3463.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-3463
reference_id
reference_type
scores
0
value 0.00333
scoring_system epss
scoring_elements 0.56331
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-3463
3
reference_url https://github.com/rails/rails/commit/6d0526db91afb0675c2ad3d871529d1536303c64
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/6d0526db91afb0675c2ad3d871529d1536303c64
4
reference_url https://groups.google.com/forum/?fromgroups=#!searchin/rubyonrails-security/3463/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ
reference_id
reference_type
scores
url https://groups.google.com/forum/?fromgroups=#!searchin/rubyonrails-security/3463/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ
5
reference_url https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source&output=gplain
6
reference_url https://groups.google.com/g/rubyonrails-security/c/fV3QUToSMSw/m/eHBSFOUYHpYJ?pli=1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/fV3QUToSMSw/m/eHBSFOUYHpYJ?pli=1
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-3463
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-3463
8
reference_url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released
9
reference_url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=847196
reference_id 847196
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=847196
11
reference_url https://github.com/advisories/GHSA-98mf-8f57-64qf
reference_id GHSA-98mf-8f57-64qf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-98mf-8f57-64qf
12
reference_url https://access.redhat.com/errata/RHSA-2012:1542
reference_id RHSA-2012:1542
reference_type
scores
url https://access.redhat.com/errata/RHSA-2012:1542
13
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
fixed_packages
0
url pkg:gem/actionpack@3.0.17
purl pkg:gem/actionpack@3.0.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5pfg-7ntp-eff4
7
vulnerability VCID-5psk-hzaf-1kbz
8
vulnerability VCID-6z21-pd9d-pfgk
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-cs1f-uhb2-xkcm
16
vulnerability VCID-dd87-gevs-juhe
17
vulnerability VCID-eeru-6pyc-8bcd
18
vulnerability VCID-ejgq-s79w-abd6
19
vulnerability VCID-g13k-qvy7-q3fk
20
vulnerability VCID-g2a6-uem4-uuce
21
vulnerability VCID-hh65-ycrj-d7gz
22
vulnerability VCID-jpj6-wzp3-m3e4
23
vulnerability VCID-k6aw-heeb-wke2
24
vulnerability VCID-kshz-ckjc-77ab
25
vulnerability VCID-m9ud-s6w6-x7ac
26
vulnerability VCID-mnh7-4rvx-suay
27
vulnerability VCID-n7ga-1sx4-yfcv
28
vulnerability VCID-n7kh-9mpq-13c7
29
vulnerability VCID-nax4-x97j-9fgr
30
vulnerability VCID-nmz3-ux68-dkfd
31
vulnerability VCID-nnka-c23v-qub7
32
vulnerability VCID-p1yd-keq8-rkh3
33
vulnerability VCID-qth9-abgp-wyaq
34
vulnerability VCID-r6mr-ay8d-nqdd
35
vulnerability VCID-sg9h-7dqr-xugu
36
vulnerability VCID-v2hk-dfbe-5khc
37
vulnerability VCID-v3u5-6bpb-qfgf
38
vulnerability VCID-vhjv-9864-tbcs
39
vulnerability VCID-vs1a-m7ya-rue8
40
vulnerability VCID-y13c-awe3-2bc1
41
vulnerability VCID-z16b-zfgu-13a9
42
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.17
1
url pkg:gem/actionpack@3.1.0.beta1
purl pkg:gem/actionpack@3.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.0.beta1
2
url pkg:gem/actionpack@3.1.8
purl pkg:gem/actionpack@3.1.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5pfg-7ntp-eff4
7
vulnerability VCID-5psk-hzaf-1kbz
8
vulnerability VCID-6z21-pd9d-pfgk
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-cs1f-uhb2-xkcm
16
vulnerability VCID-dd87-gevs-juhe
17
vulnerability VCID-eeru-6pyc-8bcd
18
vulnerability VCID-ejgq-s79w-abd6
19
vulnerability VCID-g13k-qvy7-q3fk
20
vulnerability VCID-g2a6-uem4-uuce
21
vulnerability VCID-hh65-ycrj-d7gz
22
vulnerability VCID-jpj6-wzp3-m3e4
23
vulnerability VCID-k6aw-heeb-wke2
24
vulnerability VCID-kshz-ckjc-77ab
25
vulnerability VCID-m9ud-s6w6-x7ac
26
vulnerability VCID-mnh7-4rvx-suay
27
vulnerability VCID-n7ga-1sx4-yfcv
28
vulnerability VCID-n7kh-9mpq-13c7
29
vulnerability VCID-nax4-x97j-9fgr
30
vulnerability VCID-nmz3-ux68-dkfd
31
vulnerability VCID-nnka-c23v-qub7
32
vulnerability VCID-p1yd-keq8-rkh3
33
vulnerability VCID-qth9-abgp-wyaq
34
vulnerability VCID-r6mr-ay8d-nqdd
35
vulnerability VCID-sg9h-7dqr-xugu
36
vulnerability VCID-v2hk-dfbe-5khc
37
vulnerability VCID-v3u5-6bpb-qfgf
38
vulnerability VCID-vhjv-9864-tbcs
39
vulnerability VCID-vs1a-m7ya-rue8
40
vulnerability VCID-y13c-awe3-2bc1
41
vulnerability VCID-z16b-zfgu-13a9
42
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.8
3
url pkg:gem/actionpack@3.2.0.rc1
purl pkg:gem/actionpack@3.2.0.rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-832g-x9kb-3bbx
13
vulnerability VCID-8nkw-8mka-1ygk
14
vulnerability VCID-98gu-r7wd-cuah
15
vulnerability VCID-9gqn-8g4t-wfby
16
vulnerability VCID-a6wp-n5yh-ybcv
17
vulnerability VCID-b4sv-b9pz-r7er
18
vulnerability VCID-bfbp-7umh-2fcp
19
vulnerability VCID-brwd-e9kx-xuc2
20
vulnerability VCID-cs1f-uhb2-xkcm
21
vulnerability VCID-dd87-gevs-juhe
22
vulnerability VCID-eeru-6pyc-8bcd
23
vulnerability VCID-ejgq-s79w-abd6
24
vulnerability VCID-g13k-qvy7-q3fk
25
vulnerability VCID-g2a6-uem4-uuce
26
vulnerability VCID-hh65-ycrj-d7gz
27
vulnerability VCID-jpj6-wzp3-m3e4
28
vulnerability VCID-k6aw-heeb-wke2
29
vulnerability VCID-kshz-ckjc-77ab
30
vulnerability VCID-m9ud-s6w6-x7ac
31
vulnerability VCID-mnh7-4rvx-suay
32
vulnerability VCID-n7ga-1sx4-yfcv
33
vulnerability VCID-n7kh-9mpq-13c7
34
vulnerability VCID-nax4-x97j-9fgr
35
vulnerability VCID-nmz3-ux68-dkfd
36
vulnerability VCID-nnka-c23v-qub7
37
vulnerability VCID-p1yd-keq8-rkh3
38
vulnerability VCID-qth9-abgp-wyaq
39
vulnerability VCID-r6mr-ay8d-nqdd
40
vulnerability VCID-rgw4-mrr9-euda
41
vulnerability VCID-sg9h-7dqr-xugu
42
vulnerability VCID-v2hk-dfbe-5khc
43
vulnerability VCID-v3u5-6bpb-qfgf
44
vulnerability VCID-vhjv-9864-tbcs
45
vulnerability VCID-vs1a-m7ya-rue8
46
vulnerability VCID-y13c-awe3-2bc1
47
vulnerability VCID-z16b-zfgu-13a9
48
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.0.rc1
4
url pkg:gem/actionpack@3.2.8
purl pkg:gem/actionpack@3.2.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5pfg-7ntp-eff4
7
vulnerability VCID-5psk-hzaf-1kbz
8
vulnerability VCID-6z21-pd9d-pfgk
9
vulnerability VCID-832g-x9kb-3bbx
10
vulnerability VCID-8nkw-8mka-1ygk
11
vulnerability VCID-98gu-r7wd-cuah
12
vulnerability VCID-9gqn-8g4t-wfby
13
vulnerability VCID-a6wp-n5yh-ybcv
14
vulnerability VCID-b4sv-b9pz-r7er
15
vulnerability VCID-bfbp-7umh-2fcp
16
vulnerability VCID-brwd-e9kx-xuc2
17
vulnerability VCID-cs1f-uhb2-xkcm
18
vulnerability VCID-dd87-gevs-juhe
19
vulnerability VCID-eeru-6pyc-8bcd
20
vulnerability VCID-ejgq-s79w-abd6
21
vulnerability VCID-g13k-qvy7-q3fk
22
vulnerability VCID-g2a6-uem4-uuce
23
vulnerability VCID-hh65-ycrj-d7gz
24
vulnerability VCID-jpj6-wzp3-m3e4
25
vulnerability VCID-k6aw-heeb-wke2
26
vulnerability VCID-kshz-ckjc-77ab
27
vulnerability VCID-m9ud-s6w6-x7ac
28
vulnerability VCID-mnh7-4rvx-suay
29
vulnerability VCID-n7ga-1sx4-yfcv
30
vulnerability VCID-n7kh-9mpq-13c7
31
vulnerability VCID-nax4-x97j-9fgr
32
vulnerability VCID-nmz3-ux68-dkfd
33
vulnerability VCID-nnka-c23v-qub7
34
vulnerability VCID-p1yd-keq8-rkh3
35
vulnerability VCID-qth9-abgp-wyaq
36
vulnerability VCID-r6mr-ay8d-nqdd
37
vulnerability VCID-sg9h-7dqr-xugu
38
vulnerability VCID-v2hk-dfbe-5khc
39
vulnerability VCID-v3u5-6bpb-qfgf
40
vulnerability VCID-vhjv-9864-tbcs
41
vulnerability VCID-vs1a-m7ya-rue8
42
vulnerability VCID-y13c-awe3-2bc1
43
vulnerability VCID-z16b-zfgu-13a9
44
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.8
aliases CVE-2012-3463, GHSA-98mf-8f57-64qf, OSV-84515
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4bzb-ft3d-dkgg
6
url VCID-4w1v-z4zj-6ydp
vulnerability_id VCID-4w1v-z4zj-6ydp
summary 
Untrusted users can run pending migrations in production in Rails
There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.

This vulnerability has been assigned the CVE identifier CVE-2020-8185.

Versions Affected:  6.0.0 < rails < 6.0.3.2
Not affected:       Applications with `config.action_dispatch.show_exceptions = false` (this is not a default setting in production)
Fixed Versions:     rails >= 6.0.3.2

Impact
------

Using this issue, an attacker would be able to execute any migrations that are pending for a Rails app running in production mode. It is important to note that an attacker is limited to running migrations the application developer has already defined in their application and ones that have not already run.

Workarounds
-----------

Until such time as the patch can be applied, application developers should disable the ActionDispatch middleware in their production environment via a line such as this one in their config/environment/production.rb:

`config.middleware.delete ActionDispatch::ActionableExceptions`
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8185.json
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8185.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-8185
reference_id
reference_type
scores
0
value 0.00679
scoring_system epss
scoring_elements 0.7189
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-8185
2
reference_url https://github.com/rails/rails/commit/2121b9d20b60ed503aa041ef7b926d331ed79fc2
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/2121b9d20b60ed503aa041ef7b926d331ed79fc2
3
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8185.yml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8185.yml
4
reference_url https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0
5
reference_url https://hackerone.com/reports/899069
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://hackerone.com/reports/899069
6
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB
7
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-8185
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-8185
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1852380
reference_id 1852380
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1852380
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964081
reference_id 964081
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964081
11
reference_url https://github.com/advisories/GHSA-c6qr-h5vq-59jc
reference_id GHSA-c6qr-h5vq-59jc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-c6qr-h5vq-59jc
12
reference_url https://access.redhat.com/errata/RHSA-2021:1313
reference_id RHSA-2021:1313
reference_type
scores
url https://access.redhat.com/errata/RHSA-2021:1313
fixed_packages
0
url pkg:gem/actionpack@6.0.3.2
purl pkg:gem/actionpack@6.0.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-25ru-4qks-7yf3
1
vulnerability VCID-4fyg-vxpj-c7d7
2
vulnerability VCID-98gu-r7wd-cuah
3
vulnerability VCID-be5x-uyc6-sudm
4
vulnerability VCID-dd87-gevs-juhe
5
vulnerability VCID-eeru-6pyc-8bcd
6
vulnerability VCID-fdqs-v9b2-53gu
7
vulnerability VCID-fgtd-zx7r-rygb
8
vulnerability VCID-k6aw-heeb-wke2
9
vulnerability VCID-kshz-ckjc-77ab
10
vulnerability VCID-m9ud-s6w6-x7ac
11
vulnerability VCID-mgjg-juur-rfe5
12
vulnerability VCID-n7ga-1sx4-yfcv
13
vulnerability VCID-nmz3-ux68-dkfd
14
vulnerability VCID-qth9-abgp-wyaq
15
vulnerability VCID-re7g-rxbm-dbd9
16
vulnerability VCID-uppk-66vw-gbb9
17
vulnerability VCID-v2hk-dfbe-5khc
18
vulnerability VCID-z16b-zfgu-13a9
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.0.3.2
aliases CVE-2020-8185, GHSA-c6qr-h5vq-59jc
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4w1v-z4zj-6ydp
7
url VCID-58sa-6uag-z7hp
vulnerability_id VCID-58sa-6uag-z7hp
summary 
actionpack Improper Input Validation vulnerability
`active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
references
0
reference_url http://rhn.redhat.com/errata/RHSA-2013-0153.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0153.html
1
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
2
reference_url http://rhn.redhat.com/errata/RHSA-2013-0155.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0155.html
3
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-0156.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-0156.json
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-0156
reference_id
reference_type
scores
0
value 0.91907
scoring_system epss
scoring_elements 0.99708
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-0156
5
reference_url https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156
7
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
8
reference_url https://groups.google.com/forum/?fromgroups=#!searchin/rubyonrails-security/2013-0156/rubyonrails-security/61bkgvnSGTQ/nehwjA8tQ8EJ
reference_id
reference_type
scores
url https://groups.google.com/forum/?fromgroups=#!searchin/rubyonrails-security/2013-0156/rubyonrails-security/61bkgvnSGTQ/nehwjA8tQ8EJ
9
reference_url https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-0156
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-0156
11
reference_url https://web.archive.org/web/20140111025708/http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20140111025708/http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
12
reference_url https://web.archive.org/web/20160415043747/https://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160415043747/https://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
13
reference_url https://web.archive.org/web/20160806154149/https://puppet.com/security/cve/cve-2013-0156
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160806154149/https://puppet.com/security/cve/cve-2013-0156
14
reference_url http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released
15
reference_url http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
16
reference_url http://www.debian.org/security/2013/dsa-2604
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2013/dsa-2604
17
reference_url http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
18
reference_url http://www.insinuator.net/2013/01/rails-yaml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.insinuator.net/2013/01/rails-yaml
19
reference_url http://www.insinuator.net/2013/01/rails-yaml/
reference_id
reference_type
scores
url http://www.insinuator.net/2013/01/rails-yaml/
20
reference_url http://www.kb.cert.org/vuls/id/380039
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.kb.cert.org/vuls/id/380039
21
reference_url http://www.kb.cert.org/vuls/id/628463
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.kb.cert.org/vuls/id/628463
22
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697722
reference_id 697722
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697722
23
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=892870
reference_id 892870
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=892870
24
reference_url https://web.archive.org/web/20160806154149/https://puppet.com/security/cve/cve-2013-0156/
reference_id CVE-2013-0156
reference_type
scores
url https://web.archive.org/web/20160806154149/https://puppet.com/security/cve/cve-2013-0156/
25
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/24019.rb
reference_id CVE-2013-0156;OSVDB-89026
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/24019.rb
26
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/27527.rb
reference_id CVE-2013-0156;OSVDB-89026
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/27527.rb
27
reference_url https://github.com/advisories/GHSA-jmgw-6vjg-jjwg
reference_id GHSA-jmgw-6vjg-jjwg
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-jmgw-6vjg-jjwg
28
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
29
reference_url https://access.redhat.com/errata/RHSA-2013:0153
reference_id RHSA-2013:0153
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0153
30
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
31
reference_url https://access.redhat.com/errata/RHSA-2013:0155
reference_id RHSA-2013:0155
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0155
fixed_packages
0
url pkg:gem/actionpack@3.0.19
purl pkg:gem/actionpack@3.0.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-5pfg-7ntp-eff4
6
vulnerability VCID-5psk-hzaf-1kbz
7
vulnerability VCID-6z21-pd9d-pfgk
8
vulnerability VCID-8nkw-8mka-1ygk
9
vulnerability VCID-98gu-r7wd-cuah
10
vulnerability VCID-9gqn-8g4t-wfby
11
vulnerability VCID-a6wp-n5yh-ybcv
12
vulnerability VCID-b4sv-b9pz-r7er
13
vulnerability VCID-bfbp-7umh-2fcp
14
vulnerability VCID-cs1f-uhb2-xkcm
15
vulnerability VCID-dd87-gevs-juhe
16
vulnerability VCID-eeru-6pyc-8bcd
17
vulnerability VCID-ejgq-s79w-abd6
18
vulnerability VCID-g13k-qvy7-q3fk
19
vulnerability VCID-g2a6-uem4-uuce
20
vulnerability VCID-hh65-ycrj-d7gz
21
vulnerability VCID-jpj6-wzp3-m3e4
22
vulnerability VCID-k6aw-heeb-wke2
23
vulnerability VCID-kshz-ckjc-77ab
24
vulnerability VCID-m9ud-s6w6-x7ac
25
vulnerability VCID-mnh7-4rvx-suay
26
vulnerability VCID-n7ga-1sx4-yfcv
27
vulnerability VCID-n7kh-9mpq-13c7
28
vulnerability VCID-nax4-x97j-9fgr
29
vulnerability VCID-nmz3-ux68-dkfd
30
vulnerability VCID-nnka-c23v-qub7
31
vulnerability VCID-p1yd-keq8-rkh3
32
vulnerability VCID-qth9-abgp-wyaq
33
vulnerability VCID-r6mr-ay8d-nqdd
34
vulnerability VCID-sg9h-7dqr-xugu
35
vulnerability VCID-v2hk-dfbe-5khc
36
vulnerability VCID-v3u5-6bpb-qfgf
37
vulnerability VCID-vhjv-9864-tbcs
38
vulnerability VCID-vs1a-m7ya-rue8
39
vulnerability VCID-y13c-awe3-2bc1
40
vulnerability VCID-z16b-zfgu-13a9
41
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.19
1
url pkg:gem/actionpack@3.1.0.beta1
purl pkg:gem/actionpack@3.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.0.beta1
2
url pkg:gem/actionpack@3.1.10
purl pkg:gem/actionpack@3.1.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-5pfg-7ntp-eff4
6
vulnerability VCID-5psk-hzaf-1kbz
7
vulnerability VCID-6z21-pd9d-pfgk
8
vulnerability VCID-8nkw-8mka-1ygk
9
vulnerability VCID-98gu-r7wd-cuah
10
vulnerability VCID-9gqn-8g4t-wfby
11
vulnerability VCID-a6wp-n5yh-ybcv
12
vulnerability VCID-b4sv-b9pz-r7er
13
vulnerability VCID-bfbp-7umh-2fcp
14
vulnerability VCID-cs1f-uhb2-xkcm
15
vulnerability VCID-dd87-gevs-juhe
16
vulnerability VCID-eeru-6pyc-8bcd
17
vulnerability VCID-ejgq-s79w-abd6
18
vulnerability VCID-g13k-qvy7-q3fk
19
vulnerability VCID-g2a6-uem4-uuce
20
vulnerability VCID-hh65-ycrj-d7gz
21
vulnerability VCID-jpj6-wzp3-m3e4
22
vulnerability VCID-k6aw-heeb-wke2
23
vulnerability VCID-kshz-ckjc-77ab
24
vulnerability VCID-m9ud-s6w6-x7ac
25
vulnerability VCID-mnh7-4rvx-suay
26
vulnerability VCID-n7ga-1sx4-yfcv
27
vulnerability VCID-n7kh-9mpq-13c7
28
vulnerability VCID-nax4-x97j-9fgr
29
vulnerability VCID-nmz3-ux68-dkfd
30
vulnerability VCID-nnka-c23v-qub7
31
vulnerability VCID-p1yd-keq8-rkh3
32
vulnerability VCID-qth9-abgp-wyaq
33
vulnerability VCID-r6mr-ay8d-nqdd
34
vulnerability VCID-sg9h-7dqr-xugu
35
vulnerability VCID-v2hk-dfbe-5khc
36
vulnerability VCID-v3u5-6bpb-qfgf
37
vulnerability VCID-vhjv-9864-tbcs
38
vulnerability VCID-vs1a-m7ya-rue8
39
vulnerability VCID-y13c-awe3-2bc1
40
vulnerability VCID-z16b-zfgu-13a9
41
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.10
3
url pkg:gem/actionpack@3.2.0.rc1
purl pkg:gem/actionpack@3.2.0.rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-832g-x9kb-3bbx
13
vulnerability VCID-8nkw-8mka-1ygk
14
vulnerability VCID-98gu-r7wd-cuah
15
vulnerability VCID-9gqn-8g4t-wfby
16
vulnerability VCID-a6wp-n5yh-ybcv
17
vulnerability VCID-b4sv-b9pz-r7er
18
vulnerability VCID-bfbp-7umh-2fcp
19
vulnerability VCID-brwd-e9kx-xuc2
20
vulnerability VCID-cs1f-uhb2-xkcm
21
vulnerability VCID-dd87-gevs-juhe
22
vulnerability VCID-eeru-6pyc-8bcd
23
vulnerability VCID-ejgq-s79w-abd6
24
vulnerability VCID-g13k-qvy7-q3fk
25
vulnerability VCID-g2a6-uem4-uuce
26
vulnerability VCID-hh65-ycrj-d7gz
27
vulnerability VCID-jpj6-wzp3-m3e4
28
vulnerability VCID-k6aw-heeb-wke2
29
vulnerability VCID-kshz-ckjc-77ab
30
vulnerability VCID-m9ud-s6w6-x7ac
31
vulnerability VCID-mnh7-4rvx-suay
32
vulnerability VCID-n7ga-1sx4-yfcv
33
vulnerability VCID-n7kh-9mpq-13c7
34
vulnerability VCID-nax4-x97j-9fgr
35
vulnerability VCID-nmz3-ux68-dkfd
36
vulnerability VCID-nnka-c23v-qub7
37
vulnerability VCID-p1yd-keq8-rkh3
38
vulnerability VCID-qth9-abgp-wyaq
39
vulnerability VCID-r6mr-ay8d-nqdd
40
vulnerability VCID-rgw4-mrr9-euda
41
vulnerability VCID-sg9h-7dqr-xugu
42
vulnerability VCID-v2hk-dfbe-5khc
43
vulnerability VCID-v3u5-6bpb-qfgf
44
vulnerability VCID-vhjv-9864-tbcs
45
vulnerability VCID-vs1a-m7ya-rue8
46
vulnerability VCID-y13c-awe3-2bc1
47
vulnerability VCID-z16b-zfgu-13a9
48
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.0.rc1
4
url pkg:gem/actionpack@3.2.11
purl pkg:gem/actionpack@3.2.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-5pfg-7ntp-eff4
6
vulnerability VCID-5psk-hzaf-1kbz
7
vulnerability VCID-6z21-pd9d-pfgk
8
vulnerability VCID-832g-x9kb-3bbx
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-brwd-e9kx-xuc2
16
vulnerability VCID-cs1f-uhb2-xkcm
17
vulnerability VCID-dd87-gevs-juhe
18
vulnerability VCID-eeru-6pyc-8bcd
19
vulnerability VCID-ejgq-s79w-abd6
20
vulnerability VCID-g13k-qvy7-q3fk
21
vulnerability VCID-g2a6-uem4-uuce
22
vulnerability VCID-hh65-ycrj-d7gz
23
vulnerability VCID-jpj6-wzp3-m3e4
24
vulnerability VCID-k6aw-heeb-wke2
25
vulnerability VCID-kshz-ckjc-77ab
26
vulnerability VCID-m9ud-s6w6-x7ac
27
vulnerability VCID-mnh7-4rvx-suay
28
vulnerability VCID-n7ga-1sx4-yfcv
29
vulnerability VCID-n7kh-9mpq-13c7
30
vulnerability VCID-nax4-x97j-9fgr
31
vulnerability VCID-nmz3-ux68-dkfd
32
vulnerability VCID-nnka-c23v-qub7
33
vulnerability VCID-p1yd-keq8-rkh3
34
vulnerability VCID-qth9-abgp-wyaq
35
vulnerability VCID-r6mr-ay8d-nqdd
36
vulnerability VCID-sg9h-7dqr-xugu
37
vulnerability VCID-v2hk-dfbe-5khc
38
vulnerability VCID-v3u5-6bpb-qfgf
39
vulnerability VCID-vhjv-9864-tbcs
40
vulnerability VCID-vs1a-m7ya-rue8
41
vulnerability VCID-y13c-awe3-2bc1
42
vulnerability VCID-z16b-zfgu-13a9
43
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.11
aliases CVE-2013-0156, GHSA-jmgw-6vjg-jjwg, OSV-89026
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-58sa-6uag-z7hp
8
url VCID-5a2t-fre4-zkay
vulnerability_id VCID-5a2t-fre4-zkay
summary 
Cross-site Scripting in actionpack
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_options_helper.rb` in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/6fca4f5c47705488?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/6fca4f5c47705488?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075740.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075740.html
3
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-1099.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-1099.json
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-1099
reference_id
reference_type
scores
0
value 0.00399
scoring_system epss
scoring_elements 0.60937
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-1099
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=799276
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=799276
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1099
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1099
7
reference_url https://github.com/advisories/GHSA-2xjj-5x6h-8vmf
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-2xjj-5x6h-8vmf
8
reference_url https://github.com/rails/rails/commit/9435f5a479317458c558ae743b7d876dd5a5db20
reference_id
reference_type
scores
url https://github.com/rails/rails/commit/9435f5a479317458c558ae743b7d876dd5a5db20
9
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-1099.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-1099.yml
10
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/OSVDB-79727.yml
reference_id
reference_type
scores
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/OSVDB-79727.yml
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-1099
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-1099
12
reference_url http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released
13
reference_url http://www.debian.org/security/2012/dsa-2466
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2012/dsa-2466
14
reference_url http://www.openwall.com/lists/oss-security/2012/03/02/6
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2012/03/02/6
15
reference_url http://www.openwall.com/lists/oss-security/2012/03/03/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2012/03/03/1
fixed_packages
0
url pkg:gem/actionpack@3.0.12
purl pkg:gem/actionpack@3.0.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5pfg-7ntp-eff4
9
vulnerability VCID-5psk-hzaf-1kbz
10
vulnerability VCID-6z21-pd9d-pfgk
11
vulnerability VCID-8nkw-8mka-1ygk
12
vulnerability VCID-98gu-r7wd-cuah
13
vulnerability VCID-9gqn-8g4t-wfby
14
vulnerability VCID-a6wp-n5yh-ybcv
15
vulnerability VCID-b4sv-b9pz-r7er
16
vulnerability VCID-bfbp-7umh-2fcp
17
vulnerability VCID-cs1f-uhb2-xkcm
18
vulnerability VCID-dd87-gevs-juhe
19
vulnerability VCID-eeru-6pyc-8bcd
20
vulnerability VCID-ejgq-s79w-abd6
21
vulnerability VCID-g13k-qvy7-q3fk
22
vulnerability VCID-g2a6-uem4-uuce
23
vulnerability VCID-hh65-ycrj-d7gz
24
vulnerability VCID-jpj6-wzp3-m3e4
25
vulnerability VCID-k6aw-heeb-wke2
26
vulnerability VCID-kshz-ckjc-77ab
27
vulnerability VCID-m9ud-s6w6-x7ac
28
vulnerability VCID-mnh7-4rvx-suay
29
vulnerability VCID-n7ga-1sx4-yfcv
30
vulnerability VCID-n7kh-9mpq-13c7
31
vulnerability VCID-nax4-x97j-9fgr
32
vulnerability VCID-nmz3-ux68-dkfd
33
vulnerability VCID-nnka-c23v-qub7
34
vulnerability VCID-p1yd-keq8-rkh3
35
vulnerability VCID-qth9-abgp-wyaq
36
vulnerability VCID-r6mr-ay8d-nqdd
37
vulnerability VCID-rgw4-mrr9-euda
38
vulnerability VCID-sg9h-7dqr-xugu
39
vulnerability VCID-v2hk-dfbe-5khc
40
vulnerability VCID-v3u5-6bpb-qfgf
41
vulnerability VCID-vhjv-9864-tbcs
42
vulnerability VCID-vs1a-m7ya-rue8
43
vulnerability VCID-y13c-awe3-2bc1
44
vulnerability VCID-z16b-zfgu-13a9
45
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.12
1
url pkg:gem/actionpack@3.1.0.beta1
purl pkg:gem/actionpack@3.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.0.beta1
2
url pkg:gem/actionpack@3.1.4
purl pkg:gem/actionpack@3.1.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5pfg-7ntp-eff4
9
vulnerability VCID-5psk-hzaf-1kbz
10
vulnerability VCID-6z21-pd9d-pfgk
11
vulnerability VCID-8nkw-8mka-1ygk
12
vulnerability VCID-98gu-r7wd-cuah
13
vulnerability VCID-9gqn-8g4t-wfby
14
vulnerability VCID-a6wp-n5yh-ybcv
15
vulnerability VCID-b4sv-b9pz-r7er
16
vulnerability VCID-bfbp-7umh-2fcp
17
vulnerability VCID-cs1f-uhb2-xkcm
18
vulnerability VCID-dd87-gevs-juhe
19
vulnerability VCID-eeru-6pyc-8bcd
20
vulnerability VCID-ejgq-s79w-abd6
21
vulnerability VCID-g13k-qvy7-q3fk
22
vulnerability VCID-g2a6-uem4-uuce
23
vulnerability VCID-hh65-ycrj-d7gz
24
vulnerability VCID-jpj6-wzp3-m3e4
25
vulnerability VCID-k6aw-heeb-wke2
26
vulnerability VCID-kshz-ckjc-77ab
27
vulnerability VCID-m9ud-s6w6-x7ac
28
vulnerability VCID-mnh7-4rvx-suay
29
vulnerability VCID-n7ga-1sx4-yfcv
30
vulnerability VCID-n7kh-9mpq-13c7
31
vulnerability VCID-nax4-x97j-9fgr
32
vulnerability VCID-nmz3-ux68-dkfd
33
vulnerability VCID-nnka-c23v-qub7
34
vulnerability VCID-p1yd-keq8-rkh3
35
vulnerability VCID-qth9-abgp-wyaq
36
vulnerability VCID-r6mr-ay8d-nqdd
37
vulnerability VCID-rgw4-mrr9-euda
38
vulnerability VCID-sg9h-7dqr-xugu
39
vulnerability VCID-v2hk-dfbe-5khc
40
vulnerability VCID-v3u5-6bpb-qfgf
41
vulnerability VCID-vhjv-9864-tbcs
42
vulnerability VCID-vs1a-m7ya-rue8
43
vulnerability VCID-y13c-awe3-2bc1
44
vulnerability VCID-z16b-zfgu-13a9
45
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.4
3
url pkg:gem/actionpack@3.2.0.rc1
purl pkg:gem/actionpack@3.2.0.rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-832g-x9kb-3bbx
13
vulnerability VCID-8nkw-8mka-1ygk
14
vulnerability VCID-98gu-r7wd-cuah
15
vulnerability VCID-9gqn-8g4t-wfby
16
vulnerability VCID-a6wp-n5yh-ybcv
17
vulnerability VCID-b4sv-b9pz-r7er
18
vulnerability VCID-bfbp-7umh-2fcp
19
vulnerability VCID-brwd-e9kx-xuc2
20
vulnerability VCID-cs1f-uhb2-xkcm
21
vulnerability VCID-dd87-gevs-juhe
22
vulnerability VCID-eeru-6pyc-8bcd
23
vulnerability VCID-ejgq-s79w-abd6
24
vulnerability VCID-g13k-qvy7-q3fk
25
vulnerability VCID-g2a6-uem4-uuce
26
vulnerability VCID-hh65-ycrj-d7gz
27
vulnerability VCID-jpj6-wzp3-m3e4
28
vulnerability VCID-k6aw-heeb-wke2
29
vulnerability VCID-kshz-ckjc-77ab
30
vulnerability VCID-m9ud-s6w6-x7ac
31
vulnerability VCID-mnh7-4rvx-suay
32
vulnerability VCID-n7ga-1sx4-yfcv
33
vulnerability VCID-n7kh-9mpq-13c7
34
vulnerability VCID-nax4-x97j-9fgr
35
vulnerability VCID-nmz3-ux68-dkfd
36
vulnerability VCID-nnka-c23v-qub7
37
vulnerability VCID-p1yd-keq8-rkh3
38
vulnerability VCID-qth9-abgp-wyaq
39
vulnerability VCID-r6mr-ay8d-nqdd
40
vulnerability VCID-rgw4-mrr9-euda
41
vulnerability VCID-sg9h-7dqr-xugu
42
vulnerability VCID-v2hk-dfbe-5khc
43
vulnerability VCID-v3u5-6bpb-qfgf
44
vulnerability VCID-vhjv-9864-tbcs
45
vulnerability VCID-vs1a-m7ya-rue8
46
vulnerability VCID-y13c-awe3-2bc1
47
vulnerability VCID-z16b-zfgu-13a9
48
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.0.rc1
4
url pkg:gem/actionpack@3.2.2
purl pkg:gem/actionpack@3.2.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5pfg-7ntp-eff4
9
vulnerability VCID-5psk-hzaf-1kbz
10
vulnerability VCID-6z21-pd9d-pfgk
11
vulnerability VCID-832g-x9kb-3bbx
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-brwd-e9kx-xuc2
19
vulnerability VCID-cs1f-uhb2-xkcm
20
vulnerability VCID-dd87-gevs-juhe
21
vulnerability VCID-eeru-6pyc-8bcd
22
vulnerability VCID-ejgq-s79w-abd6
23
vulnerability VCID-g13k-qvy7-q3fk
24
vulnerability VCID-g2a6-uem4-uuce
25
vulnerability VCID-hh65-ycrj-d7gz
26
vulnerability VCID-jpj6-wzp3-m3e4
27
vulnerability VCID-k6aw-heeb-wke2
28
vulnerability VCID-kshz-ckjc-77ab
29
vulnerability VCID-m9ud-s6w6-x7ac
30
vulnerability VCID-mnh7-4rvx-suay
31
vulnerability VCID-n7ga-1sx4-yfcv
32
vulnerability VCID-n7kh-9mpq-13c7
33
vulnerability VCID-nax4-x97j-9fgr
34
vulnerability VCID-nmz3-ux68-dkfd
35
vulnerability VCID-nnka-c23v-qub7
36
vulnerability VCID-p1yd-keq8-rkh3
37
vulnerability VCID-qth9-abgp-wyaq
38
vulnerability VCID-r6mr-ay8d-nqdd
39
vulnerability VCID-rgw4-mrr9-euda
40
vulnerability VCID-sg9h-7dqr-xugu
41
vulnerability VCID-v2hk-dfbe-5khc
42
vulnerability VCID-v3u5-6bpb-qfgf
43
vulnerability VCID-vhjv-9864-tbcs
44
vulnerability VCID-vs1a-m7ya-rue8
45
vulnerability VCID-y13c-awe3-2bc1
46
vulnerability VCID-z16b-zfgu-13a9
47
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.2
aliases CVE-2012-1099, GHSA-2xjj-5x6h-8vmf, OSV-79727
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5a2t-fre4-zkay
9
url VCID-5pfg-7ntp-eff4
vulnerability_id VCID-5pfg-7ntp-eff4
summary 
Cross-site Scripting vulnerability in i18n translations helper method
Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5?pli=1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5?pli=1
1
reference_url http://groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain
2
reference_url http://openwall.com/lists/oss-security/2011/11/18/8
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://openwall.com/lists/oss-security/2011/11/18/8
3
reference_url http://osvdb.org/77199
reference_id
reference_type
scores
url http://osvdb.org/77199
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-4319.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-4319.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-4319
reference_id
reference_type
scores
0
value 0.00607
scoring_system epss
scoring_elements 0.70015
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-4319
6
reference_url https://exchange.xforce.ibmcloud.com/vulnerabilities/71364
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://exchange.xforce.ibmcloud.com/vulnerabilities/71364
7
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
8
reference_url https://github.com/rails/rails/commit/2d5b105d4bcb652550dda8b5613376d1b8beb70c
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/2d5b105d4bcb652550dda8b5613376d1b8beb70c
9
reference_url https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade
10
reference_url https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade#diff-79e8a3e6d1d2808c4f93f63b3928a5a1
reference_id
reference_type
scores
url https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade#diff-79e8a3e6d1d2808c4f93f63b3928a5a1
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-4319.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-4319.yml
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/OSVDB-77199.yml
reference_id
reference_type
scores
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/OSVDB-77199.yml
13
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/K2HXD7c8fMU
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/K2HXD7c8fMU
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-4319
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-4319
15
reference_url https://web.archive.org/web/20200228155840/http://www.securityfocus.com/bid/50722
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200228155840/http://www.securityfocus.com/bid/50722
16
reference_url https://web.archive.org/web/20210307005941/http://www.securitytracker.com/id?1026342
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210307005941/http://www.securitytracker.com/id?1026342
17
reference_url http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released
18
reference_url http://weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released
19
reference_url http://www.securityfocus.com/bid/50722
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/50722
20
reference_url http://www.securitytracker.com/id?1026342
reference_id
reference_type
scores
url http://www.securitytracker.com/id?1026342
21
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=755004
reference_id 755004
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=755004
22
reference_url https://github.com/advisories/GHSA-xxr8-833v-c7wc
reference_id GHSA-xxr8-833v-c7wc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-xxr8-833v-c7wc
fixed_packages
0
url pkg:gem/actionpack@3.0.11
purl pkg:gem/actionpack@3.0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.11
1
url pkg:gem/actionpack@3.1.2
purl pkg:gem/actionpack@3.1.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.2
aliases CVE-2011-4319, GHSA-xxr8-833v-c7wc, OSV-77199
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5pfg-7ntp-eff4
10
url VCID-5psk-hzaf-1kbz
vulnerability_id VCID-5psk-hzaf-1kbz
summary 
actionpack vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/translation_helper.rb` in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
references
0
reference_url http://rhn.redhat.com/errata/RHSA-2013-1794.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-1794.html
1
reference_url http://rhn.redhat.com/errata/RHSA-2014-0008.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0008.html
2
reference_url http://rhn.redhat.com/errata/RHSA-2014-1863.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-1863.html
3
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4491.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4491.json
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-4491
reference_id
reference_type
scores
0
value 0.00713
scoring_system epss
scoring_elements 0.72631
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-4491
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
10
reference_url http://seclists.org/oss-sec/2013/q4/401
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/401
11
reference_url https://github.com/advisories/GHSA-699m-mcjm-9cw8
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-699m-mcjm-9cw8
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-4491.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-4491.yml
13
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-4491
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-4491
15
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
16
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
17
reference_url http://www.debian.org/security/2014/dsa-2888
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2014/dsa-2888
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036922
reference_id 1036922
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036922
19
reference_url https://access.redhat.com/errata/RHSA-2013:1794
reference_id RHSA-2013:1794
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:1794
20
reference_url https://access.redhat.com/errata/RHSA-2014:0008
reference_id RHSA-2014:0008
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0008
fixed_packages
0
url pkg:gem/actionpack@3.2.16
purl pkg:gem/actionpack@3.2.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-832g-x9kb-3bbx
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-dd87-gevs-juhe
14
vulnerability VCID-eeru-6pyc-8bcd
15
vulnerability VCID-ejgq-s79w-abd6
16
vulnerability VCID-g13k-qvy7-q3fk
17
vulnerability VCID-g2a6-uem4-uuce
18
vulnerability VCID-hh65-ycrj-d7gz
19
vulnerability VCID-jpj6-wzp3-m3e4
20
vulnerability VCID-k6aw-heeb-wke2
21
vulnerability VCID-kshz-ckjc-77ab
22
vulnerability VCID-m9ud-s6w6-x7ac
23
vulnerability VCID-mnh7-4rvx-suay
24
vulnerability VCID-n7ga-1sx4-yfcv
25
vulnerability VCID-n7kh-9mpq-13c7
26
vulnerability VCID-nmz3-ux68-dkfd
27
vulnerability VCID-p1yd-keq8-rkh3
28
vulnerability VCID-qth9-abgp-wyaq
29
vulnerability VCID-r6mr-ay8d-nqdd
30
vulnerability VCID-sg9h-7dqr-xugu
31
vulnerability VCID-v2hk-dfbe-5khc
32
vulnerability VCID-v3u5-6bpb-qfgf
33
vulnerability VCID-vs1a-m7ya-rue8
34
vulnerability VCID-y13c-awe3-2bc1
35
vulnerability VCID-z16b-zfgu-13a9
36
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.16
1
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-hh65-ycrj-d7gz
17
vulnerability VCID-k6aw-heeb-wke2
18
vulnerability VCID-kshz-ckjc-77ab
19
vulnerability VCID-m156-zkzd-57g9
20
vulnerability VCID-m9ud-s6w6-x7ac
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7ga-1sx4-yfcv
23
vulnerability VCID-n7kh-9mpq-13c7
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-p1yd-keq8-rkh3
26
vulnerability VCID-qth9-abgp-wyaq
27
vulnerability VCID-r6mr-ay8d-nqdd
28
vulnerability VCID-sg9h-7dqr-xugu
29
vulnerability VCID-v2hk-dfbe-5khc
30
vulnerability VCID-v3u5-6bpb-qfgf
31
vulnerability VCID-vs1a-m7ya-rue8
32
vulnerability VCID-y13c-awe3-2bc1
33
vulnerability VCID-z16b-zfgu-13a9
34
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-4491, GHSA-699m-mcjm-9cw8, OSV-100528
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5psk-hzaf-1kbz
11
url VCID-6z21-pd9d-pfgk
vulnerability_id VCID-6z21-pd9d-pfgk
summary 
Possible Strong Parameters Bypass in ActionPack
There is a strong parameters bypass vector in ActionPack.

Versions Affected:  rails <= 6.0.3
Not affected:       rails < 5.0.0
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------
In some cases user supplied information can be inadvertently leaked from
Strong Parameters.  Specifically the return value of `each`, or `each_value`,
or `each_pair` will return the underlying "untrusted" hash of data that was
read from the parameters.  Applications that use this return value may be
inadvertently use untrusted user input.

Impacted code will look something like this:

```
def update
  # Attacker has included the parameter: `{ is_admin: true }`
  User.update(clean_up_params)
end

def clean_up_params
   params.each { |k, v|  SomeModel.check(v) if k == :name }
end
```

Note the mistaken use of `each` in the `clean_up_params` method in the above
example.

Workarounds
-----------
Do not use the return values of `each`, `each_value`, or `each_pair` in your
application.
references
0
reference_url http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00089.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00089.html
1
reference_url http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00093.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00093.html
2
reference_url http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00107.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00107.html
3
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8164.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8164.json
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-8164
reference_id
reference_type
scores
0
value 0.07389
scoring_system epss
scoring_elements 0.91842
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-8164
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15169
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15169
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8162
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8162
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8164
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8164
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8165
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8165
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8166
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8166
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8167
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8167
11
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
12
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
13
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8164.yml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8164.yml
14
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY
15
reference_url https://groups.google.com/g/rubyonrails-security/c/f6ioe4sdpbY
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/f6ioe4sdpbY
16
reference_url https://hackerone.com/reports/292797
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://hackerone.com/reports/292797
17
reference_url https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html
18
reference_url https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
19
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-8164
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-8164
20
reference_url https://www.debian.org/security/2020/dsa-4766
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2020/dsa-4766
21
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1842634
reference_id 1842634
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1842634
22
reference_url https://github.com/advisories/GHSA-8727-m6gj-mc37
reference_id GHSA-8727-m6gj-mc37
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8727-m6gj-mc37
23
reference_url https://access.redhat.com/errata/RHSA-2021:1313
reference_id RHSA-2021:1313
reference_type
scores
url https://access.redhat.com/errata/RHSA-2021:1313
fixed_packages
0
url pkg:gem/actionpack@5.2.4.3
purl pkg:gem/actionpack@5.2.4.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4fyg-vxpj-c7d7
1
vulnerability VCID-4w1v-z4zj-6ydp
2
vulnerability VCID-98gu-r7wd-cuah
3
vulnerability VCID-be5x-uyc6-sudm
4
vulnerability VCID-dd87-gevs-juhe
5
vulnerability VCID-eeru-6pyc-8bcd
6
vulnerability VCID-k6aw-heeb-wke2
7
vulnerability VCID-kshz-ckjc-77ab
8
vulnerability VCID-m9ud-s6w6-x7ac
9
vulnerability VCID-n7ga-1sx4-yfcv
10
vulnerability VCID-nmz3-ux68-dkfd
11
vulnerability VCID-qth9-abgp-wyaq
12
vulnerability VCID-re7g-rxbm-dbd9
13
vulnerability VCID-v2hk-dfbe-5khc
14
vulnerability VCID-z16b-zfgu-13a9
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.2.4.3
1
url pkg:gem/actionpack@6.0.3.1
purl pkg:gem/actionpack@6.0.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-25ru-4qks-7yf3
1
vulnerability VCID-4fyg-vxpj-c7d7
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-98gu-r7wd-cuah
4
vulnerability VCID-be5x-uyc6-sudm
5
vulnerability VCID-dd87-gevs-juhe
6
vulnerability VCID-eeru-6pyc-8bcd
7
vulnerability VCID-fdqs-v9b2-53gu
8
vulnerability VCID-fgtd-zx7r-rygb
9
vulnerability VCID-k6aw-heeb-wke2
10
vulnerability VCID-kshz-ckjc-77ab
11
vulnerability VCID-m9ud-s6w6-x7ac
12
vulnerability VCID-mgjg-juur-rfe5
13
vulnerability VCID-n7ga-1sx4-yfcv
14
vulnerability VCID-nmz3-ux68-dkfd
15
vulnerability VCID-qth9-abgp-wyaq
16
vulnerability VCID-re7g-rxbm-dbd9
17
vulnerability VCID-uppk-66vw-gbb9
18
vulnerability VCID-v2hk-dfbe-5khc
19
vulnerability VCID-z16b-zfgu-13a9
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.0.3.1
aliases CVE-2020-8164, GHSA-8727-m6gj-mc37
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6z21-pd9d-pfgk
12
url VCID-8nkw-8mka-1ygk
vulnerability_id VCID-8nkw-8mka-1ygk
summary 
actionpack Improper Input Validation vulnerability
The `to_s` method in `actionpack/lib/action_dispatch/middleware/remote_ip.rb` in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
references
0
reference_url http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html
reference_id
reference_type
scores
url http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-3187
reference_id
reference_type
scores
0
value 0.08484
scoring_system epss
scoring_elements 0.92485
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-3187
2
reference_url https://bugzilla.novell.com/show_bug.cgi?id=673010
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.novell.com/show_bug.cgi?id=673010
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3187
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3187
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-3187.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-3187.yml
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-3187
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-3187
7
reference_url https://web.archive.org/web/20111209181000/http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20111209181000/http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html
8
reference_url http://webservsec.blogspot.com/2011/02/ruby-on-rails-vulnerability.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://webservsec.blogspot.com/2011/02/ruby-on-rails-vulnerability.html
9
reference_url http://www.openwall.com/lists/oss-security/2011/08/17/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/17/1
10
reference_url http://www.openwall.com/lists/oss-security/2011/08/19/11
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/19/11
11
reference_url http://www.openwall.com/lists/oss-security/2011/08/20/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/20/1
12
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/13
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/13
13
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/14
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/14
14
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/5
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/5
15
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/35352.rb
reference_id CVE-2011-3187;OSVDB-73733
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/35352.rb
16
reference_url https://www.securityfocus.com/bid/46423/info
reference_id CVE-2011-3187;OSVDB-73733
reference_type exploit
scores
url https://www.securityfocus.com/bid/46423/info
17
reference_url https://github.com/advisories/GHSA-3vfw-7rcp-3xgm
reference_id GHSA-3vfw-7rcp-3xgm
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3vfw-7rcp-3xgm
fixed_packages
aliases CVE-2011-3187, GHSA-3vfw-7rcp-3xgm
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8nkw-8mka-1ygk
13
url VCID-98gu-r7wd-cuah
vulnerability_id VCID-98gu-r7wd-cuah
summary 
ReDoS based DoS vulnerability in Action Dispatch
There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.

Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact

Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious X_FORWARDED_HOST headers before they reach the application.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series
    7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22792.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22792.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-22792
reference_id
reference_type
scores
0
value 0.02326
scoring_system epss
scoring_elements 0.85075
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-22792
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22942
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22942
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21831
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21831
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27777
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27777
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22792
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22792
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22794
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22794
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796
12
reference_url https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-24T20:30:13Z/
url https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115
13
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
14
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
15
reference_url https://github.com/rails/rails/releases/tag/v7.0.4.1
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v7.0.4.1
16
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22792.yml
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22792.yml
17
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-22792
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-22792
18
reference_url https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
19
reference_url https://security.netapp.com/advisory/ntap-20240202-0007
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20240202-0007
20
reference_url https://www.debian.org/security/2023/dsa-5372
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-24T20:30:13Z/
url https://www.debian.org/security/2023/dsa-5372
21
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1030050
reference_id 1030050
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1030050
22
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2164800
reference_id 2164800
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2164800
23
reference_url https://github.com/advisories/GHSA-p84v-45xj-wwqj
reference_id GHSA-p84v-45xj-wwqj
reference_type
scores
url https://github.com/advisories/GHSA-p84v-45xj-wwqj
24
reference_url https://security.netapp.com/advisory/ntap-20240202-0007/
reference_id ntap-20240202-0007
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-24T20:30:13Z/
url https://security.netapp.com/advisory/ntap-20240202-0007/
25
reference_url https://access.redhat.com/errata/RHSA-2023:6818
reference_id RHSA-2023:6818
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:6818
fixed_packages
0
url pkg:gem/actionpack@5.2.8
purl pkg:gem/actionpack@5.2.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-m9ud-s6w6-x7ac
5
vulnerability VCID-nmz3-ux68-dkfd
6
vulnerability VCID-qth9-abgp-wyaq
7
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.2.8
1
url pkg:gem/actionpack@5.2.8.15
purl pkg:gem/actionpack@5.2.8.15
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.2.8.15
2
url pkg:gem/actionpack@6.1.7.1
purl pkg:gem/actionpack@6.1.7.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-b7z5-h1bw-tya9
2
vulnerability VCID-dd87-gevs-juhe
3
vulnerability VCID-eeru-6pyc-8bcd
4
vulnerability VCID-k6aw-heeb-wke2
5
vulnerability VCID-m9ud-s6w6-x7ac
6
vulnerability VCID-nmz3-ux68-dkfd
7
vulnerability VCID-qth9-abgp-wyaq
8
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.7.1
3
url pkg:gem/actionpack@7.0.4.1
purl pkg:gem/actionpack@7.0.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-b7z5-h1bw-tya9
2
vulnerability VCID-dd87-gevs-juhe
3
vulnerability VCID-eeru-6pyc-8bcd
4
vulnerability VCID-k6aw-heeb-wke2
5
vulnerability VCID-m9ud-s6w6-x7ac
6
vulnerability VCID-ndth-atqq-53gq
7
vulnerability VCID-nmz3-ux68-dkfd
8
vulnerability VCID-qth9-abgp-wyaq
9
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.4.1
aliases CVE-2023-22792, GHSA-p84v-45xj-wwqj, GMS-2023-58
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-98gu-r7wd-cuah
14
url VCID-9gqn-8g4t-wfby
vulnerability_id VCID-9gqn-8g4t-wfby
summary 
actionpack Cross-site Scripting vulnerability
The `sanitize_css` method in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle `\n` (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
1
reference_url http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html
2
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
3
reference_url http://rhn.redhat.com/errata/RHSA-2013-0698.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0698.html
4
reference_url http://rhn.redhat.com/errata/RHSA-2014-1863.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-1863.html
5
reference_url https://access.redhat.com/errata/RHSA-2013:0698
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2013:0698
6
reference_url https://access.redhat.com/errata/RHSA-2014:1863
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2014:1863
7
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1855.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1855.json
8
reference_url https://access.redhat.com/security/cve/CVE-2013-1855
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/security/cve/CVE-2013-1855
9
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-1855
reference_id
reference_type
scores
0
value 0.00536
scoring_system epss
scoring_elements 0.67744
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-1855
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=921331
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=921331
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1855
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1855
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-1855.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-1855.yml
13
reference_url https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8
reference_id
reference_type
scores
url https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8
14
reference_url https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain
15
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-1855
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-1855
16
reference_url http://support.apple.com/kb/HT5784
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://support.apple.com/kb/HT5784
17
reference_url https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
18
reference_url https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
19
reference_url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released
20
reference_url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
21
reference_url https://github.com/advisories/GHSA-q759-hwvc-m3jg
reference_id GHSA-q759-hwvc-m3jg
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-q759-hwvc-m3jg
22
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
0
url pkg:gem/actionpack@3.1.12
purl pkg:gem/actionpack@3.1.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-5pfg-7ntp-eff4
6
vulnerability VCID-5psk-hzaf-1kbz
7
vulnerability VCID-6z21-pd9d-pfgk
8
vulnerability VCID-8nkw-8mka-1ygk
9
vulnerability VCID-98gu-r7wd-cuah
10
vulnerability VCID-9gqn-8g4t-wfby
11
vulnerability VCID-a6wp-n5yh-ybcv
12
vulnerability VCID-b4sv-b9pz-r7er
13
vulnerability VCID-bfbp-7umh-2fcp
14
vulnerability VCID-cs1f-uhb2-xkcm
15
vulnerability VCID-dd87-gevs-juhe
16
vulnerability VCID-eeru-6pyc-8bcd
17
vulnerability VCID-ejgq-s79w-abd6
18
vulnerability VCID-g13k-qvy7-q3fk
19
vulnerability VCID-g2a6-uem4-uuce
20
vulnerability VCID-hh65-ycrj-d7gz
21
vulnerability VCID-jpj6-wzp3-m3e4
22
vulnerability VCID-k6aw-heeb-wke2
23
vulnerability VCID-kshz-ckjc-77ab
24
vulnerability VCID-m9ud-s6w6-x7ac
25
vulnerability VCID-mnh7-4rvx-suay
26
vulnerability VCID-n7ga-1sx4-yfcv
27
vulnerability VCID-n7kh-9mpq-13c7
28
vulnerability VCID-nax4-x97j-9fgr
29
vulnerability VCID-nmz3-ux68-dkfd
30
vulnerability VCID-nnka-c23v-qub7
31
vulnerability VCID-p1yd-keq8-rkh3
32
vulnerability VCID-qth9-abgp-wyaq
33
vulnerability VCID-r6mr-ay8d-nqdd
34
vulnerability VCID-sg9h-7dqr-xugu
35
vulnerability VCID-v2hk-dfbe-5khc
36
vulnerability VCID-v3u5-6bpb-qfgf
37
vulnerability VCID-vhjv-9864-tbcs
38
vulnerability VCID-vs1a-m7ya-rue8
39
vulnerability VCID-y13c-awe3-2bc1
40
vulnerability VCID-z16b-zfgu-13a9
41
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.12
1
url pkg:gem/actionpack@3.2.13
purl pkg:gem/actionpack@3.2.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-5pfg-7ntp-eff4
6
vulnerability VCID-5psk-hzaf-1kbz
7
vulnerability VCID-6z21-pd9d-pfgk
8
vulnerability VCID-832g-x9kb-3bbx
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-brwd-e9kx-xuc2
16
vulnerability VCID-cs1f-uhb2-xkcm
17
vulnerability VCID-dd87-gevs-juhe
18
vulnerability VCID-eeru-6pyc-8bcd
19
vulnerability VCID-ejgq-s79w-abd6
20
vulnerability VCID-g13k-qvy7-q3fk
21
vulnerability VCID-g2a6-uem4-uuce
22
vulnerability VCID-hh65-ycrj-d7gz
23
vulnerability VCID-jpj6-wzp3-m3e4
24
vulnerability VCID-k6aw-heeb-wke2
25
vulnerability VCID-kshz-ckjc-77ab
26
vulnerability VCID-m9ud-s6w6-x7ac
27
vulnerability VCID-mnh7-4rvx-suay
28
vulnerability VCID-n7ga-1sx4-yfcv
29
vulnerability VCID-n7kh-9mpq-13c7
30
vulnerability VCID-nax4-x97j-9fgr
31
vulnerability VCID-nmz3-ux68-dkfd
32
vulnerability VCID-nnka-c23v-qub7
33
vulnerability VCID-p1yd-keq8-rkh3
34
vulnerability VCID-qth9-abgp-wyaq
35
vulnerability VCID-r6mr-ay8d-nqdd
36
vulnerability VCID-sg9h-7dqr-xugu
37
vulnerability VCID-v2hk-dfbe-5khc
38
vulnerability VCID-v3u5-6bpb-qfgf
39
vulnerability VCID-vhjv-9864-tbcs
40
vulnerability VCID-vs1a-m7ya-rue8
41
vulnerability VCID-y13c-awe3-2bc1
42
vulnerability VCID-z16b-zfgu-13a9
43
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.13
aliases CVE-2013-1855, GHSA-q759-hwvc-m3jg, OSV-91452
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9gqn-8g4t-wfby
15
url VCID-a6wp-n5yh-ybcv
vulnerability_id VCID-a6wp-n5yh-ybcv
summary 
Improper Input Validation in actionpack
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
1
reference_url http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
2
reference_url http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup
3
reference_url http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
reference_id
reference_type
scores
url http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2008-7248.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2008-7248.json
5
reference_url https://access.redhat.com/security/cve/CVE-2008-7248
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/security/cve/CVE-2008-7248
6
reference_url https://api.first.org/data/v1/epss?cve=CVE-2008-7248
reference_id
reference_type
scores
0
value 0.11409
scoring_system epss
scoring_elements 0.93687
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2008-7248
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=544329
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=544329
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7248
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7248
9
reference_url http://secunia.com/advisories/36600
reference_id
reference_type
scores
url http://secunia.com/advisories/36600
10
reference_url http://secunia.com/advisories/38915
reference_id
reference_type
scores
url http://secunia.com/advisories/38915
11
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
12
reference_url https://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a
13
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2008-7248.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2008-7248.yml
14
reference_url https://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
15
reference_url https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
16
reference_url https://nvd.nist.gov/vuln/detail/CVE-2008-7248
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2008-7248
17
reference_url https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup
18
reference_url https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
reference_id
reference_type
scores
url https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
19
reference_url https://web.archive.org/web/20090906010200/https://www.vupen.com/english/advisories/2009/2544
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20090906010200/https://www.vupen.com/english/advisories/2009/2544
20
reference_url https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
21
reference_url https://www.openwall.com/lists/oss-security/2009/11/28/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.openwall.com/lists/oss-security/2009/11/28/1
22
reference_url https://www.openwall.com/lists/oss-security/2009/12/02/2
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.openwall.com/lists/oss-security/2009/12/02/2
23
reference_url https://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
24
reference_url http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
25
reference_url http://www.openwall.com/lists/oss-security/2009/11/28/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2009/11/28/1
26
reference_url http://www.openwall.com/lists/oss-security/2009/12/02/2
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2009/12/02/2
27
reference_url http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
reference_id
reference_type
scores
url http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
28
reference_url http://www.vupen.com/english/advisories/2009/2544
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2009/2544
29
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=558685
reference_id 558685
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=558685
30
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/33402.txt
reference_id CVE-2008-7248;OSVDB-61124
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/33402.txt
31
reference_url https://www.securityfocus.com/bid/37322/info
reference_id CVE-2008-7248;OSVDB-61124
reference_type exploit
scores
url https://www.securityfocus.com/bid/37322/info
32
reference_url https://github.com/advisories/GHSA-8fqx-7pv4-3jwm
reference_id GHSA-8fqx-7pv4-3jwm
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8fqx-7pv4-3jwm
33
reference_url https://security.gentoo.org/glsa/200912-02
reference_id GLSA-200912-02
reference_type
scores
url https://security.gentoo.org/glsa/200912-02
fixed_packages
aliases CVE-2008-7248, GHSA-8fqx-7pv4-3jwm
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-a6wp-n5yh-ybcv
16
url VCID-b4sv-b9pz-r7er
vulnerability_id VCID-b4sv-b9pz-r7er
summary 
actionview Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
references
0
reference_url http://rhn.redhat.com/errata/RHSA-2016-1855.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-1855.html
1
reference_url http://rhn.redhat.com/errata/RHSA-2016-1856.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-1856.html
2
reference_url http://rhn.redhat.com/errata/RHSA-2016-1857.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-1857.html
3
reference_url http://rhn.redhat.com/errata/RHSA-2016-1858.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-1858.html
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-6316.json
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-6316.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-6316
reference_id
reference_type
scores
0
value 0.01626
scoring_system epss
scoring_elements 0.82169
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-6316
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6316
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6316
7
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:N/C:N/I:P/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
8
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml
9
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk
10
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-6316
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-6316
12
reference_url https://web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430
13
reference_url https://web.archive.org/web/20200812154343/https://puppet.com/security/cve/cve-2016-6316
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200812154343/https://puppet.com/security/cve/cve-2016-6316
14
reference_url http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
15
reference_url http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/
16
reference_url http://www.debian.org/security/2016/dsa-3651
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2016/dsa-3651
17
reference_url http://www.openwall.com/lists/oss-security/2016/08/11/3
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2016/08/11/3
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1365008
reference_id 1365008
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1365008
19
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834155
reference_id 834155
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834155
20
reference_url https://github.com/advisories/GHSA-pc3m-v286-2jwj
reference_id GHSA-pc3m-v286-2jwj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-pc3m-v286-2jwj
21
reference_url https://access.redhat.com/errata/RHSA-2016:1855
reference_id RHSA-2016:1855
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:1855
22
reference_url https://access.redhat.com/errata/RHSA-2016:1856
reference_id RHSA-2016:1856
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:1856
23
reference_url https://access.redhat.com/errata/RHSA-2016:1857
reference_id RHSA-2016:1857
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:1857
24
reference_url https://access.redhat.com/errata/RHSA-2016:1858
reference_id RHSA-2016:1858
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:1858
fixed_packages
0
url pkg:gem/actionpack@3.2.22.3
purl pkg:gem/actionpack@3.2.22.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-a6wp-n5yh-ybcv
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-dd87-gevs-juhe
10
vulnerability VCID-eeru-6pyc-8bcd
11
vulnerability VCID-ejgq-s79w-abd6
12
vulnerability VCID-g13k-qvy7-q3fk
13
vulnerability VCID-g2a6-uem4-uuce
14
vulnerability VCID-k6aw-heeb-wke2
15
vulnerability VCID-kshz-ckjc-77ab
16
vulnerability VCID-m9ud-s6w6-x7ac
17
vulnerability VCID-mnh7-4rvx-suay
18
vulnerability VCID-n7ga-1sx4-yfcv
19
vulnerability VCID-n7kh-9mpq-13c7
20
vulnerability VCID-nmz3-ux68-dkfd
21
vulnerability VCID-p1yd-keq8-rkh3
22
vulnerability VCID-qth9-abgp-wyaq
23
vulnerability VCID-v2hk-dfbe-5khc
24
vulnerability VCID-z16b-zfgu-13a9
25
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.22.3
aliases CVE-2016-6316, GHSA-pc3m-v286-2jwj
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-b4sv-b9pz-r7er
17
url VCID-bfbp-7umh-2fcp
vulnerability_id VCID-bfbp-7umh-2fcp
summary 
actionpack and activesupport vulnerable to information leaks
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
references
0
reference_url http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2009-3086
reference_id
reference_type
scores
0
value 0.00556
scoring_system epss
scoring_elements 0.68454
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2009-3086
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3086
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3086
3
reference_url http://secunia.com/advisories/36600
reference_id
reference_type
scores
url http://secunia.com/advisories/36600
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rails/rails/commit/1f07a89c5946910fc28ea5ccd1da6af8a0f972a0
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/1f07a89c5946910fc28ea5ccd1da6af8a0f972a0
6
reference_url https://github.com/rails/rails/commit/674f780d59a5a7ec0301755d43a7b277a3ad2978
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/674f780d59a5a7ec0301755d43a7b277a3ad2978
7
reference_url https://github.com/rails/rails/commit/d460c9a25560f43e7c3789abadf7b455053eb686
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/d460c9a25560f43e7c3789abadf7b455053eb686
8
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2009-3086.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2009-3086.yml
9
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2009-3086.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2009-3086.yml
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2009-3086
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2009-3086
11
reference_url https://web.archive.org/web/20090906010200/http://www.vupen.com/english/advisories/2009/2544
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20090906010200/http://www.vupen.com/english/advisories/2009/2544
12
reference_url https://web.archive.org/web/20090907001716/http://secunia.com/advisories/36600
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20090907001716/http://secunia.com/advisories/36600
13
reference_url https://web.archive.org/web/20200229150042/http://www.securityfocus.com/bid/37427
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200229150042/http://www.securityfocus.com/bid/37427
14
reference_url http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails
15
reference_url http://www.debian.org/security/2011/dsa-2260
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2011/dsa-2260
16
reference_url http://www.securityfocus.com/bid/37427
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/37427
17
reference_url http://www.vupen.com/english/advisories/2009/2544
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2009/2544
18
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
reference_id 545063
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
19
reference_url https://github.com/advisories/GHSA-fg9w-g6m4-557j
reference_id GHSA-fg9w-g6m4-557j
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-fg9w-g6m4-557j
20
reference_url https://security.gentoo.org/glsa/200912-02
reference_id GLSA-200912-02
reference_type
scores
url https://security.gentoo.org/glsa/200912-02
fixed_packages
aliases CVE-2009-3086, GHSA-fg9w-g6m4-557j
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bfbp-7umh-2fcp
18
url VCID-cs1f-uhb2-xkcm
vulnerability_id VCID-cs1f-uhb2-xkcm
summary 
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the simple_format helper in `actionpack/lib/action_view/helpers/text_helper.rb` in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6416.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6416.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-6416
reference_id
reference_type
scores
0
value 0.00236
scoring_system epss
scoring_elements 0.46624
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-6416
2
reference_url http://seclists.org/oss-sec/2013/q4/404
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/404
3
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
4
reference_url https://github.com/rails/rails/commit/4b4f5847f64f81c961625e647711ef9f6ad1a454
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/4b4f5847f64f81c961625e647711ef9f6ad1a454
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6416.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6416.yml
6
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/5ZI1-H5OoIM/ZNq4FoR2GnIJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/5ZI1-H5OoIM/ZNq4FoR2GnIJ
7
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/5ZI1-H5OoIM
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/5ZI1-H5OoIM
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-6416
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-6416
9
reference_url https://web.archive.org/web/20200228165109/http://www.securityfocus.com/bid/64071
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200228165109/http://www.securityfocus.com/bid/64071
10
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
11
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036914
reference_id 1036914
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036914
13
reference_url https://github.com/advisories/GHSA-w37c-q653-qg95
reference_id GHSA-w37c-q653-qg95
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-w37c-q653-qg95
fixed_packages
0
url pkg:gem/actionpack@3.1.0
purl pkg:gem/actionpack@3.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.0
1
url pkg:gem/actionpack@3.2.0
purl pkg:gem/actionpack@3.2.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-832g-x9kb-3bbx
13
vulnerability VCID-8nkw-8mka-1ygk
14
vulnerability VCID-98gu-r7wd-cuah
15
vulnerability VCID-9gqn-8g4t-wfby
16
vulnerability VCID-a6wp-n5yh-ybcv
17
vulnerability VCID-b4sv-b9pz-r7er
18
vulnerability VCID-bfbp-7umh-2fcp
19
vulnerability VCID-brwd-e9kx-xuc2
20
vulnerability VCID-cs1f-uhb2-xkcm
21
vulnerability VCID-dd87-gevs-juhe
22
vulnerability VCID-eeru-6pyc-8bcd
23
vulnerability VCID-ejgq-s79w-abd6
24
vulnerability VCID-g13k-qvy7-q3fk
25
vulnerability VCID-g2a6-uem4-uuce
26
vulnerability VCID-hh65-ycrj-d7gz
27
vulnerability VCID-jpj6-wzp3-m3e4
28
vulnerability VCID-k6aw-heeb-wke2
29
vulnerability VCID-kshz-ckjc-77ab
30
vulnerability VCID-m9ud-s6w6-x7ac
31
vulnerability VCID-mnh7-4rvx-suay
32
vulnerability VCID-n7ga-1sx4-yfcv
33
vulnerability VCID-n7kh-9mpq-13c7
34
vulnerability VCID-nax4-x97j-9fgr
35
vulnerability VCID-nmz3-ux68-dkfd
36
vulnerability VCID-nnka-c23v-qub7
37
vulnerability VCID-p1yd-keq8-rkh3
38
vulnerability VCID-qth9-abgp-wyaq
39
vulnerability VCID-r6mr-ay8d-nqdd
40
vulnerability VCID-rgw4-mrr9-euda
41
vulnerability VCID-sg9h-7dqr-xugu
42
vulnerability VCID-v2hk-dfbe-5khc
43
vulnerability VCID-v3u5-6bpb-qfgf
44
vulnerability VCID-v4sh-tkkf-xfeh
45
vulnerability VCID-vhjv-9864-tbcs
46
vulnerability VCID-vs1a-m7ya-rue8
47
vulnerability VCID-y13c-awe3-2bc1
48
vulnerability VCID-z16b-zfgu-13a9
49
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.0
2
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-hh65-ycrj-d7gz
17
vulnerability VCID-k6aw-heeb-wke2
18
vulnerability VCID-kshz-ckjc-77ab
19
vulnerability VCID-m156-zkzd-57g9
20
vulnerability VCID-m9ud-s6w6-x7ac
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7ga-1sx4-yfcv
23
vulnerability VCID-n7kh-9mpq-13c7
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-p1yd-keq8-rkh3
26
vulnerability VCID-qth9-abgp-wyaq
27
vulnerability VCID-r6mr-ay8d-nqdd
28
vulnerability VCID-sg9h-7dqr-xugu
29
vulnerability VCID-v2hk-dfbe-5khc
30
vulnerability VCID-v3u5-6bpb-qfgf
31
vulnerability VCID-vs1a-m7ya-rue8
32
vulnerability VCID-y13c-awe3-2bc1
33
vulnerability VCID-z16b-zfgu-13a9
34
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-6416, GHSA-w37c-q653-qg95, OSV-100526
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cs1f-uhb2-xkcm
19
url VCID-dd87-gevs-juhe
vulnerability_id VCID-dd87-gevs-juhe
summary 
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
There is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2024-41128.

Impact
------

Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.


Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Users on Ruby 3.2 are unaffected by this issue.


Credits
-------

Thanks to [scyoon](https://hackerone.com/scyoon) for the report and patches!
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41128.json
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41128.json
1
reference_url https://access.redhat.com/security/cve/cve-2024-41128
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://access.redhat.com/security/cve/cve-2024-41128
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-41128
reference_id
reference_type
scores
0
value 0.00774
scoring_system epss
scoring_elements 0.73902
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-41128
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2319036
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://bugzilla.redhat.com/show_bug.cgi?id=2319036
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41128
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41128
5
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
6
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
7
reference_url https://github.com/rails/rails/commit/27121e80f6dbb260f5a9f0452cd8411cb681f075
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://github.com/rails/rails/commit/27121e80f6dbb260f5a9f0452cd8411cb681f075
8
reference_url https://github.com/rails/rails/commit/b0fe99fa854ec8ff4498e75779b458392d1560ef
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://github.com/rails/rails/commit/b0fe99fa854ec8ff4498e75779b458392d1560ef
9
reference_url https://github.com/rails/rails/commit/b1241f468d1b32235f438c2e2203386e6efd3891
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://github.com/rails/rails/commit/b1241f468d1b32235f438c2e2203386e6efd3891
10
reference_url https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd
11
reference_url https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T17:09:25Z/
url https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-41128.yml
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-41128.yml
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-41128
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-41128
14
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085376
reference_id 1085376
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085376
15
reference_url https://github.com/advisories/GHSA-x76w-6vjr-8xgj
reference_id GHSA-x76w-6vjr-8xgj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-x76w-6vjr-8xgj
16
reference_url https://usn.ubuntu.com/7290-1/
reference_id USN-7290-1
reference_type
scores
url https://usn.ubuntu.com/7290-1/
fixed_packages
0
url pkg:gem/actionpack@6.1.7.9
purl pkg:gem/actionpack@6.1.7.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.7.9
1
url pkg:gem/actionpack@7.0.0.alpha1
purl pkg:gem/actionpack@7.0.0.alpha1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-nmz3-ux68-dkfd
5
vulnerability VCID-qth9-abgp-wyaq
6
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.0.alpha1
2
url pkg:gem/actionpack@7.0.8.5
purl pkg:gem/actionpack@7.0.8.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.8.5
3
url pkg:gem/actionpack@7.1.0.beta1
purl pkg:gem/actionpack@7.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dd87-gevs-juhe
1
vulnerability VCID-eeru-6pyc-8bcd
2
vulnerability VCID-nmz3-ux68-dkfd
3
vulnerability VCID-qth9-abgp-wyaq
4
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.1.0.beta1
4
url pkg:gem/actionpack@7.1.4.1
purl pkg:gem/actionpack@7.1.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.1.4.1
5
url pkg:gem/actionpack@7.2.0.beta1
purl pkg:gem/actionpack@7.2.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-b7z5-h1bw-tya9
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-nmz3-ux68-dkfd
4
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.2.0.beta1
6
url pkg:gem/actionpack@7.2.1.1
purl pkg:gem/actionpack@7.2.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.2.1.1
7
url pkg:gem/actionpack@8.0.0.beta1
purl pkg:gem/actionpack@8.0.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dd87-gevs-juhe
1
vulnerability VCID-eeru-6pyc-8bcd
2
vulnerability VCID-nmz3-ux68-dkfd
3
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@8.0.0.beta1
aliases CVE-2024-41128, GHSA-x76w-6vjr-8xgj
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dd87-gevs-juhe
20
url VCID-eeru-6pyc-8bcd
vulnerability_id VCID-eeru-6pyc-8bcd
summary 
Possible ReDoS vulnerability in HTTP Token authentication in Action Controller
There is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. This vulnerability has been assigned the CVE identifier CVE-2024-47887.

Impact
------

For applications using HTTP Token authentication via `authenticate_or_request_with_http_token` or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Users on Ruby 3.2 are unaffected by this issue.


Credits
-------
Thanks to [scyoon](https://hackerone.com/scyoon) for reporting
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-47887.json
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-47887.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-47887
reference_id
reference_type
scores
0
value 0.00333
scoring_system epss
scoring_elements 0.56344
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-47887
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47887
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47887
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T16:34:50Z/
url https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
6
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-47887.yml
reference_id
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-47887.yml
7
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085376
reference_id 1085376
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085376
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2319034
reference_id 2319034
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2319034
9
reference_url https://github.com/rails/rails/commit/56b2fc3302836405b496e196a8d5fc0195e55049
reference_id 56b2fc3302836405b496e196a8d5fc0195e55049
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T16:34:50Z/
url https://github.com/rails/rails/commit/56b2fc3302836405b496e196a8d5fc0195e55049
10
reference_url https://github.com/rails/rails/commit/7c1398854d51f9bb193fb79f226647351133d08a
reference_id 7c1398854d51f9bb193fb79f226647351133d08a
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T16:34:50Z/
url https://github.com/rails/rails/commit/7c1398854d51f9bb193fb79f226647351133d08a
11
reference_url https://github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545
reference_id 8e057db25bff1dc7a98e9ae72e0083825b9ac545
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T16:34:50Z/
url https://github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-47887
reference_id CVE-2024-47887
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2024-47887
13
reference_url https://github.com/rails/rails/commit/f4dc83d8926509d0958ec21fcdbc2e7df3d32ce2
reference_id f4dc83d8926509d0958ec21fcdbc2e7df3d32ce2
reference_type
scores
0
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-17T16:34:50Z/
url https://github.com/rails/rails/commit/f4dc83d8926509d0958ec21fcdbc2e7df3d32ce2
14
reference_url https://github.com/advisories/GHSA-vfg9-r3fq-jvx4
reference_id GHSA-vfg9-r3fq-jvx4
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vfg9-r3fq-jvx4
15
reference_url https://usn.ubuntu.com/7290-1/
reference_id USN-7290-1
reference_type
scores
url https://usn.ubuntu.com/7290-1/
fixed_packages
0
url pkg:gem/actionpack@6.1.7.9
purl pkg:gem/actionpack@6.1.7.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.7.9
1
url pkg:gem/actionpack@7.0.0.alpha1
purl pkg:gem/actionpack@7.0.0.alpha1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-nmz3-ux68-dkfd
5
vulnerability VCID-qth9-abgp-wyaq
6
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.0.alpha1
2
url pkg:gem/actionpack@7.0.8.5
purl pkg:gem/actionpack@7.0.8.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.8.5
3
url pkg:gem/actionpack@7.1.0.beta1
purl pkg:gem/actionpack@7.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dd87-gevs-juhe
1
vulnerability VCID-eeru-6pyc-8bcd
2
vulnerability VCID-nmz3-ux68-dkfd
3
vulnerability VCID-qth9-abgp-wyaq
4
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.1.0.beta1
4
url pkg:gem/actionpack@7.1.4.1
purl pkg:gem/actionpack@7.1.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.1.4.1
5
url pkg:gem/actionpack@7.2.0.beta1
purl pkg:gem/actionpack@7.2.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-b7z5-h1bw-tya9
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-nmz3-ux68-dkfd
4
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.2.0.beta1
6
url pkg:gem/actionpack@7.2.1.1
purl pkg:gem/actionpack@7.2.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
1
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.2.1.1
7
url pkg:gem/actionpack@8.0.0.beta1
purl pkg:gem/actionpack@8.0.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dd87-gevs-juhe
1
vulnerability VCID-eeru-6pyc-8bcd
2
vulnerability VCID-nmz3-ux68-dkfd
3
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@8.0.0.beta1
aliases CVE-2024-47887, GHSA-vfg9-r3fq-jvx4
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-eeru-6pyc-8bcd
21
url VCID-ejgq-s79w-abd6
vulnerability_id VCID-ejgq-s79w-abd6
summary 
rails Cross-site Scripting vulnerability
The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html
3
reference_url http://openwall.com/lists/oss-security/2011/06/09/2
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://openwall.com/lists/oss-security/2011/06/09/2
4
reference_url http://openwall.com/lists/oss-security/2011/06/13/9
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://openwall.com/lists/oss-security/2011/06/13/9
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-2197
reference_id
reference_type
scores
0
value 0.00442
scoring_system epss
scoring_elements 0.63551
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-2197
6
reference_url http://secunia.com/advisories/44789
reference_id
reference_type
scores
url http://secunia.com/advisories/44789
7
reference_url https://gist.github.com/NZKoz/b2ceb626fc2bcdfe497f
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://gist.github.com/NZKoz/b2ceb626fc2bcdfe497f
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/53a2c0baf2b128dd4808eca313256f6f4bb8c4cd
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/53a2c0baf2b128dd4808eca313256f6f4bb8c4cd
10
reference_url https://github.com/rails/rails/commit/ed3796434af6069ced6a641293cf88eef3b284da
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/ed3796434af6069ced6a641293cf88eef3b284da
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2197.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2197.yml
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-2197
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-2197
13
reference_url http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications
14
reference_url https://github.com/advisories/GHSA-v9v4-7jp6-8c73
reference_id GHSA-v9v4-7jp6-8c73
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-v9v4-7jp6-8c73
fixed_packages
0
url pkg:gem/actionpack@3.0.7
purl pkg:gem/actionpack@3.0.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.7
1
url pkg:gem/actionpack@3.0.8
purl pkg:gem/actionpack@3.0.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.8
aliases CVE-2011-2197, GHSA-v9v4-7jp6-8c73
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ejgq-s79w-abd6
22
url VCID-fr3w-ejk8-47gw
vulnerability_id VCID-fr3w-ejk8-47gw
summary 
Cross site scripting in actionpack Rubygem
A cross-site scripting vulnerability flaw was found in the `auto_link` function in Rails before version 3.0.6.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-1497.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-1497.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-1497
reference_id
reference_type
scores
0
value 0.00328
scoring_system epss
scoring_elements 0.55931
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-1497
2
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
3
reference_url https://github.com/rails/rails/blob/38df020c95beca7e12f0188cb7e18f3c37789e20/actionpack/CHANGELOG
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/blob/38df020c95beca7e12f0188cb7e18f3c37789e20/actionpack/CHANGELOG
4
reference_url https://github.com/rails/rails/commit/61ee3449674c591747db95f9b3472c5c3bd9e84d
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/61ee3449674c591747db95f9b3472c5c3bd9e84d
5
reference_url https://github.com/rails/rails/commit/ab764ecbfea31a3b14323283287e2fc80955ace6
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/ab764ecbfea31a3b14323283287e2fc80955ace6
6
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-1497.yml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-1497.yml
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-1497
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-1497
8
reference_url https://www.openwall.com/lists/oss-security/2011/04/06/13
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.openwall.com/lists/oss-security/2011/04/06/13
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2015262
reference_id 2015262
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2015262
10
reference_url https://github.com/advisories/GHSA-q58j-fmvf-9rq6
reference_id GHSA-q58j-fmvf-9rq6
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-q58j-fmvf-9rq6
fixed_packages
0
url pkg:gem/actionpack@3.0.6
purl pkg:gem/actionpack@3.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.6
aliases CVE-2011-1497, GHSA-q58j-fmvf-9rq6
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fr3w-ejk8-47gw
23
url VCID-g13k-qvy7-q3fk
vulnerability_id VCID-g13k-qvy7-q3fk
summary 
Rails actionpack gem vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the `mail_to` helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
3
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-0446
reference_id
reference_type
scores
0
value 0.0067
scoring_system epss
scoring_elements 0.71678
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-0446
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0446
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0446
6
reference_url http://secunia.com/advisories/43274
reference_id
reference_type
scores
url http://secunia.com/advisories/43274
7
reference_url http://secunia.com/advisories/43666
reference_id
reference_type
scores
url http://secunia.com/advisories/43666
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/abe97736b8316f1b714cac56c115c0779aa73217
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/abe97736b8316f1b714cac56c115c0779aa73217
10
reference_url https://github.com/rails/rails/commit/e3dd2107c57a8efaaea5d61cf8da65f7444760b2
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/e3dd2107c57a8efaaea5d61cf8da65f7444760b2
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0446.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0446.yml
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2011-0446.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2011-0446.yml
13
reference_url https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-0446
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-0446
15
reference_url https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43274
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43274
16
reference_url https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43666
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43666
17
reference_url https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
18
reference_url https://web.archive.org/web/20200812054342/http://www.securitytracker.com/id?1025064
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200812054342/http://www.securitytracker.com/id?1025064
19
reference_url http://www.debian.org/security/2011/dsa-2247
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2011/dsa-2247
20
reference_url http://www.securityfocus.com/bid/46291
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/46291
21
reference_url http://www.securitytracker.com/id?1025064
reference_id
reference_type
scores
url http://www.securitytracker.com/id?1025064
22
reference_url http://www.vupen.com/english/advisories/2011/0587
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2011/0587
23
reference_url http://www.vupen.com/english/advisories/2011/0877
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2011/0877
24
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614864
reference_id 614864
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614864
25
reference_url https://github.com/advisories/GHSA-75w6-p6mg-vh8j
reference_id GHSA-75w6-p6mg-vh8j
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-75w6-p6mg-vh8j
26
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
0
url pkg:gem/actionpack@3.0.4
purl pkg:gem/actionpack@3.0.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-fr3w-ejk8-47gw
23
vulnerability VCID-g13k-qvy7-q3fk
24
vulnerability VCID-g2a6-uem4-uuce
25
vulnerability VCID-hh65-ycrj-d7gz
26
vulnerability VCID-jpj6-wzp3-m3e4
27
vulnerability VCID-k6aw-heeb-wke2
28
vulnerability VCID-kshz-ckjc-77ab
29
vulnerability VCID-m9ud-s6w6-x7ac
30
vulnerability VCID-mnh7-4rvx-suay
31
vulnerability VCID-n7ga-1sx4-yfcv
32
vulnerability VCID-n7kh-9mpq-13c7
33
vulnerability VCID-nax4-x97j-9fgr
34
vulnerability VCID-nmz3-ux68-dkfd
35
vulnerability VCID-nnka-c23v-qub7
36
vulnerability VCID-p1yd-keq8-rkh3
37
vulnerability VCID-qth9-abgp-wyaq
38
vulnerability VCID-r6mr-ay8d-nqdd
39
vulnerability VCID-rgw4-mrr9-euda
40
vulnerability VCID-sg9h-7dqr-xugu
41
vulnerability VCID-v2hk-dfbe-5khc
42
vulnerability VCID-v3u5-6bpb-qfgf
43
vulnerability VCID-vhjv-9864-tbcs
44
vulnerability VCID-vs1a-m7ya-rue8
45
vulnerability VCID-y13c-awe3-2bc1
46
vulnerability VCID-z16b-zfgu-13a9
47
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.4
aliases CVE-2011-0446, GHSA-75w6-p6mg-vh8j
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g13k-qvy7-q3fk
24
url VCID-g2a6-uem4-uuce
vulnerability_id VCID-g2a6-uem4-uuce
summary 
actionpack Cross-Site Request Forgery vulnerability
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
3
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-0447
reference_id
reference_type
scores
0
value 0.00991
scoring_system epss
scoring_elements 0.77177
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-0447
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0447
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0447
6
reference_url http://secunia.com/advisories/43274
reference_id
reference_type
scores
url http://secunia.com/advisories/43274
7
reference_url http://secunia.com/advisories/43666
reference_id
reference_type
scores
url http://secunia.com/advisories/43666
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034
10
reference_url https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-0447
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-0447
13
reference_url https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
14
reference_url https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060
15
reference_url http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
16
reference_url http://www.debian.org/security/2011/dsa-2247
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2011/dsa-2247
17
reference_url http://www.securityfocus.com/bid/46291
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/46291
18
reference_url http://www.securitytracker.com/id?1025060
reference_id
reference_type
scores
url http://www.securitytracker.com/id?1025060
19
reference_url http://www.vupen.com/english/advisories/2011/0587
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2011/0587
20
reference_url http://www.vupen.com/english/advisories/2011/0877
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2011/0877
21
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614864
reference_id 614864
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614864
22
reference_url https://github.com/advisories/GHSA-24fg-p96v-hxh8
reference_id GHSA-24fg-p96v-hxh8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-24fg-p96v-hxh8
23
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
0
url pkg:gem/actionpack@3.0.4
purl pkg:gem/actionpack@3.0.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-fr3w-ejk8-47gw
23
vulnerability VCID-g13k-qvy7-q3fk
24
vulnerability VCID-g2a6-uem4-uuce
25
vulnerability VCID-hh65-ycrj-d7gz
26
vulnerability VCID-jpj6-wzp3-m3e4
27
vulnerability VCID-k6aw-heeb-wke2
28
vulnerability VCID-kshz-ckjc-77ab
29
vulnerability VCID-m9ud-s6w6-x7ac
30
vulnerability VCID-mnh7-4rvx-suay
31
vulnerability VCID-n7ga-1sx4-yfcv
32
vulnerability VCID-n7kh-9mpq-13c7
33
vulnerability VCID-nax4-x97j-9fgr
34
vulnerability VCID-nmz3-ux68-dkfd
35
vulnerability VCID-nnka-c23v-qub7
36
vulnerability VCID-p1yd-keq8-rkh3
37
vulnerability VCID-qth9-abgp-wyaq
38
vulnerability VCID-r6mr-ay8d-nqdd
39
vulnerability VCID-rgw4-mrr9-euda
40
vulnerability VCID-sg9h-7dqr-xugu
41
vulnerability VCID-v2hk-dfbe-5khc
42
vulnerability VCID-v3u5-6bpb-qfgf
43
vulnerability VCID-vhjv-9864-tbcs
44
vulnerability VCID-vs1a-m7ya-rue8
45
vulnerability VCID-y13c-awe3-2bc1
46
vulnerability VCID-z16b-zfgu-13a9
47
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.4
aliases CVE-2011-0447, GHSA-24fg-p96v-hxh8
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g2a6-uem4-uuce
25
url VCID-jpj6-wzp3-m3e4
vulnerability_id VCID-jpj6-wzp3-m3e4
summary 
actionpack Improper Input Validation vulnerability
`actionpack/lib/action_view/template/text.rb` in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the `:text` option to the `render` method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
1
reference_url http://openwall.com/lists/oss-security/2014/02/18/10
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://openwall.com/lists/oss-security/2014/02/18/10
2
reference_url http://rhn.redhat.com/errata/RHSA-2014-0215.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0215.html
3
reference_url http://rhn.redhat.com/errata/RHSA-2014-0306.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0306.html
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0082.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0082.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-0082
reference_id
reference_type
scores
0
value 0.06456
scoring_system epss
scoring_elements 0.91211
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-0082
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0081
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0081
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0082
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0082
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0130
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0130
9
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
10
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0082.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0082.yml
11
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/LMxO_3_eCuc
reference_id
reference_type
scores
url https://groups.google.com/forum/#!topic/rubyonrails-security/LMxO_3_eCuc
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-0082
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-0082
13
reference_url https://web.archive.org/web/20201207044540/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201207044540/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ
14
reference_url https://web.archive.org/web/20220315115444/https://puppet.com/security/cve/cve-2014-0082
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20220315115444/https://puppet.com/security/cve/cve-2014-0082
15
reference_url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release
16
reference_url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
reference_id
reference_type
scores
url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
17
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1065538
reference_id 1065538
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1065538
18
reference_url https://github.com/advisories/GHSA-7cgp-c3g7-qvrw
reference_id GHSA-7cgp-c3g7-qvrw
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7cgp-c3g7-qvrw
19
reference_url https://access.redhat.com/errata/RHSA-2014:0215
reference_id RHSA-2014:0215
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0215
20
reference_url https://access.redhat.com/errata/RHSA-2014:0306
reference_id RHSA-2014:0306
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0306
fixed_packages
0
url pkg:gem/actionpack@3.2.17
purl pkg:gem/actionpack@3.2.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-832g-x9kb-3bbx
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-dd87-gevs-juhe
14
vulnerability VCID-eeru-6pyc-8bcd
15
vulnerability VCID-ejgq-s79w-abd6
16
vulnerability VCID-g13k-qvy7-q3fk
17
vulnerability VCID-g2a6-uem4-uuce
18
vulnerability VCID-hh65-ycrj-d7gz
19
vulnerability VCID-k6aw-heeb-wke2
20
vulnerability VCID-kshz-ckjc-77ab
21
vulnerability VCID-m9ud-s6w6-x7ac
22
vulnerability VCID-mnh7-4rvx-suay
23
vulnerability VCID-n7ga-1sx4-yfcv
24
vulnerability VCID-n7kh-9mpq-13c7
25
vulnerability VCID-nmz3-ux68-dkfd
26
vulnerability VCID-p1yd-keq8-rkh3
27
vulnerability VCID-qth9-abgp-wyaq
28
vulnerability VCID-r6mr-ay8d-nqdd
29
vulnerability VCID-sg9h-7dqr-xugu
30
vulnerability VCID-v2hk-dfbe-5khc
31
vulnerability VCID-v3u5-6bpb-qfgf
32
vulnerability VCID-y13c-awe3-2bc1
33
vulnerability VCID-z16b-zfgu-13a9
34
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.17
1
url pkg:gem/actionpack@4.0.0.beta1
purl pkg:gem/actionpack@4.0.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-3rn4-abmh-nkhv
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-5psk-hzaf-1kbz
6
vulnerability VCID-6z21-pd9d-pfgk
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-9gqn-8g4t-wfby
10
vulnerability VCID-a6wp-n5yh-ybcv
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-cs1f-uhb2-xkcm
14
vulnerability VCID-dd87-gevs-juhe
15
vulnerability VCID-eeru-6pyc-8bcd
16
vulnerability VCID-ejgq-s79w-abd6
17
vulnerability VCID-g13k-qvy7-q3fk
18
vulnerability VCID-g2a6-uem4-uuce
19
vulnerability VCID-jpj6-wzp3-m3e4
20
vulnerability VCID-k6aw-heeb-wke2
21
vulnerability VCID-kshz-ckjc-77ab
22
vulnerability VCID-m156-zkzd-57g9
23
vulnerability VCID-m9ud-s6w6-x7ac
24
vulnerability VCID-mnh7-4rvx-suay
25
vulnerability VCID-n7ga-1sx4-yfcv
26
vulnerability VCID-n7kh-9mpq-13c7
27
vulnerability VCID-nax4-x97j-9fgr
28
vulnerability VCID-nmz3-ux68-dkfd
29
vulnerability VCID-nnka-c23v-qub7
30
vulnerability VCID-p1yd-keq8-rkh3
31
vulnerability VCID-qth9-abgp-wyaq
32
vulnerability VCID-r6mr-ay8d-nqdd
33
vulnerability VCID-sg9h-7dqr-xugu
34
vulnerability VCID-v2hk-dfbe-5khc
35
vulnerability VCID-v3u5-6bpb-qfgf
36
vulnerability VCID-vhjv-9864-tbcs
37
vulnerability VCID-vs1a-m7ya-rue8
38
vulnerability VCID-y13c-awe3-2bc1
39
vulnerability VCID-z16b-zfgu-13a9
40
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.0.beta1
2
url pkg:gem/actionpack@4.0.0
purl pkg:gem/actionpack@4.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-5az9-zqff-5kav
6
vulnerability VCID-5pfg-7ntp-eff4
7
vulnerability VCID-5psk-hzaf-1kbz
8
vulnerability VCID-6z21-pd9d-pfgk
9
vulnerability VCID-832g-x9kb-3bbx
10
vulnerability VCID-8nkw-8mka-1ygk
11
vulnerability VCID-8p57-4fhz-v3gh
12
vulnerability VCID-98gu-r7wd-cuah
13
vulnerability VCID-a6wp-n5yh-ybcv
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-brwd-e9kx-xuc2
16
vulnerability VCID-cs1f-uhb2-xkcm
17
vulnerability VCID-dd87-gevs-juhe
18
vulnerability VCID-eeru-6pyc-8bcd
19
vulnerability VCID-ejgq-s79w-abd6
20
vulnerability VCID-g13k-qvy7-q3fk
21
vulnerability VCID-g2a6-uem4-uuce
22
vulnerability VCID-hh65-ycrj-d7gz
23
vulnerability VCID-hvua-jhzn-97fr
24
vulnerability VCID-k651-yq6k-cyc9
25
vulnerability VCID-k6aw-heeb-wke2
26
vulnerability VCID-kshz-ckjc-77ab
27
vulnerability VCID-m156-zkzd-57g9
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-p2yz-5pzq-nyag
37
vulnerability VCID-qth9-abgp-wyaq
38
vulnerability VCID-r6mr-ay8d-nqdd
39
vulnerability VCID-rnnm-ck7u-fydy
40
vulnerability VCID-sg9h-7dqr-xugu
41
vulnerability VCID-v2hk-dfbe-5khc
42
vulnerability VCID-v3u5-6bpb-qfgf
43
vulnerability VCID-v4sh-tkkf-xfeh
44
vulnerability VCID-vs1a-m7ya-rue8
45
vulnerability VCID-y13c-awe3-2bc1
46
vulnerability VCID-z16b-zfgu-13a9
47
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.0
aliases CVE-2014-0082, GHSA-7cgp-c3g7-qvrw, OSV-103440
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jpj6-wzp3-m3e4
26
url VCID-k6aw-heeb-wke2
vulnerability_id VCID-k6aw-heeb-wke2
summary 
ReDoS based DoS vulnerability in Action Dispatch
There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795.

Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1

Impact

A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious If-None-Match headers before they reach the application.

Users on Ruby 3.2.0 or greater are not affected by this vulnerability.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Avoid-regex-backtracking-on-If-None-Match-header.patch - Patch for 6.1 series
    7-0-Avoid-regex-backtracking-on-If-None-Match-header.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22795.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22795.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-22795
reference_id
reference_type
scores
0
value 0.01339
scoring_system epss
scoring_elements 0.80309
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-22795
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22942
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22942
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21831
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21831
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27777
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27777
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22792
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22792
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22794
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22794
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796
12
reference_url https://discuss.rubyonrails.org/t/cve-2023-22795-possible-redos-based-dos-vulnerability-in-action-dispatch/82118
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://discuss.rubyonrails.org/t/cve-2023-22795-possible-redos-based-dos-vulnerability-in-action-dispatch/82118
13
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
14
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
15
reference_url https://github.com/rails/rails/commit/8d82687f3b04b2803320b64f985308239a8c3d2f
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/8d82687f3b04b2803320b64f985308239a8c3d2f
16
reference_url https://github.com/rails/rails/commit/8dc45950619a4c64d16fb9370570c996d201f9b0
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/8dc45950619a4c64d16fb9370570c996d201f9b0
17
reference_url https://github.com/rails/rails/commit/cd461c3e64e09cdcb1e379d1c35423c5e2caa592
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/cd461c3e64e09cdcb1e379d1c35423c5e2caa592
18
reference_url https://github.com/rails/rails/releases/tag/v6.1.7.1
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v6.1.7.1
19
reference_url https://github.com/rails/rails/releases/tag/v7.0.4.1
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v7.0.4.1
20
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22795.yml
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22795.yml
21
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-22795
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-22795
22
reference_url https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
23
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1030050
reference_id 1030050
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1030050
24
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2164799
reference_id 2164799
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2164799
25
reference_url https://github.com/advisories/GHSA-8xww-x3g3-6jcv
reference_id GHSA-8xww-x3g3-6jcv
reference_type
scores
url https://github.com/advisories/GHSA-8xww-x3g3-6jcv
26
reference_url https://access.redhat.com/errata/RHSA-2023:6818
reference_id RHSA-2023:6818
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:6818
fixed_packages
0
url pkg:gem/actionpack@5.2.8
purl pkg:gem/actionpack@5.2.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-m9ud-s6w6-x7ac
5
vulnerability VCID-nmz3-ux68-dkfd
6
vulnerability VCID-qth9-abgp-wyaq
7
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.2.8
1
url pkg:gem/actionpack@6.1.7.1
purl pkg:gem/actionpack@6.1.7.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-b7z5-h1bw-tya9
2
vulnerability VCID-dd87-gevs-juhe
3
vulnerability VCID-eeru-6pyc-8bcd
4
vulnerability VCID-k6aw-heeb-wke2
5
vulnerability VCID-m9ud-s6w6-x7ac
6
vulnerability VCID-nmz3-ux68-dkfd
7
vulnerability VCID-qth9-abgp-wyaq
8
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.7.1
2
url pkg:gem/actionpack@7.0.4.1
purl pkg:gem/actionpack@7.0.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-b7z5-h1bw-tya9
2
vulnerability VCID-dd87-gevs-juhe
3
vulnerability VCID-eeru-6pyc-8bcd
4
vulnerability VCID-k6aw-heeb-wke2
5
vulnerability VCID-m9ud-s6w6-x7ac
6
vulnerability VCID-ndth-atqq-53gq
7
vulnerability VCID-nmz3-ux68-dkfd
8
vulnerability VCID-qth9-abgp-wyaq
9
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.4.1
aliases CVE-2023-22795, GHSA-8xww-x3g3-6jcv, GMS-2023-56
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-k6aw-heeb-wke2
27
url VCID-kshz-ckjc-77ab
vulnerability_id VCID-kshz-ckjc-77ab
summary tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-27777.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-27777.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-27777
reference_id
reference_type
scores
0
value 0.01409
scoring_system epss
scoring_elements 0.80797
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-27777
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22942
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22942
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44528
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21831
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21831
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27777
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27777
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22792
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22792
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22794
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22794
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796
12
reference_url https://discuss.rubyonrails.org/t/cve-2022-27777-possible-xss-vulnerability-in-action-view-tag-helpers/80534
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://discuss.rubyonrails.org/t/cve-2022-27777-possible-xss-vulnerability-in-action-view-tag-helpers/80534
13
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
14
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
15
reference_url https://github.com/rails/rails/commit/649516ce0feb699ae06a8c5e81df75d460cc9a85
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/649516ce0feb699ae06a8c5e81df75d460cc9a85
16
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2022-27777.yml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2022-27777.yml
17
reference_url https://groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw
18
reference_url https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
19
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-27777
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-27777
20
reference_url https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
21
reference_url https://www.debian.org/security/2023/dsa-5372
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2023/dsa-5372
22
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016982
reference_id 1016982
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016982
23
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2080296
reference_id 2080296
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2080296
24
reference_url https://github.com/advisories/GHSA-ch3h-j2vf-95pv
reference_id GHSA-ch3h-j2vf-95pv
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-ch3h-j2vf-95pv
25
reference_url https://access.redhat.com/errata/RHSA-2023:2097
reference_id RHSA-2023:2097
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:2097
fixed_packages
0
url pkg:gem/actionpack@5.2.7.1
purl pkg:gem/actionpack@5.2.7.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-m9ud-s6w6-x7ac
5
vulnerability VCID-nmz3-ux68-dkfd
6
vulnerability VCID-qth9-abgp-wyaq
7
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.2.7.1
1
url pkg:gem/actionpack@6.0.4.8
purl pkg:gem/actionpack@6.0.4.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-k6aw-heeb-wke2
4
vulnerability VCID-m9ud-s6w6-x7ac
5
vulnerability VCID-nmz3-ux68-dkfd
6
vulnerability VCID-qth9-abgp-wyaq
7
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.0.4.8
2
url pkg:gem/actionpack@6.1.5.1
purl pkg:gem/actionpack@6.1.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-b7z5-h1bw-tya9
2
vulnerability VCID-dd87-gevs-juhe
3
vulnerability VCID-eeru-6pyc-8bcd
4
vulnerability VCID-k6aw-heeb-wke2
5
vulnerability VCID-m9ud-s6w6-x7ac
6
vulnerability VCID-nmz3-ux68-dkfd
7
vulnerability VCID-qth9-abgp-wyaq
8
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.5.1
3
url pkg:gem/actionpack@7.0.2.4
purl pkg:gem/actionpack@7.0.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-b7z5-h1bw-tya9
2
vulnerability VCID-dd87-gevs-juhe
3
vulnerability VCID-eeru-6pyc-8bcd
4
vulnerability VCID-k6aw-heeb-wke2
5
vulnerability VCID-m9ud-s6w6-x7ac
6
vulnerability VCID-ndth-atqq-53gq
7
vulnerability VCID-nmz3-ux68-dkfd
8
vulnerability VCID-qth9-abgp-wyaq
9
vulnerability VCID-v2hk-dfbe-5khc
10
vulnerability VCID-z277-4dtj-zfbz
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.2.4
aliases CVE-2022-27777, GHSA-ch3h-j2vf-95pv, GMS-2022-1138
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kshz-ckjc-77ab
28
url VCID-m9ud-s6w6-x7ac
vulnerability_id VCID-m9ud-s6w6-x7ac
summary actionpack: Possible XSS via User Supplied Values to redirect_to
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28362.json
reference_id
reference_type
scores
0
value 4.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28362.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-28362
reference_id
reference_type
scores
0
value 0.00225
scoring_system epss
scoring_elements 0.45261
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-28362
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28362
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28362
3
reference_url https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3
scoring_elements
1
value 4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
2
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-09T21:26:42Z/
url https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132
4
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
5
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
6
reference_url https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-09T21:26:42Z/
url https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441
7
reference_url https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-09T21:26:42Z/
url https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5
8
reference_url https://github.com/rails/rails/commit/c9ab9b32bcdcfd8bcd55907f6c7b20b4e004cc23
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/c9ab9b32bcdcfd8bcd55907f6c7b20b4e004cc23
9
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-28362.yml
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-28362.yml
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-28362
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-28362
11
reference_url https://security.netapp.com/advisory/ntap-20250502-0009
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20250502-0009
12
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051058
reference_id 1051058
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051058
13
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2217785
reference_id 2217785
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2217785
14
reference_url https://github.com/advisories/GHSA-4g8v-vg43-wpgf
reference_id GHSA-4g8v-vg43-wpgf
reference_type
scores
0
value 4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-09T21:26:42Z/
url https://github.com/advisories/GHSA-4g8v-vg43-wpgf
15
reference_url https://access.redhat.com/errata/RHSA-2023:7851
reference_id RHSA-2023:7851
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:7851
fixed_packages
0
url pkg:gem/actionpack@6.1.7.4
purl pkg:gem/actionpack@6.1.7.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-b7z5-h1bw-tya9
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-nmz3-ux68-dkfd
4
vulnerability VCID-qth9-abgp-wyaq
5
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.7.4
1
url pkg:gem/actionpack@7.0.5.1
purl pkg:gem/actionpack@7.0.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-b7z5-h1bw-tya9
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-ndth-atqq-53gq
4
vulnerability VCID-nmz3-ux68-dkfd
5
vulnerability VCID-qth9-abgp-wyaq
6
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.5.1
aliases CVE-2023-28362, GHSA-4g8v-vg43-wpgf
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-m9ud-s6w6-x7ac
29
url VCID-mnh7-4rvx-suay
vulnerability_id VCID-mnh7-4rvx-suay
summary 
Action Pack contains database-query restrictions bypass
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain `[nil]` values, a related issue to CVE-2012-2694.
references
0
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
1
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
2
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
3
reference_url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
4
reference_url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
6
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-2660.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-2660.json
7
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-2660
reference_id
reference_type
scores
0
value 0.00159
scoring_system epss
scoring_elements 0.3656
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-2660
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://github.com/rails/rails/commit/61eed87ce32caf534bf1f52dd8134097b4ad9e1b
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/61eed87ce32caf534bf1f52dd8134097b4ad9e1b
10
reference_url https://github.com/rails/rails/commit/dff6db18840e2fd1dd3f3e4ef0ae7a9a3986d01d#diff-3179d24efacadd64068c4d9c1184eac3
reference_id
reference_type
scores
url https://github.com/rails/rails/commit/dff6db18840e2fd1dd3f3e4ef0ae7a9a3986d01d#diff-3179d24efacadd64068c4d9c1184eac3
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2660.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2660.yml
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2012-2660.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2012-2660.yml
13
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/OSVDB-82610.yml
reference_id
reference_type
scores
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/OSVDB-82610.yml
14
reference_url https://groups.google.com/forum/#!original/rubyonrails-security/8SA-M3as7A8/Mr9fi9X4kNgJ
reference_id
reference_type
scores
url https://groups.google.com/forum/#!original/rubyonrails-security/8SA-M3as7A8/Mr9fi9X4kNgJ
15
reference_url https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain
16
reference_url https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ
17
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-2660
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-2660
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=827353
reference_id 827353
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=827353
19
reference_url https://github.com/advisories/GHSA-hgpp-pp89-4fgf
reference_id GHSA-hgpp-pp89-4fgf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-hgpp-pp89-4fgf
20
reference_url https://access.redhat.com/errata/RHSA-2012:1542
reference_id RHSA-2012:1542
reference_type
scores
url https://access.redhat.com/errata/RHSA-2012:1542
21
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
fixed_packages
0
url pkg:gem/actionpack@3.0.13
purl pkg:gem/actionpack@3.0.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5pfg-7ntp-eff4
9
vulnerability VCID-5psk-hzaf-1kbz
10
vulnerability VCID-6z21-pd9d-pfgk
11
vulnerability VCID-8nkw-8mka-1ygk
12
vulnerability VCID-98gu-r7wd-cuah
13
vulnerability VCID-9gqn-8g4t-wfby
14
vulnerability VCID-a6wp-n5yh-ybcv
15
vulnerability VCID-b4sv-b9pz-r7er
16
vulnerability VCID-bfbp-7umh-2fcp
17
vulnerability VCID-cs1f-uhb2-xkcm
18
vulnerability VCID-dd87-gevs-juhe
19
vulnerability VCID-eeru-6pyc-8bcd
20
vulnerability VCID-ejgq-s79w-abd6
21
vulnerability VCID-g13k-qvy7-q3fk
22
vulnerability VCID-g2a6-uem4-uuce
23
vulnerability VCID-hh65-ycrj-d7gz
24
vulnerability VCID-jpj6-wzp3-m3e4
25
vulnerability VCID-k6aw-heeb-wke2
26
vulnerability VCID-kshz-ckjc-77ab
27
vulnerability VCID-m9ud-s6w6-x7ac
28
vulnerability VCID-mnh7-4rvx-suay
29
vulnerability VCID-n7ga-1sx4-yfcv
30
vulnerability VCID-n7kh-9mpq-13c7
31
vulnerability VCID-nax4-x97j-9fgr
32
vulnerability VCID-nmz3-ux68-dkfd
33
vulnerability VCID-nnka-c23v-qub7
34
vulnerability VCID-p1yd-keq8-rkh3
35
vulnerability VCID-qth9-abgp-wyaq
36
vulnerability VCID-r6mr-ay8d-nqdd
37
vulnerability VCID-rgw4-mrr9-euda
38
vulnerability VCID-sg9h-7dqr-xugu
39
vulnerability VCID-v2hk-dfbe-5khc
40
vulnerability VCID-v3u5-6bpb-qfgf
41
vulnerability VCID-vhjv-9864-tbcs
42
vulnerability VCID-vs1a-m7ya-rue8
43
vulnerability VCID-y13c-awe3-2bc1
44
vulnerability VCID-z16b-zfgu-13a9
45
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.13
1
url pkg:gem/actionpack@3.1.5
purl pkg:gem/actionpack@3.1.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5pfg-7ntp-eff4
9
vulnerability VCID-5psk-hzaf-1kbz
10
vulnerability VCID-6z21-pd9d-pfgk
11
vulnerability VCID-8nkw-8mka-1ygk
12
vulnerability VCID-98gu-r7wd-cuah
13
vulnerability VCID-9gqn-8g4t-wfby
14
vulnerability VCID-a6wp-n5yh-ybcv
15
vulnerability VCID-b4sv-b9pz-r7er
16
vulnerability VCID-bfbp-7umh-2fcp
17
vulnerability VCID-cs1f-uhb2-xkcm
18
vulnerability VCID-dd87-gevs-juhe
19
vulnerability VCID-eeru-6pyc-8bcd
20
vulnerability VCID-ejgq-s79w-abd6
21
vulnerability VCID-g13k-qvy7-q3fk
22
vulnerability VCID-g2a6-uem4-uuce
23
vulnerability VCID-hh65-ycrj-d7gz
24
vulnerability VCID-jpj6-wzp3-m3e4
25
vulnerability VCID-k6aw-heeb-wke2
26
vulnerability VCID-kshz-ckjc-77ab
27
vulnerability VCID-m9ud-s6w6-x7ac
28
vulnerability VCID-mnh7-4rvx-suay
29
vulnerability VCID-n7ga-1sx4-yfcv
30
vulnerability VCID-n7kh-9mpq-13c7
31
vulnerability VCID-nax4-x97j-9fgr
32
vulnerability VCID-nmz3-ux68-dkfd
33
vulnerability VCID-nnka-c23v-qub7
34
vulnerability VCID-p1yd-keq8-rkh3
35
vulnerability VCID-qth9-abgp-wyaq
36
vulnerability VCID-r6mr-ay8d-nqdd
37
vulnerability VCID-rgw4-mrr9-euda
38
vulnerability VCID-sg9h-7dqr-xugu
39
vulnerability VCID-v2hk-dfbe-5khc
40
vulnerability VCID-v3u5-6bpb-qfgf
41
vulnerability VCID-vhjv-9864-tbcs
42
vulnerability VCID-vs1a-m7ya-rue8
43
vulnerability VCID-y13c-awe3-2bc1
44
vulnerability VCID-z16b-zfgu-13a9
45
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.5
2
url pkg:gem/actionpack@3.2.4
purl pkg:gem/actionpack@3.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5pfg-7ntp-eff4
9
vulnerability VCID-5psk-hzaf-1kbz
10
vulnerability VCID-6z21-pd9d-pfgk
11
vulnerability VCID-832g-x9kb-3bbx
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-brwd-e9kx-xuc2
19
vulnerability VCID-cs1f-uhb2-xkcm
20
vulnerability VCID-dd87-gevs-juhe
21
vulnerability VCID-eeru-6pyc-8bcd
22
vulnerability VCID-ejgq-s79w-abd6
23
vulnerability VCID-g13k-qvy7-q3fk
24
vulnerability VCID-g2a6-uem4-uuce
25
vulnerability VCID-hh65-ycrj-d7gz
26
vulnerability VCID-jpj6-wzp3-m3e4
27
vulnerability VCID-k6aw-heeb-wke2
28
vulnerability VCID-kshz-ckjc-77ab
29
vulnerability VCID-m9ud-s6w6-x7ac
30
vulnerability VCID-mnh7-4rvx-suay
31
vulnerability VCID-n7ga-1sx4-yfcv
32
vulnerability VCID-n7kh-9mpq-13c7
33
vulnerability VCID-nax4-x97j-9fgr
34
vulnerability VCID-nmz3-ux68-dkfd
35
vulnerability VCID-nnka-c23v-qub7
36
vulnerability VCID-p1yd-keq8-rkh3
37
vulnerability VCID-qth9-abgp-wyaq
38
vulnerability VCID-r6mr-ay8d-nqdd
39
vulnerability VCID-rgw4-mrr9-euda
40
vulnerability VCID-sg9h-7dqr-xugu
41
vulnerability VCID-v2hk-dfbe-5khc
42
vulnerability VCID-v3u5-6bpb-qfgf
43
vulnerability VCID-vhjv-9864-tbcs
44
vulnerability VCID-vs1a-m7ya-rue8
45
vulnerability VCID-y13c-awe3-2bc1
46
vulnerability VCID-z16b-zfgu-13a9
47
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.4
aliases CVE-2012-2660, GHSA-hgpp-pp89-4fgf, OSV-82610
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mnh7-4rvx-suay
30
url VCID-n7ga-1sx4-yfcv
vulnerability_id VCID-n7ga-1sx4-yfcv
summary rubygem-actionpack: Possible Open Redirect Vulnerability in Action Pack
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-22903.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-22903.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-22903
reference_id
reference_type
scores
0
value 0.00096
scoring_system epss
scoring_elements 0.2653
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-22903
2
reference_url https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/rails/rails/releases/tag/v6.1.3.2
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v6.1.3.2
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22903.yml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22903.yml
6
reference_url https://groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0
7
reference_url https://hackerone.com/reports/1148025
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://hackerone.com/reports/1148025
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-22903
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-22903
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1957438
reference_id 1957438
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1957438
10
reference_url https://security.archlinux.org/AVG-1919
reference_id AVG-1919
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-1919
fixed_packages
0
url pkg:gem/actionpack@6.1.3.2
purl pkg:gem/actionpack@6.1.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-b7z5-h1bw-tya9
2
vulnerability VCID-be5x-uyc6-sudm
3
vulnerability VCID-dd87-gevs-juhe
4
vulnerability VCID-eeru-6pyc-8bcd
5
vulnerability VCID-fdqs-v9b2-53gu
6
vulnerability VCID-fgtd-zx7r-rygb
7
vulnerability VCID-k6aw-heeb-wke2
8
vulnerability VCID-kshz-ckjc-77ab
9
vulnerability VCID-m9ud-s6w6-x7ac
10
vulnerability VCID-nmz3-ux68-dkfd
11
vulnerability VCID-qth9-abgp-wyaq
12
vulnerability VCID-re7g-rxbm-dbd9
13
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.3.2
aliases CVE-2021-22903, GHSA-5hq2-xf89-9jxq
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n7ga-1sx4-yfcv
31
url VCID-n7kh-9mpq-13c7
vulnerability_id VCID-n7kh-9mpq-13c7
summary 
Cross site scripting that affects rails
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.
references
0
reference_url http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
1
reference_url http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source
2
reference_url http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
3
reference_url http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3009.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3009.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2009-3009
reference_id
reference_type
scores
0
value 0.01632
scoring_system epss
scoring_elements 0.8221
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2009-3009
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3009
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3009
7
reference_url http://secunia.com/advisories/36600
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://secunia.com/advisories/36600
8
reference_url http://secunia.com/advisories/36717
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://secunia.com/advisories/36717
9
reference_url http://securitytracker.com/id?1022824
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://securitytracker.com/id?1022824
10
reference_url https://exchange.xforce.ibmcloud.com/vulnerabilities/53036
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://exchange.xforce.ibmcloud.com/vulnerabilities/53036
11
reference_url https://github.com/advisories/GHSA-8qrh-h9m2-5fvf
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-8qrh-h9m2-5fvf
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2009-3009.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2009-3009.yml
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2009-3009
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2009-3009
14
reference_url http://support.apple.com/kb/HT4077
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://support.apple.com/kb/HT4077
15
reference_url http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails
16
reference_url http://www.debian.org/security/2009/dsa-1887
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2009/dsa-1887
17
reference_url http://www.osvdb.org/57666
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.osvdb.org/57666
18
reference_url http://www.securityfocus.com/bid/36278
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/36278
19
reference_url http://www.vupen.com/english/advisories/2009/2544
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.vupen.com/english/advisories/2009/2544
20
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=520843
reference_id 520843
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=520843
21
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
reference_id 545063
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
22
reference_url https://security.gentoo.org/glsa/200912-02
reference_id GLSA-200912-02
reference_type
scores
url https://security.gentoo.org/glsa/200912-02
fixed_packages
aliases CVE-2009-3009, GHSA-8qrh-h9m2-5fvf, OSV-57666
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n7kh-9mpq-13c7
32
url VCID-nax4-x97j-9fgr
vulnerability_id VCID-nax4-x97j-9fgr
summary 
actionpack Improper Input Validation vulnerability
`actionpack/lib/action_view/lookup_context.rb` in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
1
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
2
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
3
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
4
reference_url http://rhn.redhat.com/errata/RHSA-2013-1794.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-1794.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2014-0008.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0008.html
6
reference_url http://rhn.redhat.com/errata/RHSA-2014-1863.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-1863.html
7
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6414.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6414.json
8
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-6414
reference_id
reference_type
scores
0
value 0.70843
scoring_system epss
scoring_elements 0.98724
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-6414
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
14
reference_url http://seclists.org/oss-sec/2013/q4/400
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/400
15
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
16
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6414.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6414.yml
17
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/A-ebV4WxzKg/KNPTbX8XAQUJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/A-ebV4WxzKg/KNPTbX8XAQUJ
18
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/A-ebV4WxzKg
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/A-ebV4WxzKg
19
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-6414
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-6414
20
reference_url https://puppet.com/security/cve/cve-2013-6414
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://puppet.com/security/cve/cve-2013-6414
21
reference_url https://web.archive.org/web/20160421165124/http://secunia.com/advisories/57836
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160421165124/http://secunia.com/advisories/57836
22
reference_url https://web.archive.org/web/20160808161629/https://puppet.com/security/cve/cve-2013-6414
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160808161629/https://puppet.com/security/cve/cve-2013-6414
23
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
24
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
25
reference_url http://www.debian.org/security/2014/dsa-2888
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2014/dsa-2888
26
reference_url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release
27
reference_url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
reference_id
reference_type
scores
url http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
28
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036483
reference_id 1036483
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036483
29
reference_url https://github.com/advisories/GHSA-mpxf-gcw2-pw5q
reference_id GHSA-mpxf-gcw2-pw5q
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mpxf-gcw2-pw5q
30
reference_url https://access.redhat.com/errata/RHSA-2013:1794
reference_id RHSA-2013:1794
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:1794
31
reference_url https://access.redhat.com/errata/RHSA-2014:0008
reference_id RHSA-2014:0008
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0008
fixed_packages
0
url pkg:gem/actionpack@3.2.16
purl pkg:gem/actionpack@3.2.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-832g-x9kb-3bbx
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-dd87-gevs-juhe
14
vulnerability VCID-eeru-6pyc-8bcd
15
vulnerability VCID-ejgq-s79w-abd6
16
vulnerability VCID-g13k-qvy7-q3fk
17
vulnerability VCID-g2a6-uem4-uuce
18
vulnerability VCID-hh65-ycrj-d7gz
19
vulnerability VCID-jpj6-wzp3-m3e4
20
vulnerability VCID-k6aw-heeb-wke2
21
vulnerability VCID-kshz-ckjc-77ab
22
vulnerability VCID-m9ud-s6w6-x7ac
23
vulnerability VCID-mnh7-4rvx-suay
24
vulnerability VCID-n7ga-1sx4-yfcv
25
vulnerability VCID-n7kh-9mpq-13c7
26
vulnerability VCID-nmz3-ux68-dkfd
27
vulnerability VCID-p1yd-keq8-rkh3
28
vulnerability VCID-qth9-abgp-wyaq
29
vulnerability VCID-r6mr-ay8d-nqdd
30
vulnerability VCID-sg9h-7dqr-xugu
31
vulnerability VCID-v2hk-dfbe-5khc
32
vulnerability VCID-v3u5-6bpb-qfgf
33
vulnerability VCID-vs1a-m7ya-rue8
34
vulnerability VCID-y13c-awe3-2bc1
35
vulnerability VCID-z16b-zfgu-13a9
36
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.16
1
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-hh65-ycrj-d7gz
17
vulnerability VCID-k6aw-heeb-wke2
18
vulnerability VCID-kshz-ckjc-77ab
19
vulnerability VCID-m156-zkzd-57g9
20
vulnerability VCID-m9ud-s6w6-x7ac
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7ga-1sx4-yfcv
23
vulnerability VCID-n7kh-9mpq-13c7
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-p1yd-keq8-rkh3
26
vulnerability VCID-qth9-abgp-wyaq
27
vulnerability VCID-r6mr-ay8d-nqdd
28
vulnerability VCID-sg9h-7dqr-xugu
29
vulnerability VCID-v2hk-dfbe-5khc
30
vulnerability VCID-v3u5-6bpb-qfgf
31
vulnerability VCID-vs1a-m7ya-rue8
32
vulnerability VCID-y13c-awe3-2bc1
33
vulnerability VCID-z16b-zfgu-13a9
34
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-6414, GHSA-mpxf-gcw2-pw5q, OSV-100525
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nax4-x97j-9fgr
33
url VCID-nmz3-ux68-dkfd
vulnerability_id VCID-nmz3-ux68-dkfd
summary Rails: Action Pack: Action Pack: Cross-Site Scripting (XSS) via improper exception message escaping
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33167.json
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33167.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-33167
reference_id
reference_type
scores
0
value 0.00021
scoring_system epss
scoring_elements 0.06147
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-33167
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
4
reference_url https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T18:44:05Z/
url https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0
5
reference_url https://github.com/rails/rails/releases/tag/v8.1.2.1
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T18:44:05Z/
url https://github.com/rails/rails/releases/tag/v8.1.2.1
6
reference_url https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T18:44:05Z/
url https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
7
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2026-33167.yml
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2026-33167.yml
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-33167
reference_id
reference_type
scores
0
value 1.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-33167
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2450552
reference_id 2450552
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2450552
fixed_packages
0
url pkg:gem/actionpack@8.1.2.1
purl pkg:gem/actionpack@8.1.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@8.1.2.1
aliases CVE-2026-33167, GHSA-pgm4-439c-5jp6
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nmz3-ux68-dkfd
34
url VCID-nnka-c23v-qub7
vulnerability_id VCID-nnka-c23v-qub7
summary 
actionpack vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the `number_to_currency` helper in `actionpack/lib/action_view/helpers/number_helper.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
1
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00080.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00080.html
2
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
3
reference_url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
4
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
5
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
6
reference_url http://rhn.redhat.com/errata/RHSA-2013-1794.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-1794.html
7
reference_url http://rhn.redhat.com/errata/RHSA-2014-0008.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0008.html
8
reference_url http://rhn.redhat.com/errata/RHSA-2014-1863.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-1863.html
9
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6415.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6415.json
10
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-6415
reference_id
reference_type
scores
0
value 0.01506
scoring_system epss
scoring_elements 0.8147
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-6415
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4389
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4491
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6414
14
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6415
15
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6417
16
reference_url http://seclists.org/oss-sec/2013/q4/402
reference_id
reference_type
scores
url http://seclists.org/oss-sec/2013/q4/402
17
reference_url https://github.com/advisories/GHSA-6h5q-96hp-9jgm
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-6h5q-96hp-9jgm
18
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6415.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6415.yml
19
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ
20
reference_url https://groups.google.com/forum/#!topic/ruby-security-ann/9WiRn2nhfq0
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/ruby-security-ann/9WiRn2nhfq0
21
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-6415
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-6415
22
reference_url https://puppet.com/security/cve/cve-2013-6415
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://puppet.com/security/cve/cve-2013-6415
23
reference_url https://web.archive.org/web/20131206180005/http://www.securityfocus.com/bid/64077
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20131206180005/http://www.securityfocus.com/bid/64077
24
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
25
reference_url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
26
reference_url http://www.debian.org/security/2014/dsa-2888
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2014/dsa-2888
27
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1036910
reference_id 1036910
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1036910
28
reference_url https://access.redhat.com/errata/RHSA-2013:1794
reference_id RHSA-2013:1794
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:1794
29
reference_url https://access.redhat.com/errata/RHSA-2014:0008
reference_id RHSA-2014:0008
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0008
fixed_packages
0
url pkg:gem/actionpack@3.2.16
purl pkg:gem/actionpack@3.2.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-832g-x9kb-3bbx
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-dd87-gevs-juhe
14
vulnerability VCID-eeru-6pyc-8bcd
15
vulnerability VCID-ejgq-s79w-abd6
16
vulnerability VCID-g13k-qvy7-q3fk
17
vulnerability VCID-g2a6-uem4-uuce
18
vulnerability VCID-hh65-ycrj-d7gz
19
vulnerability VCID-jpj6-wzp3-m3e4
20
vulnerability VCID-k6aw-heeb-wke2
21
vulnerability VCID-kshz-ckjc-77ab
22
vulnerability VCID-m9ud-s6w6-x7ac
23
vulnerability VCID-mnh7-4rvx-suay
24
vulnerability VCID-n7ga-1sx4-yfcv
25
vulnerability VCID-n7kh-9mpq-13c7
26
vulnerability VCID-nmz3-ux68-dkfd
27
vulnerability VCID-p1yd-keq8-rkh3
28
vulnerability VCID-qth9-abgp-wyaq
29
vulnerability VCID-r6mr-ay8d-nqdd
30
vulnerability VCID-sg9h-7dqr-xugu
31
vulnerability VCID-v2hk-dfbe-5khc
32
vulnerability VCID-v3u5-6bpb-qfgf
33
vulnerability VCID-vs1a-m7ya-rue8
34
vulnerability VCID-y13c-awe3-2bc1
35
vulnerability VCID-z16b-zfgu-13a9
36
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.16
1
url pkg:gem/actionpack@4.0.2
purl pkg:gem/actionpack@4.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-hh65-ycrj-d7gz
17
vulnerability VCID-k6aw-heeb-wke2
18
vulnerability VCID-kshz-ckjc-77ab
19
vulnerability VCID-m156-zkzd-57g9
20
vulnerability VCID-m9ud-s6w6-x7ac
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7ga-1sx4-yfcv
23
vulnerability VCID-n7kh-9mpq-13c7
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-p1yd-keq8-rkh3
26
vulnerability VCID-qth9-abgp-wyaq
27
vulnerability VCID-r6mr-ay8d-nqdd
28
vulnerability VCID-sg9h-7dqr-xugu
29
vulnerability VCID-v2hk-dfbe-5khc
30
vulnerability VCID-v3u5-6bpb-qfgf
31
vulnerability VCID-vs1a-m7ya-rue8
32
vulnerability VCID-y13c-awe3-2bc1
33
vulnerability VCID-z16b-zfgu-13a9
34
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.2
aliases CVE-2013-6415, GHSA-6h5q-96hp-9jgm, OSV-100524
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nnka-c23v-qub7
35
url VCID-p1yd-keq8-rkh3
vulnerability_id VCID-p1yd-keq8-rkh3
summary 
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the `strip_tags` helper in `actionpack/lib/action_controller/vendor/html-scanner/html/node.rb` in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/fd41ab62966e0fd1?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/fd41ab62966e0fd1?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065137.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065137.html
3
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-2931
reference_id
reference_type
scores
0
value 0.00813
scoring_system epss
scoring_elements 0.7456
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-2931
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=731436
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=731436
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2931
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2931
7
reference_url http://secunia.com/advisories/45921
reference_id
reference_type
scores
url http://secunia.com/advisories/45921
8
reference_url https://github.com/advisories/GHSA-v5jg-558j-q67c
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-v5jg-558j-q67c
9
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
10
reference_url https://github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037a
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037a
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-2931.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-2931.yml
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-2931
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-2931
13
reference_url http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
14
reference_url http://www.debian.org/security/2011/dsa-2301
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2011/dsa-2301
15
reference_url http://www.openwall.com/lists/oss-security/2011/08/17/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/17/1
16
reference_url http://www.openwall.com/lists/oss-security/2011/08/19/11
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/19/11
17
reference_url http://www.openwall.com/lists/oss-security/2011/08/20/1
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/20/1
18
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/13
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/13
19
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/14
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/14
20
reference_url http://www.openwall.com/lists/oss-security/2011/08/22/5
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2011/08/22/5
21
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
0
url pkg:gem/actionpack@3.0.10
purl pkg:gem/actionpack@3.0.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.10
aliases CVE-2011-2931, GHSA-v5jg-558j-q67c
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p1yd-keq8-rkh3
36
url VCID-qth9-abgp-wyaq
vulnerability_id VCID-qth9-abgp-wyaq
summary 
Possible Content Security Policy bypass in Action Dispatch
There is a possible Cross Site Scripting (XSS) vulnerability  in the `content_security_policy` helper in Action Pack.

Impact
------
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits
-------
Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-54133.json
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-54133.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-54133
reference_id
reference_type
scores
0
value 0.0019
scoring_system epss
scoring_elements 0.40653
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-54133
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54133
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54133
3
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
4
reference_url https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/
url https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49
5
reference_url https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/
url https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a
6
reference_url https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/
url https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542
7
reference_url https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/
url https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d
8
reference_url https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/
url https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v
9
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-54133.yml
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-54133.yml
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-54133
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-54133
11
reference_url https://security.netapp.com/advisory/ntap-20250306-0010
reference_id
reference_type
scores
0
value 2.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20250306-0010
12
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089755
reference_id 1089755
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089755
13
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2331619
reference_id 2331619
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2331619
fixed_packages
0
url pkg:gem/actionpack@7.0.8.7
purl pkg:gem/actionpack@7.0.8.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.8.7
1
url pkg:gem/actionpack@7.1.5.1
purl pkg:gem/actionpack@7.1.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.1.5.1
2
url pkg:gem/actionpack@7.2.2.1
purl pkg:gem/actionpack@7.2.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.2.2.1
3
url pkg:gem/actionpack@8.0.0.1
purl pkg:gem/actionpack@8.0.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nmz3-ux68-dkfd
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@8.0.0.1
aliases CVE-2024-54133, GHSA-vfm5-rmrh-j26v
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qth9-abgp-wyaq
37
url VCID-r6mr-ay8d-nqdd
vulnerability_id VCID-r6mr-ay8d-nqdd
summary 
actionpack is vulnerable to denial of service via a crafted HTTP Accept header
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
references
0
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
2
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
3
reference_url http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
4
reference_url http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
5
reference_url http://rhn.redhat.com/errata/RHSA-2016-0296.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-0296.html
6
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0751.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0751.json
7
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-0751
reference_id
reference_type
scores
0
value 0.08895
scoring_system epss
scoring_elements 0.92689
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-0751
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3226
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3226
9
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3227
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3227
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7576
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7576
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7577
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7577
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7581
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7581
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0751
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0751
14
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0752
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0752
15
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0753
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0753
16
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:N/C:N/I:N/A:P
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
17
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
18
reference_url https://github.com/rails/rails/commit/127967b735813cd4f263df7a50426d74e7e9cc17
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/127967b735813cd4f263df7a50426d74e7e9cc17
19
reference_url https://github.com/rails/rails/commit/221937c8ba1d291430ceddebbd4bdef7d3cb47d6
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/221937c8ba1d291430ceddebbd4bdef7d3cb47d6
20
reference_url https://github.com/rails/rails/commit/37047b779a177b911c7161052cfc34a30e1db0af
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/37047b779a177b911c7161052cfc34a30e1db0af
21
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0751.yml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0751.yml
22
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9oLY_FCzvoc/5CDXbvpYEgAJ
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9oLY_FCzvoc/5CDXbvpYEgAJ
23
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc
24
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-0751
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-0751
25
reference_url https://web.archive.org/web/20160128201702/http://www.securitytracker.com/id/1034816
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160128201702/http://www.securitytracker.com/id/1034816
26
reference_url https://web.archive.org/web/20200227181647/http://www.securityfocus.com/bid/81800
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200227181647/http://www.securityfocus.com/bid/81800
27
reference_url http://www.debian.org/security/2016/dsa-3464
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2016/dsa-3464
28
reference_url http://www.openwall.com/lists/oss-security/2016/01/25/9
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2016/01/25/9
29
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1301946
reference_id 1301946
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1301946
30
reference_url https://github.com/advisories/GHSA-ffpv-c4hm-3x6v
reference_id GHSA-ffpv-c4hm-3x6v
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-ffpv-c4hm-3x6v
31
reference_url https://access.redhat.com/errata/RHSA-2016:0296
reference_id RHSA-2016:0296
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0296
32
reference_url https://access.redhat.com/errata/RHSA-2016:0454
reference_id RHSA-2016:0454
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0454
33
reference_url https://access.redhat.com/errata/RHSA-2016:0455
reference_id RHSA-2016:0455
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0455
fixed_packages
0
url pkg:gem/actionpack@3.2.22.1
purl pkg:gem/actionpack@3.2.22.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-832g-x9kb-3bbx
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-b4sv-b9pz-r7er
10
vulnerability VCID-bfbp-7umh-2fcp
11
vulnerability VCID-brwd-e9kx-xuc2
12
vulnerability VCID-dd87-gevs-juhe
13
vulnerability VCID-eeru-6pyc-8bcd
14
vulnerability VCID-ejgq-s79w-abd6
15
vulnerability VCID-g13k-qvy7-q3fk
16
vulnerability VCID-g2a6-uem4-uuce
17
vulnerability VCID-k6aw-heeb-wke2
18
vulnerability VCID-kshz-ckjc-77ab
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-v2hk-dfbe-5khc
27
vulnerability VCID-v4sh-tkkf-xfeh
28
vulnerability VCID-z16b-zfgu-13a9
29
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.22.1
1
url pkg:gem/actionpack@4.1.14.1
purl pkg:gem/actionpack@4.1.14.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-832g-x9kb-3bbx
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m9ud-s6w6-x7ac
19
vulnerability VCID-mnh7-4rvx-suay
20
vulnerability VCID-n7ga-1sx4-yfcv
21
vulnerability VCID-n7kh-9mpq-13c7
22
vulnerability VCID-nmz3-ux68-dkfd
23
vulnerability VCID-p1yd-keq8-rkh3
24
vulnerability VCID-qth9-abgp-wyaq
25
vulnerability VCID-v2hk-dfbe-5khc
26
vulnerability VCID-v4sh-tkkf-xfeh
27
vulnerability VCID-z16b-zfgu-13a9
28
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.14.1
2
url pkg:gem/actionpack@4.2.5.1
purl pkg:gem/actionpack@4.2.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-a6wp-n5yh-ybcv
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-kshz-ckjc-77ab
17
vulnerability VCID-m9ud-s6w6-x7ac
18
vulnerability VCID-mnh7-4rvx-suay
19
vulnerability VCID-n7ga-1sx4-yfcv
20
vulnerability VCID-n7kh-9mpq-13c7
21
vulnerability VCID-nmz3-ux68-dkfd
22
vulnerability VCID-p1yd-keq8-rkh3
23
vulnerability VCID-qth9-abgp-wyaq
24
vulnerability VCID-v2hk-dfbe-5khc
25
vulnerability VCID-v4sh-tkkf-xfeh
26
vulnerability VCID-z16b-zfgu-13a9
27
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.5.1
3
url pkg:gem/actionpack@5.0.0.beta1.1
purl pkg:gem/actionpack@5.0.0.beta1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-a6wp-n5yh-ybcv
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-dd87-gevs-juhe
10
vulnerability VCID-eeru-6pyc-8bcd
11
vulnerability VCID-ejgq-s79w-abd6
12
vulnerability VCID-g13k-qvy7-q3fk
13
vulnerability VCID-g2a6-uem4-uuce
14
vulnerability VCID-k6aw-heeb-wke2
15
vulnerability VCID-kshz-ckjc-77ab
16
vulnerability VCID-m9ud-s6w6-x7ac
17
vulnerability VCID-mnh7-4rvx-suay
18
vulnerability VCID-n7ga-1sx4-yfcv
19
vulnerability VCID-n7kh-9mpq-13c7
20
vulnerability VCID-nmz3-ux68-dkfd
21
vulnerability VCID-p1yd-keq8-rkh3
22
vulnerability VCID-qth9-abgp-wyaq
23
vulnerability VCID-v2hk-dfbe-5khc
24
vulnerability VCID-z16b-zfgu-13a9
25
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.0.0.beta1.1
aliases CVE-2016-0751, GHSA-ffpv-c4hm-3x6v
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-r6mr-ay8d-nqdd
38
url VCID-rgw4-mrr9-euda
vulnerability_id VCID-rgw4-mrr9-euda
summary 
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/sanitize_helper.rb` in the `strip_tags` helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.
references
0
reference_url http://rhn.redhat.com/errata/RHSA-2013-0154.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0154.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3465.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3465.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-3465
reference_id
reference_type
scores
0
value 0.00333
scoring_system epss
scoring_elements 0.56331
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-3465
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3465
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3465
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rails/rails/commit/cf48c9c7dcbef8543171f7f7de8d3d9a16b58e77
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/cf48c9c7dcbef8543171f7f7de8d3d9a16b58e77
6
reference_url https://github.com/rails/rails/commit/e91e4e8bbee12ce1496bf384c04da6be296b687a
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/e91e4e8bbee12ce1496bf384c04da6be296b687a
7
reference_url https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-3465
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-3465
9
reference_url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=847200
reference_id 847200
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=847200
11
reference_url https://github.com/advisories/GHSA-7g65-ghrg-hpf5
reference_id GHSA-7g65-ghrg-hpf5
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7g65-ghrg-hpf5
12
reference_url https://access.redhat.com/errata/RHSA-2012:1542
reference_id RHSA-2012:1542
reference_type
scores
url https://access.redhat.com/errata/RHSA-2012:1542
13
reference_url https://access.redhat.com/errata/RHSA-2013:0154
reference_id RHSA-2013:0154
reference_type
scores
url https://access.redhat.com/errata/RHSA-2013:0154
fixed_packages
0
url pkg:gem/actionpack@3.0.17
purl pkg:gem/actionpack@3.0.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5pfg-7ntp-eff4
7
vulnerability VCID-5psk-hzaf-1kbz
8
vulnerability VCID-6z21-pd9d-pfgk
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-cs1f-uhb2-xkcm
16
vulnerability VCID-dd87-gevs-juhe
17
vulnerability VCID-eeru-6pyc-8bcd
18
vulnerability VCID-ejgq-s79w-abd6
19
vulnerability VCID-g13k-qvy7-q3fk
20
vulnerability VCID-g2a6-uem4-uuce
21
vulnerability VCID-hh65-ycrj-d7gz
22
vulnerability VCID-jpj6-wzp3-m3e4
23
vulnerability VCID-k6aw-heeb-wke2
24
vulnerability VCID-kshz-ckjc-77ab
25
vulnerability VCID-m9ud-s6w6-x7ac
26
vulnerability VCID-mnh7-4rvx-suay
27
vulnerability VCID-n7ga-1sx4-yfcv
28
vulnerability VCID-n7kh-9mpq-13c7
29
vulnerability VCID-nax4-x97j-9fgr
30
vulnerability VCID-nmz3-ux68-dkfd
31
vulnerability VCID-nnka-c23v-qub7
32
vulnerability VCID-p1yd-keq8-rkh3
33
vulnerability VCID-qth9-abgp-wyaq
34
vulnerability VCID-r6mr-ay8d-nqdd
35
vulnerability VCID-sg9h-7dqr-xugu
36
vulnerability VCID-v2hk-dfbe-5khc
37
vulnerability VCID-v3u5-6bpb-qfgf
38
vulnerability VCID-vhjv-9864-tbcs
39
vulnerability VCID-vs1a-m7ya-rue8
40
vulnerability VCID-y13c-awe3-2bc1
41
vulnerability VCID-z16b-zfgu-13a9
42
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.17
1
url pkg:gem/actionpack@3.1.0.beta1
purl pkg:gem/actionpack@3.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-g13k-qvy7-q3fk
23
vulnerability VCID-g2a6-uem4-uuce
24
vulnerability VCID-hh65-ycrj-d7gz
25
vulnerability VCID-jpj6-wzp3-m3e4
26
vulnerability VCID-k6aw-heeb-wke2
27
vulnerability VCID-kshz-ckjc-77ab
28
vulnerability VCID-m9ud-s6w6-x7ac
29
vulnerability VCID-mnh7-4rvx-suay
30
vulnerability VCID-n7ga-1sx4-yfcv
31
vulnerability VCID-n7kh-9mpq-13c7
32
vulnerability VCID-nax4-x97j-9fgr
33
vulnerability VCID-nmz3-ux68-dkfd
34
vulnerability VCID-nnka-c23v-qub7
35
vulnerability VCID-p1yd-keq8-rkh3
36
vulnerability VCID-qth9-abgp-wyaq
37
vulnerability VCID-r6mr-ay8d-nqdd
38
vulnerability VCID-rgw4-mrr9-euda
39
vulnerability VCID-sg9h-7dqr-xugu
40
vulnerability VCID-v2hk-dfbe-5khc
41
vulnerability VCID-v3u5-6bpb-qfgf
42
vulnerability VCID-vhjv-9864-tbcs
43
vulnerability VCID-vs1a-m7ya-rue8
44
vulnerability VCID-y13c-awe3-2bc1
45
vulnerability VCID-z16b-zfgu-13a9
46
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.0.beta1
2
url pkg:gem/actionpack@3.1.8
purl pkg:gem/actionpack@3.1.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5pfg-7ntp-eff4
7
vulnerability VCID-5psk-hzaf-1kbz
8
vulnerability VCID-6z21-pd9d-pfgk
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-cs1f-uhb2-xkcm
16
vulnerability VCID-dd87-gevs-juhe
17
vulnerability VCID-eeru-6pyc-8bcd
18
vulnerability VCID-ejgq-s79w-abd6
19
vulnerability VCID-g13k-qvy7-q3fk
20
vulnerability VCID-g2a6-uem4-uuce
21
vulnerability VCID-hh65-ycrj-d7gz
22
vulnerability VCID-jpj6-wzp3-m3e4
23
vulnerability VCID-k6aw-heeb-wke2
24
vulnerability VCID-kshz-ckjc-77ab
25
vulnerability VCID-m9ud-s6w6-x7ac
26
vulnerability VCID-mnh7-4rvx-suay
27
vulnerability VCID-n7ga-1sx4-yfcv
28
vulnerability VCID-n7kh-9mpq-13c7
29
vulnerability VCID-nax4-x97j-9fgr
30
vulnerability VCID-nmz3-ux68-dkfd
31
vulnerability VCID-nnka-c23v-qub7
32
vulnerability VCID-p1yd-keq8-rkh3
33
vulnerability VCID-qth9-abgp-wyaq
34
vulnerability VCID-r6mr-ay8d-nqdd
35
vulnerability VCID-sg9h-7dqr-xugu
36
vulnerability VCID-v2hk-dfbe-5khc
37
vulnerability VCID-v3u5-6bpb-qfgf
38
vulnerability VCID-vhjv-9864-tbcs
39
vulnerability VCID-vs1a-m7ya-rue8
40
vulnerability VCID-y13c-awe3-2bc1
41
vulnerability VCID-z16b-zfgu-13a9
42
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.8
3
url pkg:gem/actionpack@3.2.0.rc1
purl pkg:gem/actionpack@3.2.0.rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-832g-x9kb-3bbx
13
vulnerability VCID-8nkw-8mka-1ygk
14
vulnerability VCID-98gu-r7wd-cuah
15
vulnerability VCID-9gqn-8g4t-wfby
16
vulnerability VCID-a6wp-n5yh-ybcv
17
vulnerability VCID-b4sv-b9pz-r7er
18
vulnerability VCID-bfbp-7umh-2fcp
19
vulnerability VCID-brwd-e9kx-xuc2
20
vulnerability VCID-cs1f-uhb2-xkcm
21
vulnerability VCID-dd87-gevs-juhe
22
vulnerability VCID-eeru-6pyc-8bcd
23
vulnerability VCID-ejgq-s79w-abd6
24
vulnerability VCID-g13k-qvy7-q3fk
25
vulnerability VCID-g2a6-uem4-uuce
26
vulnerability VCID-hh65-ycrj-d7gz
27
vulnerability VCID-jpj6-wzp3-m3e4
28
vulnerability VCID-k6aw-heeb-wke2
29
vulnerability VCID-kshz-ckjc-77ab
30
vulnerability VCID-m9ud-s6w6-x7ac
31
vulnerability VCID-mnh7-4rvx-suay
32
vulnerability VCID-n7ga-1sx4-yfcv
33
vulnerability VCID-n7kh-9mpq-13c7
34
vulnerability VCID-nax4-x97j-9fgr
35
vulnerability VCID-nmz3-ux68-dkfd
36
vulnerability VCID-nnka-c23v-qub7
37
vulnerability VCID-p1yd-keq8-rkh3
38
vulnerability VCID-qth9-abgp-wyaq
39
vulnerability VCID-r6mr-ay8d-nqdd
40
vulnerability VCID-rgw4-mrr9-euda
41
vulnerability VCID-sg9h-7dqr-xugu
42
vulnerability VCID-v2hk-dfbe-5khc
43
vulnerability VCID-v3u5-6bpb-qfgf
44
vulnerability VCID-vhjv-9864-tbcs
45
vulnerability VCID-vs1a-m7ya-rue8
46
vulnerability VCID-y13c-awe3-2bc1
47
vulnerability VCID-z16b-zfgu-13a9
48
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.0.rc1
4
url pkg:gem/actionpack@3.2.8
purl pkg:gem/actionpack@3.2.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-58sa-6uag-z7hp
6
vulnerability VCID-5pfg-7ntp-eff4
7
vulnerability VCID-5psk-hzaf-1kbz
8
vulnerability VCID-6z21-pd9d-pfgk
9
vulnerability VCID-832g-x9kb-3bbx
10
vulnerability VCID-8nkw-8mka-1ygk
11
vulnerability VCID-98gu-r7wd-cuah
12
vulnerability VCID-9gqn-8g4t-wfby
13
vulnerability VCID-a6wp-n5yh-ybcv
14
vulnerability VCID-b4sv-b9pz-r7er
15
vulnerability VCID-bfbp-7umh-2fcp
16
vulnerability VCID-brwd-e9kx-xuc2
17
vulnerability VCID-cs1f-uhb2-xkcm
18
vulnerability VCID-dd87-gevs-juhe
19
vulnerability VCID-eeru-6pyc-8bcd
20
vulnerability VCID-ejgq-s79w-abd6
21
vulnerability VCID-g13k-qvy7-q3fk
22
vulnerability VCID-g2a6-uem4-uuce
23
vulnerability VCID-hh65-ycrj-d7gz
24
vulnerability VCID-jpj6-wzp3-m3e4
25
vulnerability VCID-k6aw-heeb-wke2
26
vulnerability VCID-kshz-ckjc-77ab
27
vulnerability VCID-m9ud-s6w6-x7ac
28
vulnerability VCID-mnh7-4rvx-suay
29
vulnerability VCID-n7ga-1sx4-yfcv
30
vulnerability VCID-n7kh-9mpq-13c7
31
vulnerability VCID-nax4-x97j-9fgr
32
vulnerability VCID-nmz3-ux68-dkfd
33
vulnerability VCID-nnka-c23v-qub7
34
vulnerability VCID-p1yd-keq8-rkh3
35
vulnerability VCID-qth9-abgp-wyaq
36
vulnerability VCID-r6mr-ay8d-nqdd
37
vulnerability VCID-sg9h-7dqr-xugu
38
vulnerability VCID-v2hk-dfbe-5khc
39
vulnerability VCID-v3u5-6bpb-qfgf
40
vulnerability VCID-vhjv-9864-tbcs
41
vulnerability VCID-vs1a-m7ya-rue8
42
vulnerability VCID-y13c-awe3-2bc1
43
vulnerability VCID-z16b-zfgu-13a9
44
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.8
aliases CVE-2012-3465, GHSA-7g65-ghrg-hpf5, OSV-84513
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-rgw4-mrr9-euda
39
url VCID-sg9h-7dqr-xugu
vulnerability_id VCID-sg9h-7dqr-xugu
summary 
actionpack vulnerable to Path Traversal
Directory traversal vulnerability in `actionpack/lib/action_dispatch/middleware/static.rb` in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when `serve_static_assets` is enabled, allows remote attackers to determine the existence of files outside the application root via a `/..%2F` sequence.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-7818.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-7818.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-7818
reference_id
reference_type
scores
0
value 0.0022
scoring_system epss
scoring_elements 0.44666
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-7818
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7818
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7818
4
reference_url https://github.com/advisories/GHSA-29gr-w57f-rpfw
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-29gr-w57f-rpfw
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-7818.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-7818.yml
6
reference_url https://groups.google.com/forum/message/raw?msg=rubyonrails-security/dCp7duBiQgo/v_R_8PFs5IwJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=rubyonrails-security/dCp7duBiQgo/v_R_8PFs5IwJ
7
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-7818
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-7818
9
reference_url https://puppet.com/security/cve/cve-2014-7829
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://puppet.com/security/cve/cve-2014-7829
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1161499
reference_id 1161499
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1161499
11
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770934
reference_id 770934
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770934
fixed_packages
0
url pkg:gem/actionpack@3.2.20
purl pkg:gem/actionpack@3.2.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-832g-x9kb-3bbx
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-dd87-gevs-juhe
14
vulnerability VCID-eeru-6pyc-8bcd
15
vulnerability VCID-ejgq-s79w-abd6
16
vulnerability VCID-g13k-qvy7-q3fk
17
vulnerability VCID-g2a6-uem4-uuce
18
vulnerability VCID-k6aw-heeb-wke2
19
vulnerability VCID-kshz-ckjc-77ab
20
vulnerability VCID-m9ud-s6w6-x7ac
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7ga-1sx4-yfcv
23
vulnerability VCID-n7kh-9mpq-13c7
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-p1yd-keq8-rkh3
26
vulnerability VCID-qth9-abgp-wyaq
27
vulnerability VCID-r6mr-ay8d-nqdd
28
vulnerability VCID-v2hk-dfbe-5khc
29
vulnerability VCID-v3u5-6bpb-qfgf
30
vulnerability VCID-y13c-awe3-2bc1
31
vulnerability VCID-z16b-zfgu-13a9
32
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.20
1
url pkg:gem/actionpack@4.0.11
purl pkg:gem/actionpack@4.0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m156-zkzd-57g9
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-r6mr-ay8d-nqdd
27
vulnerability VCID-v2hk-dfbe-5khc
28
vulnerability VCID-v3u5-6bpb-qfgf
29
vulnerability VCID-y13c-awe3-2bc1
30
vulnerability VCID-z16b-zfgu-13a9
31
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.11
2
url pkg:gem/actionpack@4.1.0.beta1
purl pkg:gem/actionpack@4.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m156-zkzd-57g9
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-r6mr-ay8d-nqdd
27
vulnerability VCID-sg9h-7dqr-xugu
28
vulnerability VCID-v2hk-dfbe-5khc
29
vulnerability VCID-v3u5-6bpb-qfgf
30
vulnerability VCID-vs1a-m7ya-rue8
31
vulnerability VCID-y13c-awe3-2bc1
32
vulnerability VCID-z16b-zfgu-13a9
33
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.0.beta1
3
url pkg:gem/actionpack@4.1.7
purl pkg:gem/actionpack@4.1.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m156-zkzd-57g9
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-r6mr-ay8d-nqdd
27
vulnerability VCID-v2hk-dfbe-5khc
28
vulnerability VCID-v3u5-6bpb-qfgf
29
vulnerability VCID-y13c-awe3-2bc1
30
vulnerability VCID-z16b-zfgu-13a9
31
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.7
4
url pkg:gem/actionpack@4.2.0.beta1
purl pkg:gem/actionpack@4.2.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-a6wp-n5yh-ybcv
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-kshz-ckjc-77ab
17
vulnerability VCID-m156-zkzd-57g9
18
vulnerability VCID-m9ud-s6w6-x7ac
19
vulnerability VCID-mnh7-4rvx-suay
20
vulnerability VCID-n7ga-1sx4-yfcv
21
vulnerability VCID-n7kh-9mpq-13c7
22
vulnerability VCID-nmz3-ux68-dkfd
23
vulnerability VCID-p1yd-keq8-rkh3
24
vulnerability VCID-qth9-abgp-wyaq
25
vulnerability VCID-r6mr-ay8d-nqdd
26
vulnerability VCID-sg9h-7dqr-xugu
27
vulnerability VCID-v2hk-dfbe-5khc
28
vulnerability VCID-v3u5-6bpb-qfgf
29
vulnerability VCID-y13c-awe3-2bc1
30
vulnerability VCID-z16b-zfgu-13a9
31
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.0.beta1
5
url pkg:gem/actionpack@4.2.0.beta3
purl pkg:gem/actionpack@4.2.0.beta3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-a6wp-n5yh-ybcv
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-kshz-ckjc-77ab
17
vulnerability VCID-m156-zkzd-57g9
18
vulnerability VCID-m9ud-s6w6-x7ac
19
vulnerability VCID-mnh7-4rvx-suay
20
vulnerability VCID-n7ga-1sx4-yfcv
21
vulnerability VCID-n7kh-9mpq-13c7
22
vulnerability VCID-nmz3-ux68-dkfd
23
vulnerability VCID-p1yd-keq8-rkh3
24
vulnerability VCID-qth9-abgp-wyaq
25
vulnerability VCID-r6mr-ay8d-nqdd
26
vulnerability VCID-v2hk-dfbe-5khc
27
vulnerability VCID-v3u5-6bpb-qfgf
28
vulnerability VCID-y13c-awe3-2bc1
29
vulnerability VCID-z16b-zfgu-13a9
30
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.0.beta3
aliases CVE-2014-7818, GHSA-29gr-w57f-rpfw
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-sg9h-7dqr-xugu
40
url VCID-v2hk-dfbe-5khc
vulnerability_id VCID-v2hk-dfbe-5khc
summary 
Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch
# Possible ReDoS vulnerability in Accept header parsing in Action Dispatch

There is a possible ReDoS vulnerability in the Accept header parsing routines
of Action Dispatch. This vulnerability has been assigned the CVE identifier
CVE-2024-26142.

Versions Affected:  >= 7.1.0, < 7.1.3.1
Not affected:       < 7.1.0
Fixed Versions:     7.1.3.1

Impact
------
Carefully crafted Accept headers can cause Accept header parsing in Action
Dispatch to take an unexpected amount of time, possibly resulting in a DoS
vulnerability.  All users running an affected release should either upgrade or
use one of the workarounds immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby
3.2 or newer are unaffected.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
There are no feasible workarounds for this issue.

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 7-1-accept-redox.patch - Patch for 7.1 series

Credits
-------
Thanks [svalkanov](https://hackerone.com/svalkanov) for the report and patch!
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-26142.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-26142.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-26142
reference_id
reference_type
scores
0
value 0.03542
scoring_system epss
scoring_elements 0.87875
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-26142
2
reference_url https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-28T20:01:00Z/
url https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
5
reference_url https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-28T20:01:00Z/
url https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
6
reference_url https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system cvssv3.1_qr
scoring_elements
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-28T20:01:00Z/
url https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
7
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-28T20:01:00Z/
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-26142
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-26142
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2266324
reference_id 2266324
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2266324
10
reference_url https://github.com/advisories/GHSA-jjhx-jhvp-74wq
reference_id GHSA-jjhx-jhvp-74wq
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-jjhx-jhvp-74wq
11
reference_url https://security.netapp.com/advisory/ntap-20240503-0003/
reference_id ntap-20240503-0003
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-28T20:01:00Z/
url https://security.netapp.com/advisory/ntap-20240503-0003/
fixed_packages
0
url pkg:gem/actionpack@7.1.3.1
purl pkg:gem/actionpack@7.1.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-b7z5-h1bw-tya9
1
vulnerability VCID-dd87-gevs-juhe
2
vulnerability VCID-eeru-6pyc-8bcd
3
vulnerability VCID-nmz3-ux68-dkfd
4
vulnerability VCID-qth9-abgp-wyaq
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.1.3.1
aliases CVE-2024-26142, GHSA-jjhx-jhvp-74wq
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v2hk-dfbe-5khc
41
url VCID-v3u5-6bpb-qfgf
vulnerability_id VCID-v3u5-6bpb-qfgf
summary Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-7829.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-7829.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-7829
reference_id
reference_type
scores
0
value 0.00265
scoring_system epss
scoring_elements 0.50107
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-7829
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7829
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7829
4
reference_url https://github.com/advisories/GHSA-h56m-vwxc-3qpw
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-h56m-vwxc-3qpw
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-7829.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-7829.yml
6
reference_url https://groups.google.com/forum/message/raw?msg=rubyonrails-security/rMTQy4oRCGk/loS_CRS8mNEJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=rubyonrails-security/rMTQy4oRCGk/loS_CRS8mNEJ
7
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-7829
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-7829
9
reference_url https://puppet.com/security/cve/cve-2014-7829
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://puppet.com/security/cve/cve-2014-7829
10
reference_url https://web.archive.org/web/20160403085126/http://www.securityfocus.com/bid/71183
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160403085126/http://www.securityfocus.com/bid/71183
11
reference_url http://weblog.rubyonrails.org/2014/11/19/Rails-4-0-11-1-and-4-1-7-1-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2014/11/19/Rails-4-0-11-1-and-4-1-7-1-have-been-released/
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1164659
reference_id 1164659
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1164659
13
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770934
reference_id 770934
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770934
fixed_packages
0
url pkg:gem/actionpack@3.2.21
purl pkg:gem/actionpack@3.2.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-832g-x9kb-3bbx
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-dd87-gevs-juhe
14
vulnerability VCID-eeru-6pyc-8bcd
15
vulnerability VCID-ejgq-s79w-abd6
16
vulnerability VCID-g13k-qvy7-q3fk
17
vulnerability VCID-g2a6-uem4-uuce
18
vulnerability VCID-k6aw-heeb-wke2
19
vulnerability VCID-kshz-ckjc-77ab
20
vulnerability VCID-m9ud-s6w6-x7ac
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7ga-1sx4-yfcv
23
vulnerability VCID-n7kh-9mpq-13c7
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-p1yd-keq8-rkh3
26
vulnerability VCID-qth9-abgp-wyaq
27
vulnerability VCID-r6mr-ay8d-nqdd
28
vulnerability VCID-v2hk-dfbe-5khc
29
vulnerability VCID-y13c-awe3-2bc1
30
vulnerability VCID-z16b-zfgu-13a9
31
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.21
1
url pkg:gem/actionpack@4.0.11.1
purl pkg:gem/actionpack@4.0.11.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m156-zkzd-57g9
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-r6mr-ay8d-nqdd
27
vulnerability VCID-v2hk-dfbe-5khc
28
vulnerability VCID-y13c-awe3-2bc1
29
vulnerability VCID-z16b-zfgu-13a9
30
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.11.1
2
url pkg:gem/actionpack@4.0.12
purl pkg:gem/actionpack@4.0.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m156-zkzd-57g9
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-r6mr-ay8d-nqdd
27
vulnerability VCID-v2hk-dfbe-5khc
28
vulnerability VCID-v3u5-6bpb-qfgf
29
vulnerability VCID-y13c-awe3-2bc1
30
vulnerability VCID-z16b-zfgu-13a9
31
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.12
3
url pkg:gem/actionpack@4.1.0.beta1
purl pkg:gem/actionpack@4.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m156-zkzd-57g9
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-r6mr-ay8d-nqdd
27
vulnerability VCID-sg9h-7dqr-xugu
28
vulnerability VCID-v2hk-dfbe-5khc
29
vulnerability VCID-v3u5-6bpb-qfgf
30
vulnerability VCID-vs1a-m7ya-rue8
31
vulnerability VCID-y13c-awe3-2bc1
32
vulnerability VCID-z16b-zfgu-13a9
33
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.0.beta1
4
url pkg:gem/actionpack@4.1.7.1
purl pkg:gem/actionpack@4.1.7.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m156-zkzd-57g9
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-r6mr-ay8d-nqdd
27
vulnerability VCID-v2hk-dfbe-5khc
28
vulnerability VCID-y13c-awe3-2bc1
29
vulnerability VCID-z16b-zfgu-13a9
30
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.7.1
5
url pkg:gem/actionpack@4.1.8
purl pkg:gem/actionpack@4.1.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m156-zkzd-57g9
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-r6mr-ay8d-nqdd
27
vulnerability VCID-v2hk-dfbe-5khc
28
vulnerability VCID-v3u5-6bpb-qfgf
29
vulnerability VCID-y13c-awe3-2bc1
30
vulnerability VCID-z16b-zfgu-13a9
31
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.8
6
url pkg:gem/actionpack@4.2.0.beta1
purl pkg:gem/actionpack@4.2.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-a6wp-n5yh-ybcv
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-kshz-ckjc-77ab
17
vulnerability VCID-m156-zkzd-57g9
18
vulnerability VCID-m9ud-s6w6-x7ac
19
vulnerability VCID-mnh7-4rvx-suay
20
vulnerability VCID-n7ga-1sx4-yfcv
21
vulnerability VCID-n7kh-9mpq-13c7
22
vulnerability VCID-nmz3-ux68-dkfd
23
vulnerability VCID-p1yd-keq8-rkh3
24
vulnerability VCID-qth9-abgp-wyaq
25
vulnerability VCID-r6mr-ay8d-nqdd
26
vulnerability VCID-sg9h-7dqr-xugu
27
vulnerability VCID-v2hk-dfbe-5khc
28
vulnerability VCID-v3u5-6bpb-qfgf
29
vulnerability VCID-y13c-awe3-2bc1
30
vulnerability VCID-z16b-zfgu-13a9
31
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.0.beta1
7
url pkg:gem/actionpack@4.2.0.beta4
purl pkg:gem/actionpack@4.2.0.beta4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-a6wp-n5yh-ybcv
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-kshz-ckjc-77ab
17
vulnerability VCID-m156-zkzd-57g9
18
vulnerability VCID-m9ud-s6w6-x7ac
19
vulnerability VCID-mnh7-4rvx-suay
20
vulnerability VCID-n7ga-1sx4-yfcv
21
vulnerability VCID-n7kh-9mpq-13c7
22
vulnerability VCID-nmz3-ux68-dkfd
23
vulnerability VCID-p1yd-keq8-rkh3
24
vulnerability VCID-qth9-abgp-wyaq
25
vulnerability VCID-r6mr-ay8d-nqdd
26
vulnerability VCID-v2hk-dfbe-5khc
27
vulnerability VCID-v3u5-6bpb-qfgf
28
vulnerability VCID-y13c-awe3-2bc1
29
vulnerability VCID-z16b-zfgu-13a9
30
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.0.beta4
aliases CVE-2014-7829, GHSA-h56m-vwxc-3qpw
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v3u5-6bpb-qfgf
42
url VCID-vhjv-9864-tbcs
vulnerability_id VCID-vhjv-9864-tbcs
summary 
actionpack Cross-site Scripting vulnerability
The sanitize helper in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded `:` (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a `&#x3a;` sequence.
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
1
reference_url http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html
2
reference_url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
3
reference_url http://rhn.redhat.com/errata/RHSA-2013-0698.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2013-0698.html
4
reference_url http://rhn.redhat.com/errata/RHSA-2014-1863.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-1863.html
5
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1857.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1857.json
6
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-1857
reference_id
reference_type
scores
0
value 0.00625
scoring_system epss
scoring_elements 0.7051
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-1857
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1857
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1857
8
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
9
reference_url https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI
reference_id
reference_type
scores
url https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI
10
reference_url https://groups.google.com/group/rubyonrails-security/msg/78b9817a5943f6d6?dmode=source&output=gplain
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://groups.google.com/group/rubyonrails-security/msg/78b9817a5943f6d6?dmode=source&output=gplain
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-1857
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-1857
12
reference_url http://support.apple.com/kb/HT5784
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://support.apple.com/kb/HT5784
13
reference_url https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
14
reference_url https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
15
reference_url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released
16
reference_url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
reference_id
reference_type
scores
url http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
17
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=921335
reference_id 921335
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=921335
18
reference_url https://github.com/advisories/GHSA-j838-vfpq-fmf2
reference_id GHSA-j838-vfpq-fmf2
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-j838-vfpq-fmf2
19
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
0
url pkg:gem/actionpack@3.1.12
purl pkg:gem/actionpack@3.1.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-5pfg-7ntp-eff4
6
vulnerability VCID-5psk-hzaf-1kbz
7
vulnerability VCID-6z21-pd9d-pfgk
8
vulnerability VCID-8nkw-8mka-1ygk
9
vulnerability VCID-98gu-r7wd-cuah
10
vulnerability VCID-9gqn-8g4t-wfby
11
vulnerability VCID-a6wp-n5yh-ybcv
12
vulnerability VCID-b4sv-b9pz-r7er
13
vulnerability VCID-bfbp-7umh-2fcp
14
vulnerability VCID-cs1f-uhb2-xkcm
15
vulnerability VCID-dd87-gevs-juhe
16
vulnerability VCID-eeru-6pyc-8bcd
17
vulnerability VCID-ejgq-s79w-abd6
18
vulnerability VCID-g13k-qvy7-q3fk
19
vulnerability VCID-g2a6-uem4-uuce
20
vulnerability VCID-hh65-ycrj-d7gz
21
vulnerability VCID-jpj6-wzp3-m3e4
22
vulnerability VCID-k6aw-heeb-wke2
23
vulnerability VCID-kshz-ckjc-77ab
24
vulnerability VCID-m9ud-s6w6-x7ac
25
vulnerability VCID-mnh7-4rvx-suay
26
vulnerability VCID-n7ga-1sx4-yfcv
27
vulnerability VCID-n7kh-9mpq-13c7
28
vulnerability VCID-nax4-x97j-9fgr
29
vulnerability VCID-nmz3-ux68-dkfd
30
vulnerability VCID-nnka-c23v-qub7
31
vulnerability VCID-p1yd-keq8-rkh3
32
vulnerability VCID-qth9-abgp-wyaq
33
vulnerability VCID-r6mr-ay8d-nqdd
34
vulnerability VCID-sg9h-7dqr-xugu
35
vulnerability VCID-v2hk-dfbe-5khc
36
vulnerability VCID-v3u5-6bpb-qfgf
37
vulnerability VCID-vhjv-9864-tbcs
38
vulnerability VCID-vs1a-m7ya-rue8
39
vulnerability VCID-y13c-awe3-2bc1
40
vulnerability VCID-z16b-zfgu-13a9
41
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.1.12
1
url pkg:gem/actionpack@3.2.13
purl pkg:gem/actionpack@3.2.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-3rn4-abmh-nkhv
4
vulnerability VCID-4w1v-z4zj-6ydp
5
vulnerability VCID-5pfg-7ntp-eff4
6
vulnerability VCID-5psk-hzaf-1kbz
7
vulnerability VCID-6z21-pd9d-pfgk
8
vulnerability VCID-832g-x9kb-3bbx
9
vulnerability VCID-8nkw-8mka-1ygk
10
vulnerability VCID-98gu-r7wd-cuah
11
vulnerability VCID-9gqn-8g4t-wfby
12
vulnerability VCID-a6wp-n5yh-ybcv
13
vulnerability VCID-b4sv-b9pz-r7er
14
vulnerability VCID-bfbp-7umh-2fcp
15
vulnerability VCID-brwd-e9kx-xuc2
16
vulnerability VCID-cs1f-uhb2-xkcm
17
vulnerability VCID-dd87-gevs-juhe
18
vulnerability VCID-eeru-6pyc-8bcd
19
vulnerability VCID-ejgq-s79w-abd6
20
vulnerability VCID-g13k-qvy7-q3fk
21
vulnerability VCID-g2a6-uem4-uuce
22
vulnerability VCID-hh65-ycrj-d7gz
23
vulnerability VCID-jpj6-wzp3-m3e4
24
vulnerability VCID-k6aw-heeb-wke2
25
vulnerability VCID-kshz-ckjc-77ab
26
vulnerability VCID-m9ud-s6w6-x7ac
27
vulnerability VCID-mnh7-4rvx-suay
28
vulnerability VCID-n7ga-1sx4-yfcv
29
vulnerability VCID-n7kh-9mpq-13c7
30
vulnerability VCID-nax4-x97j-9fgr
31
vulnerability VCID-nmz3-ux68-dkfd
32
vulnerability VCID-nnka-c23v-qub7
33
vulnerability VCID-p1yd-keq8-rkh3
34
vulnerability VCID-qth9-abgp-wyaq
35
vulnerability VCID-r6mr-ay8d-nqdd
36
vulnerability VCID-sg9h-7dqr-xugu
37
vulnerability VCID-v2hk-dfbe-5khc
38
vulnerability VCID-v3u5-6bpb-qfgf
39
vulnerability VCID-vhjv-9864-tbcs
40
vulnerability VCID-vs1a-m7ya-rue8
41
vulnerability VCID-y13c-awe3-2bc1
42
vulnerability VCID-z16b-zfgu-13a9
43
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.13
aliases CVE-2013-1857, GHSA-j838-vfpq-fmf2, OSV-91454
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vhjv-9864-tbcs
43
url VCID-vs1a-m7ya-rue8
vulnerability_id VCID-vs1a-m7ya-rue8
summary 
Rails vulnerable to Cross-site Scripting
There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0081.

Versions Affected:  All.
Fixed Versions:     4.1.0.beta2, 4.0.3, 3.2.17.

Impact
------
These helpers allows users to nicely format a numeric value. Some of the parameters to the helper (format, negative_format and units) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack.

All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately.

Releases
--------
The 4.1.0.rc1, 4.0.3 and 3.2.17 releases are available at the normal locations.

Workarounds
-----------

The workaround for this issue is to escape the value passed to the parameter.
For example, replace code like this:

```ruby
<%= number_to_currency(1.02, format: params[:format]) %>
```

With code like this

```ruby
<%= number_to_currency(1.02, format: h(params[:format])) %>
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 4-1-beta-number_helpers_xss.patch - Patch for 4.1-beta series
* 4-0-number_helpers_xss.patch - Patch for 4.0 series
* 3-2-number_helpers_xss.patch - Patch for 3.2 series

Please note that only the 4.0.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------

Thanks to Kevin Reintjes for reporting the issue to us.

-- 
Aaron Patterson
http://tenderlovemaking.com/
references
0
reference_url http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
1
reference_url http://openwall.com/lists/oss-security/2014/02/18/8
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://openwall.com/lists/oss-security/2014/02/18/8
2
reference_url http://rhn.redhat.com/errata/RHSA-2014-0215.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0215.html
3
reference_url http://rhn.redhat.com/errata/RHSA-2014-0306.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2014-0306.html
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0081.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0081.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-0081
reference_id
reference_type
scores
0
value 0.00885
scoring_system epss
scoring_elements 0.75766
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-0081
6
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0081
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0081
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0082
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0082
8
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0130
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0130
9
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
10
reference_url https://github.com/rails/rails/commit/08d0a11a3f62718d601d39e617c834759cf59bbb
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/08d0a11a3f62718d601d39e617c834759cf59bbb
11
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0081.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0081.yml
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2014-0081.yml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2014-0081.yml
13
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/tfp6gZCtzr4
reference_id
reference_type
scores
url https://groups.google.com/forum/#!topic/rubyonrails-security/tfp6gZCtzr4
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-0081
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-0081
15
reference_url https://web.archive.org/web/20140911141416/http://www.securitytracker.com/id/1029782
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20140911141416/http://www.securitytracker.com/id/1029782
16
reference_url https://web.archive.org/web/20170307202606/http://www.securityfocus.com/bid/65647
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20170307202606/http://www.securityfocus.com/bid/65647
17
reference_url https://web.archive.org/web/20201207045136/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201207045136/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1065520
reference_id 1065520
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1065520
19
reference_url https://github.com/advisories/GHSA-m46p-ggm5-5j83
reference_id GHSA-m46p-ggm5-5j83
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-m46p-ggm5-5j83
20
reference_url https://access.redhat.com/errata/RHSA-2014:0215
reference_id RHSA-2014:0215
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0215
21
reference_url https://access.redhat.com/errata/RHSA-2014:0306
reference_id RHSA-2014:0306
reference_type
scores
url https://access.redhat.com/errata/RHSA-2014:0306
fixed_packages
0
url pkg:gem/actionpack@3.2.17
purl pkg:gem/actionpack@3.2.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-832g-x9kb-3bbx
7
vulnerability VCID-8nkw-8mka-1ygk
8
vulnerability VCID-98gu-r7wd-cuah
9
vulnerability VCID-a6wp-n5yh-ybcv
10
vulnerability VCID-b4sv-b9pz-r7er
11
vulnerability VCID-bfbp-7umh-2fcp
12
vulnerability VCID-brwd-e9kx-xuc2
13
vulnerability VCID-dd87-gevs-juhe
14
vulnerability VCID-eeru-6pyc-8bcd
15
vulnerability VCID-ejgq-s79w-abd6
16
vulnerability VCID-g13k-qvy7-q3fk
17
vulnerability VCID-g2a6-uem4-uuce
18
vulnerability VCID-hh65-ycrj-d7gz
19
vulnerability VCID-k6aw-heeb-wke2
20
vulnerability VCID-kshz-ckjc-77ab
21
vulnerability VCID-m9ud-s6w6-x7ac
22
vulnerability VCID-mnh7-4rvx-suay
23
vulnerability VCID-n7ga-1sx4-yfcv
24
vulnerability VCID-n7kh-9mpq-13c7
25
vulnerability VCID-nmz3-ux68-dkfd
26
vulnerability VCID-p1yd-keq8-rkh3
27
vulnerability VCID-qth9-abgp-wyaq
28
vulnerability VCID-r6mr-ay8d-nqdd
29
vulnerability VCID-sg9h-7dqr-xugu
30
vulnerability VCID-v2hk-dfbe-5khc
31
vulnerability VCID-v3u5-6bpb-qfgf
32
vulnerability VCID-y13c-awe3-2bc1
33
vulnerability VCID-z16b-zfgu-13a9
34
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.17
1
url pkg:gem/actionpack@4.0.3
purl pkg:gem/actionpack@4.0.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-hh65-ycrj-d7gz
17
vulnerability VCID-k6aw-heeb-wke2
18
vulnerability VCID-kshz-ckjc-77ab
19
vulnerability VCID-m156-zkzd-57g9
20
vulnerability VCID-m9ud-s6w6-x7ac
21
vulnerability VCID-mnh7-4rvx-suay
22
vulnerability VCID-n7ga-1sx4-yfcv
23
vulnerability VCID-n7kh-9mpq-13c7
24
vulnerability VCID-nmz3-ux68-dkfd
25
vulnerability VCID-p1yd-keq8-rkh3
26
vulnerability VCID-qth9-abgp-wyaq
27
vulnerability VCID-r6mr-ay8d-nqdd
28
vulnerability VCID-sg9h-7dqr-xugu
29
vulnerability VCID-v2hk-dfbe-5khc
30
vulnerability VCID-v3u5-6bpb-qfgf
31
vulnerability VCID-y13c-awe3-2bc1
32
vulnerability VCID-z16b-zfgu-13a9
33
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.3
2
url pkg:gem/actionpack@4.1.0.beta1
purl pkg:gem/actionpack@4.1.0.beta1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m156-zkzd-57g9
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-r6mr-ay8d-nqdd
27
vulnerability VCID-sg9h-7dqr-xugu
28
vulnerability VCID-v2hk-dfbe-5khc
29
vulnerability VCID-v3u5-6bpb-qfgf
30
vulnerability VCID-vs1a-m7ya-rue8
31
vulnerability VCID-y13c-awe3-2bc1
32
vulnerability VCID-z16b-zfgu-13a9
33
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.0.beta1
3
url pkg:gem/actionpack@4.1.1
purl pkg:gem/actionpack@4.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-3edd-m27s-a3ek
3
vulnerability VCID-4w1v-z4zj-6ydp
4
vulnerability VCID-5pfg-7ntp-eff4
5
vulnerability VCID-6z21-pd9d-pfgk
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m156-zkzd-57g9
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-r6mr-ay8d-nqdd
27
vulnerability VCID-sg9h-7dqr-xugu
28
vulnerability VCID-v2hk-dfbe-5khc
29
vulnerability VCID-v3u5-6bpb-qfgf
30
vulnerability VCID-y13c-awe3-2bc1
31
vulnerability VCID-z16b-zfgu-13a9
32
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.1
aliases CVE-2014-0081, GHSA-m46p-ggm5-5j83, OSV-103439
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vs1a-m7ya-rue8
44
url VCID-y13c-awe3-2bc1
vulnerability_id VCID-y13c-awe3-2bc1
summary 
actionpack is vulnerable to remote bypass authentication
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
references
0
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html
2
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
3
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178068.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178068.html
4
reference_url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
5
reference_url http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
6
reference_url http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
7
reference_url http://rhn.redhat.com/errata/RHSA-2016-0296.html
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://rhn.redhat.com/errata/RHSA-2016-0296.html
8
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-7576.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-7576.json
9
reference_url https://api.first.org/data/v1/epss?cve=CVE-2015-7576
reference_id
reference_type
scores
0
value 0.01119
scoring_system epss
scoring_elements 0.78538
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2015-7576
10
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3226
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3226
11
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3227
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3227
12
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7576
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7576
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7577
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7577
14
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7581
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7581
15
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0751
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0751
16
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0752
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0752
17
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0753
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0753
18
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:N/C:P/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
19
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
20
reference_url https://github.com/rails/rails/commit/17e6f1507b7f2c2a883c180f4f9548445d6dfbd
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/17e6f1507b7f2c2a883c180f4f9548445d6dfbd
21
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2015-7576.yml
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2015-7576.yml
22
reference_url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/ANv0HDHEC3k/T8Hgq-hYEgAJ
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/message/raw?msg=ruby-security-ann/ANv0HDHEC3k/T8Hgq-hYEgAJ
23
reference_url https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements
1
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k
24
reference_url https://nvd.nist.gov/vuln/detail/CVE-2015-7576
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2015-7576
25
reference_url https://web.archive.org/web/20160405205300/http://www.securitytracker.com/id/1034816
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20160405205300/http://www.securitytracker.com/id/1034816
26
reference_url https://web.archive.org/web/20200228001849/http://www.securityfocus.com/bid/81803
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200228001849/http://www.securityfocus.com/bid/81803
27
reference_url http://www.debian.org/security/2016/dsa-3464
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://www.debian.org/security/2016/dsa-3464
28
reference_url http://www.openwall.com/lists/oss-security/2016/01/25/8
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2016/01/25/8
29
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1301933
reference_id 1301933
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1301933
30
reference_url https://github.com/advisories/GHSA-p692-7mm3-3fxg
reference_id GHSA-p692-7mm3-3fxg
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-p692-7mm3-3fxg
31
reference_url https://access.redhat.com/errata/RHSA-2016:0296
reference_id RHSA-2016:0296
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0296
32
reference_url https://access.redhat.com/errata/RHSA-2016:0454
reference_id RHSA-2016:0454
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0454
33
reference_url https://access.redhat.com/errata/RHSA-2016:0455
reference_id RHSA-2016:0455
reference_type
scores
url https://access.redhat.com/errata/RHSA-2016:0455
fixed_packages
0
url pkg:gem/actionpack@3.2.22.1
purl pkg:gem/actionpack@3.2.22.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-832g-x9kb-3bbx
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-b4sv-b9pz-r7er
10
vulnerability VCID-bfbp-7umh-2fcp
11
vulnerability VCID-brwd-e9kx-xuc2
12
vulnerability VCID-dd87-gevs-juhe
13
vulnerability VCID-eeru-6pyc-8bcd
14
vulnerability VCID-ejgq-s79w-abd6
15
vulnerability VCID-g13k-qvy7-q3fk
16
vulnerability VCID-g2a6-uem4-uuce
17
vulnerability VCID-k6aw-heeb-wke2
18
vulnerability VCID-kshz-ckjc-77ab
19
vulnerability VCID-m9ud-s6w6-x7ac
20
vulnerability VCID-mnh7-4rvx-suay
21
vulnerability VCID-n7ga-1sx4-yfcv
22
vulnerability VCID-n7kh-9mpq-13c7
23
vulnerability VCID-nmz3-ux68-dkfd
24
vulnerability VCID-p1yd-keq8-rkh3
25
vulnerability VCID-qth9-abgp-wyaq
26
vulnerability VCID-v2hk-dfbe-5khc
27
vulnerability VCID-v4sh-tkkf-xfeh
28
vulnerability VCID-z16b-zfgu-13a9
29
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.22.1
1
url pkg:gem/actionpack@4.1.14.1
purl pkg:gem/actionpack@4.1.14.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-832g-x9kb-3bbx
6
vulnerability VCID-8nkw-8mka-1ygk
7
vulnerability VCID-98gu-r7wd-cuah
8
vulnerability VCID-a6wp-n5yh-ybcv
9
vulnerability VCID-bfbp-7umh-2fcp
10
vulnerability VCID-brwd-e9kx-xuc2
11
vulnerability VCID-dd87-gevs-juhe
12
vulnerability VCID-eeru-6pyc-8bcd
13
vulnerability VCID-ejgq-s79w-abd6
14
vulnerability VCID-g13k-qvy7-q3fk
15
vulnerability VCID-g2a6-uem4-uuce
16
vulnerability VCID-k6aw-heeb-wke2
17
vulnerability VCID-kshz-ckjc-77ab
18
vulnerability VCID-m9ud-s6w6-x7ac
19
vulnerability VCID-mnh7-4rvx-suay
20
vulnerability VCID-n7ga-1sx4-yfcv
21
vulnerability VCID-n7kh-9mpq-13c7
22
vulnerability VCID-nmz3-ux68-dkfd
23
vulnerability VCID-p1yd-keq8-rkh3
24
vulnerability VCID-qth9-abgp-wyaq
25
vulnerability VCID-v2hk-dfbe-5khc
26
vulnerability VCID-v4sh-tkkf-xfeh
27
vulnerability VCID-z16b-zfgu-13a9
28
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.14.1
2
url pkg:gem/actionpack@4.2.5.1
purl pkg:gem/actionpack@4.2.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-a6wp-n5yh-ybcv
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-brwd-e9kx-xuc2
10
vulnerability VCID-dd87-gevs-juhe
11
vulnerability VCID-eeru-6pyc-8bcd
12
vulnerability VCID-ejgq-s79w-abd6
13
vulnerability VCID-g13k-qvy7-q3fk
14
vulnerability VCID-g2a6-uem4-uuce
15
vulnerability VCID-k6aw-heeb-wke2
16
vulnerability VCID-kshz-ckjc-77ab
17
vulnerability VCID-m9ud-s6w6-x7ac
18
vulnerability VCID-mnh7-4rvx-suay
19
vulnerability VCID-n7ga-1sx4-yfcv
20
vulnerability VCID-n7kh-9mpq-13c7
21
vulnerability VCID-nmz3-ux68-dkfd
22
vulnerability VCID-p1yd-keq8-rkh3
23
vulnerability VCID-qth9-abgp-wyaq
24
vulnerability VCID-v2hk-dfbe-5khc
25
vulnerability VCID-v4sh-tkkf-xfeh
26
vulnerability VCID-z16b-zfgu-13a9
27
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.2.5.1
3
url pkg:gem/actionpack@5.0.0.beta1.1
purl pkg:gem/actionpack@5.0.0.beta1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9z-efz6-9fdu
1
vulnerability VCID-3edd-m27s-a3ek
2
vulnerability VCID-4w1v-z4zj-6ydp
3
vulnerability VCID-5pfg-7ntp-eff4
4
vulnerability VCID-6z21-pd9d-pfgk
5
vulnerability VCID-8nkw-8mka-1ygk
6
vulnerability VCID-98gu-r7wd-cuah
7
vulnerability VCID-a6wp-n5yh-ybcv
8
vulnerability VCID-bfbp-7umh-2fcp
9
vulnerability VCID-dd87-gevs-juhe
10
vulnerability VCID-eeru-6pyc-8bcd
11
vulnerability VCID-ejgq-s79w-abd6
12
vulnerability VCID-g13k-qvy7-q3fk
13
vulnerability VCID-g2a6-uem4-uuce
14
vulnerability VCID-k6aw-heeb-wke2
15
vulnerability VCID-kshz-ckjc-77ab
16
vulnerability VCID-m9ud-s6w6-x7ac
17
vulnerability VCID-mnh7-4rvx-suay
18
vulnerability VCID-n7ga-1sx4-yfcv
19
vulnerability VCID-n7kh-9mpq-13c7
20
vulnerability VCID-nmz3-ux68-dkfd
21
vulnerability VCID-p1yd-keq8-rkh3
22
vulnerability VCID-qth9-abgp-wyaq
23
vulnerability VCID-v2hk-dfbe-5khc
24
vulnerability VCID-z16b-zfgu-13a9
25
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.0.0.beta1.1
aliases CVE-2015-7576, GHSA-p692-7mm3-3fxg
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-y13c-awe3-2bc1
45
url VCID-z16b-zfgu-13a9
vulnerability_id VCID-z16b-zfgu-13a9
summary rails: Possible DoS Vulnerability in Action Controller Token Authentication
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-22904.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-22904.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-22904
reference_id
reference_type
scores
0
value 0.03338
scoring_system epss
scoring_elements 0.87506
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-22904
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22880
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22880
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22885
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22885
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22904
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22904
5
reference_url https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869
6
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
7
reference_url https://github.com/rails/rails
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails
8
reference_url https://github.com/rails/rails/releases/tag/v5.2.4.6
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v5.2.4.6
9
reference_url https://github.com/rails/rails/releases/tag/v5.2.6
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v5.2.6
10
reference_url https://github.com/rails/rails/releases/tag/v6.0.3.7
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v6.0.3.7
11
reference_url https://github.com/rails/rails/releases/tag/v6.1.3.2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/releases/tag/v6.1.3.2
12
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22904.yml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22904.yml
13
reference_url https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ
14
reference_url https://hackerone.com/reports/1101125
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://hackerone.com/reports/1101125
15
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-22904
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-22904
16
reference_url https://security.netapp.com/advisory/ntap-20210805-0009
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20210805-0009
17
reference_url https://security.netapp.com/advisory/ntap-20210805-0009/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20210805-0009/
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1961379
reference_id 1961379
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1961379
19
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988214
reference_id 988214
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988214
20
reference_url https://security.archlinux.org/AVG-1920
reference_id AVG-1920
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-1920
21
reference_url https://security.archlinux.org/AVG-1921
reference_id AVG-1921
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-1921
22
reference_url https://security.archlinux.org/AVG-2090
reference_id AVG-2090
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-2090
23
reference_url https://security.archlinux.org/AVG-2223
reference_id AVG-2223
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-2223
24
reference_url https://access.redhat.com/errata/RHSA-2021:4702
reference_id RHSA-2021:4702
reference_type
scores
url https://access.redhat.com/errata/RHSA-2021:4702
fixed_packages
0
url pkg:gem/actionpack@5.2.4.6
purl pkg:gem/actionpack@5.2.4.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-be5x-uyc6-sudm
2
vulnerability VCID-dd87-gevs-juhe
3
vulnerability VCID-eeru-6pyc-8bcd
4
vulnerability VCID-k6aw-heeb-wke2
5
vulnerability VCID-kshz-ckjc-77ab
6
vulnerability VCID-m9ud-s6w6-x7ac
7
vulnerability VCID-n7ga-1sx4-yfcv
8
vulnerability VCID-nmz3-ux68-dkfd
9
vulnerability VCID-qth9-abgp-wyaq
10
vulnerability VCID-re7g-rxbm-dbd9
11
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.2.4.6
1
url pkg:gem/actionpack@5.2.6
purl pkg:gem/actionpack@5.2.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-be5x-uyc6-sudm
2
vulnerability VCID-dd87-gevs-juhe
3
vulnerability VCID-eeru-6pyc-8bcd
4
vulnerability VCID-k6aw-heeb-wke2
5
vulnerability VCID-kshz-ckjc-77ab
6
vulnerability VCID-m9ud-s6w6-x7ac
7
vulnerability VCID-n7ga-1sx4-yfcv
8
vulnerability VCID-nmz3-ux68-dkfd
9
vulnerability VCID-qth9-abgp-wyaq
10
vulnerability VCID-re7g-rxbm-dbd9
11
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@5.2.6
2
url pkg:gem/actionpack@6.0.3.7
purl pkg:gem/actionpack@6.0.3.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-be5x-uyc6-sudm
2
vulnerability VCID-dd87-gevs-juhe
3
vulnerability VCID-eeru-6pyc-8bcd
4
vulnerability VCID-fdqs-v9b2-53gu
5
vulnerability VCID-fgtd-zx7r-rygb
6
vulnerability VCID-k6aw-heeb-wke2
7
vulnerability VCID-kshz-ckjc-77ab
8
vulnerability VCID-m9ud-s6w6-x7ac
9
vulnerability VCID-n7ga-1sx4-yfcv
10
vulnerability VCID-nmz3-ux68-dkfd
11
vulnerability VCID-qth9-abgp-wyaq
12
vulnerability VCID-re7g-rxbm-dbd9
13
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.0.3.7
3
url pkg:gem/actionpack@6.1.3.2
purl pkg:gem/actionpack@6.1.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98gu-r7wd-cuah
1
vulnerability VCID-b7z5-h1bw-tya9
2
vulnerability VCID-be5x-uyc6-sudm
3
vulnerability VCID-dd87-gevs-juhe
4
vulnerability VCID-eeru-6pyc-8bcd
5
vulnerability VCID-fdqs-v9b2-53gu
6
vulnerability VCID-fgtd-zx7r-rygb
7
vulnerability VCID-k6aw-heeb-wke2
8
vulnerability VCID-kshz-ckjc-77ab
9
vulnerability VCID-m9ud-s6w6-x7ac
10
vulnerability VCID-nmz3-ux68-dkfd
11
vulnerability VCID-qth9-abgp-wyaq
12
vulnerability VCID-re7g-rxbm-dbd9
13
vulnerability VCID-v2hk-dfbe-5khc
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.3.2
aliases CVE-2021-22904, GHSA-7wjx-3g7j-8584
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-z16b-zfgu-13a9
46
url VCID-zapd-uts9-zfch
vulnerability_id VCID-zapd-uts9-zfch
summary 
actionpack allows remote attackers to bypass intended access restrictions
`actionpack/lib/action_view/template/resolver.rb` in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
references
0
reference_url http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain
1
reference_url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2011-0449
reference_id
reference_type
scores
0
value 0.00555
scoring_system epss
scoring_elements 0.68408
published_at 2026-05-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2011-0449
3
reference_url http://secunia.com/advisories/43278
reference_id
reference_type
scores
url http://secunia.com/advisories/43278
4
reference_url http://securitytracker.com/id?1025061
reference_id
reference_type
scores
url http://securitytracker.com/id?1025061
5
reference_url https://github.com/rails/rails/commit/6f80224057803f85b3f448936aae89e742452c3b
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/commit/6f80224057803f85b3f448936aae89e742452c3b
6
reference_url https://github.com/rails/rails/tree/main/actionpack
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rails/rails/tree/main/actionpack
7
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0449.yml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0449.yml
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2011-0449
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2011-0449
9
reference_url https://web.archive.org/web/20201207190612/http://securitytracker.com/id?1025061
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201207190612/http://securitytracker.com/id?1025061
10
reference_url http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
11
reference_url http://www.vupen.com/english/advisories/2011/0877
reference_id
reference_type
scores
url http://www.vupen.com/english/advisories/2011/0877
12
reference_url https://github.com/advisories/GHSA-4ww3-3rxj-8v6q
reference_id GHSA-4ww3-3rxj-8v6q
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4ww3-3rxj-8v6q
13
reference_url https://security.gentoo.org/glsa/201412-28
reference_id GLSA-201412-28
reference_type
scores
url https://security.gentoo.org/glsa/201412-28
fixed_packages
0
url pkg:gem/actionpack@3.0.4
purl pkg:gem/actionpack@3.0.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-123f-6px7-3qdg
1
vulnerability VCID-1b9z-efz6-9fdu
2
vulnerability VCID-1xbd-73qv-mff9
3
vulnerability VCID-3edd-m27s-a3ek
4
vulnerability VCID-3rn4-abmh-nkhv
5
vulnerability VCID-4bzb-ft3d-dkgg
6
vulnerability VCID-4w1v-z4zj-6ydp
7
vulnerability VCID-58sa-6uag-z7hp
8
vulnerability VCID-5a2t-fre4-zkay
9
vulnerability VCID-5pfg-7ntp-eff4
10
vulnerability VCID-5psk-hzaf-1kbz
11
vulnerability VCID-6z21-pd9d-pfgk
12
vulnerability VCID-8nkw-8mka-1ygk
13
vulnerability VCID-98gu-r7wd-cuah
14
vulnerability VCID-9gqn-8g4t-wfby
15
vulnerability VCID-a6wp-n5yh-ybcv
16
vulnerability VCID-b4sv-b9pz-r7er
17
vulnerability VCID-bfbp-7umh-2fcp
18
vulnerability VCID-cs1f-uhb2-xkcm
19
vulnerability VCID-dd87-gevs-juhe
20
vulnerability VCID-eeru-6pyc-8bcd
21
vulnerability VCID-ejgq-s79w-abd6
22
vulnerability VCID-fr3w-ejk8-47gw
23
vulnerability VCID-g13k-qvy7-q3fk
24
vulnerability VCID-g2a6-uem4-uuce
25
vulnerability VCID-hh65-ycrj-d7gz
26
vulnerability VCID-jpj6-wzp3-m3e4
27
vulnerability VCID-k6aw-heeb-wke2
28
vulnerability VCID-kshz-ckjc-77ab
29
vulnerability VCID-m9ud-s6w6-x7ac
30
vulnerability VCID-mnh7-4rvx-suay
31
vulnerability VCID-n7ga-1sx4-yfcv
32
vulnerability VCID-n7kh-9mpq-13c7
33
vulnerability VCID-nax4-x97j-9fgr
34
vulnerability VCID-nmz3-ux68-dkfd
35
vulnerability VCID-nnka-c23v-qub7
36
vulnerability VCID-p1yd-keq8-rkh3
37
vulnerability VCID-qth9-abgp-wyaq
38
vulnerability VCID-r6mr-ay8d-nqdd
39
vulnerability VCID-rgw4-mrr9-euda
40
vulnerability VCID-sg9h-7dqr-xugu
41
vulnerability VCID-v2hk-dfbe-5khc
42
vulnerability VCID-v3u5-6bpb-qfgf
43
vulnerability VCID-vhjv-9864-tbcs
44
vulnerability VCID-vs1a-m7ya-rue8
45
vulnerability VCID-y13c-awe3-2bc1
46
vulnerability VCID-z16b-zfgu-13a9
47
vulnerability VCID-zapd-uts9-zfch
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.4
aliases CVE-2011-0449, GHSA-4ww3-3rxj-8v6q
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zapd-uts9-zfch
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.0.rc