Search for packages
| purl | pkg:gem/activesupport@2.4 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-43f3-rxwm-fkgv
Aliases: CVE-2011-2932 GHSA-9fh3-vh3h-q4g3 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability." |
Affected by 12 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-ca7u-t1y4-uuc7
Aliases: CVE-2013-0333 GHSA-xgr2-v94m-rc9g OSV-89594 |
Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 There is a vulnerability in the JSON code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application. |
Affected by 9 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-j24x-nhsb-yug6
Aliases: CVE-2011-2197 GHSA-v9v4-7jp6-8c73 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method. |
Affected by 12 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-uudj-r63z-kban
Aliases: CVE-2013-1856 GHSA-9c2j-593q-3g82 OSV-91451 |
XML Parsing Vulnerability affecting JRuby users There is a vulnerability in the JDOM backend to ActiveSupport's XML parser. you should upgrade or use one of the work arounds immediately. |
Affected by 9 other vulnerabilities. Affected by 10 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T15:18:18.406340+00:00 | Ruby Importer | Affected by | VCID-ca7u-t1y4-uuc7 | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2013-0333.yml | 38.0.0 |
| 2026-04-01T15:18:18.299497+00:00 | Ruby Importer | Affected by | VCID-43f3-rxwm-fkgv | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2932.yml | 38.0.0 |
| 2026-04-01T15:18:18.247376+00:00 | Ruby Importer | Affected by | VCID-j24x-nhsb-yug6 | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2197.yml | 38.0.0 |
| 2026-04-01T15:18:18.189276+00:00 | Ruby Importer | Affected by | VCID-uudj-r63z-kban | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2013-1856.yml | 38.0.0 |