Search for packages
| purl | pkg:gem/actionpack@1.13.1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2021-22903
|
URL Redirection to Untrusted Site ('Open Redirect') The actionpack ruby gem suffers from a possible open redirect vulnerability. Specially crafted … |
Vulnerable |
|
CVE-2020-8185
|
Uncontrolled Resource Consumption A denial of service vulnerability exists in Rails that allowed an untrusted user to run any pending … |
Vulnerable |
|
CVE-2013-1855
|
XSS vulnerability in sanitize_css in Action Pack Carefully crafted text can bypass the sanitization provided in the `sanitize_css` method in … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2013-1857
|
XSS Vulnerability in the `sanitize` helper The `sanitize` helper in Ruby on Rails is designed to filter HTML and remove … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-22904
|
Uncontrolled Resource Consumption The actionpack ruby gem suffers from a possible denial of service vulnerability in the Token Authentication logic … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GMS-2023-56
Aliases: CVE-2023-22795 GHSA-8xww-x3g3-6jcv |
ReDoS based DoS vulnerability in Action Dispatch There is a possible regular expression based DoS vulnerability in Action Dispatch related … |
Vulnerable Vulnerable |
|
CVE-2016-0751
|
Possible Object Leak and Denial of Service attack A carefully crafted `Accept` header can cause a global cache of mime … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2013-0156
|
Multiple vulnerabilities in parameter parsing in Action Pack There are multiple weaknesses in the parameter parsing code for Ruby on … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2013-6414
|
Improper Input Validation actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails allows remote attackers to cause a denial of service … |
Vulnerable Vulnerable |
|
CVE-2020-8164
|
Deserialization of Untrusted Data A deserialization of untrusted data vulnerability exists in rails, rails which can allow an attacker to … |
Vulnerable Vulnerable |
|
CVE-2014-0081
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2013-6415
|
XSS Vulnerability in number_to_currency The number_to_currency helper allows users to nicely format a numeric value. The unit parameter is not … |
Vulnerable Vulnerable |
|
CVE-2015-7576
|
Timing attack vulnerability in basic authentication Due to the way that Action Controller compares user names and passwords in basic … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2014-0082
|
Improper Input Validation actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails converts MIME type strings to symbols during use of … |
Vulnerable |
|
CVE-2022-27777
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A XSS Vulnerability in Action View tag helpers >= 5.2.0 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2012-3463
Aliases: GHSA-98mf-8f57-64qf OSV-84515 |
CVE-2012-3463 rubygem-actionpack: potential XSS vulnerability in select_tag prompt Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before … | There are no reported fixed by versions. |
|
CVE-2013-6416
Aliases: GHSA-w37c-q653-qg95 OSV-100526 |
XSS Vulnerability in simple_format helper There is a vulnerability in the simple_format helper in Ruby on Rails. The simple_format helper … | There are no reported fixed by versions. |
|
CVE-2013-6414
Aliases: GHSA-mpxf-gcw2-pw5q OSV-100525 |
Denial of Service Vulnerability in Action View There is a denial of service vulnerability in the header handling component of … | There are no reported fixed by versions. |
|
CVE-2016-0752
Aliases: GHSA-xrr4-p6fq-hjg7 |
Possible Information Leak Vulnerability in Action View There is a possible directory traversal and information leak vulnerability in Action View. … | There are no reported fixed by versions. |
|
CVE-2016-6316
Aliases: GHSA-pc3m-v286-2jwj |
Possible XSS Vulnerability in Action View There is a possible XSS vulnerability in Action View. Text declared as "HTML safe" … | There are no reported fixed by versions. |
|
CVE-2012-3424
Aliases: GHSA-92w9-2pqw-rhjj OSV-84243 |
CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before … | There are no reported fixed by versions. |
|
CVE-2014-0082
Aliases: GHSA-7cgp-c3g7-qvrw OSV-103440 |
CVE-2014-0082 rubygem-actionpack: Action View string handling denial of service actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 … | There are no reported fixed by versions. |
|
CVE-2016-2097
Aliases: GHSA-vx9j-46rh-fqr8 |
Possible Information Leak Vulnerability in Action View There is a possible directory traversal and information leak vulnerability in Action View. … | There are no reported fixed by versions. |
|
CVE-2015-7581
Aliases: GHSA-9h6g-gp95-x3q5 |
Object leak vulnerability for wildcard controller routes in Action Pack There is an object leak vulnerability for wildcard controllers in … | There are no reported fixed by versions. |
|
CVE-2016-2098
Aliases: GHSA-78rc-8c29-p45g |
Possible remote code execution vulnerability in Action Pack There is a possible remote code execution vulnerability in Action Pack. This … | There are no reported fixed by versions. |
|
GHSA-92w9-2pqw-rhjj
Aliases: CVE-2012-3424 |
actionpack Improper Authentication vulnerability The `decode_credentials` method in `actionpack/lib/action_controller/metal/http_authentication.rb` in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x … |
Vulnerable |
|
GHSA-hgpp-pp89-4fgf
Aliases: CVE-2012-2660 |
Action Pack contains database-query restrictions bypass `actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and … |
Vulnerable |
|
GHSA-q759-hwvc-m3jg
Aliases: CVE-2013-1855 |
actionpack Cross-site Scripting vulnerability The `sanitize_css` method in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, … |
Vulnerable |
|
GHSA-j838-vfpq-fmf2
Aliases: CVE-2013-1857 |
actionpack Cross-site Scripting vulnerability The sanitize helper in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, … |
Vulnerable |
|
GHSA-7g65-ghrg-hpf5
Aliases: CVE-2012-3465 |
actionpack Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/sanitize_helper.rb` in the `strip_tags` helper in Ruby on Rails before 2.3.16, … |
Vulnerable |
|
GHSA-75w6-p6mg-vh8j
Aliases: CVE-2011-0446 |
Rails actionpack gem vulnerable to Cross-site Scripting Multiple cross-site scripting (XSS) vulnerabilities in the `mail_to` helper in Ruby on Rails … |
Vulnerable |
|
GHSA-jmgw-6vjg-jjwg
Aliases: CVE-2013-0156 |
actionpack Improper Input Validation vulnerability `active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x … |
Vulnerable |
|
GHSA-4g8v-vg43-wpgf
Aliases: CVE-2023-28362 |
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to The `redirect_to` method in Rails allows provided values … |
Vulnerable |
|
GHSA-23v3-qfrj-wmgh
|
Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby … |
Vulnerable |
|
GHSA-5xmj-wm96-fmw8
|
Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby … |
Vulnerable |
|
GHSA-qf5x-qgx7-437h
|
Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in … |
Vulnerable |
|
GHSA-9chr-4fjh-5rgw
Aliases: CVE-2022-3704 |
Cross-site Scripting in actionpack actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error … | There are no reported fixed by versions. |
|
CVE-2016-0752
Aliases: GHSA-xrr4-p6fq-hjg7 |
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-ffpv-c4hm-3x6v
Aliases: CVE-2016-0751 |
actionpack is vulnerable to denial of service via a crafted HTTP Accept header actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-xrr4-p6fq-hjg7
Aliases: CVE-2016-0752 |
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-m53f-rhq8-q6hf
|
Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-vwfg-qj3r-6v3r
|
Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation … |
Vulnerable Vulnerable Vulnerable Vulnerable |