VulnerableCode Package Details - pkg:gem/actionpack@3.1.4.rc1

Vulnerabilities affecting this package (79)

Advisory	Summary	Fixed in package version
CVE-2021-22903	URL Redirection to Untrusted Site ('Open Redirect') The actionpack ruby gem suffers from a possible open redirect vulnerability. Specially crafted …	6.1.3.2 Vulnerable
CVE-2020-8185	Uncontrolled Resource Consumption A denial of service vulnerability exists in Rails that allowed an untrusted user to run any pending …	6.0.3.2 Vulnerable
CVE-2012-3463	Ruby on Rails Potential XSS Vulnerability in select_tag prompt When a value for the `prompt` field is supplied to the …	3.0.17 Vulnerable 3.1.8 Vulnerable 3.2.8 Vulnerable
CVE-2013-1855	XSS vulnerability in sanitize_css in Action Pack Carefully crafted text can bypass the sanitization provided in the `sanitize_css` method in …	2.3.18 Vulnerable 3.1.12 Vulnerable 3.2.13 Vulnerable
CVE-2013-1857	XSS Vulnerability in the `sanitize` helper The `sanitize` helper in Ruby on Rails is designed to filter HTML and remove …	2.3.18 Vulnerable 3.1.12 Vulnerable 3.2.13 Vulnerable
CVE-2021-22904	Uncontrolled Resource Consumption The actionpack ruby gem suffers from a possible denial of service vulnerability in the Token Authentication logic …	6.1.3.2 Vulnerable 5.2.4.6 Vulnerable 6.0.3.7 Vulnerable 5.2.6 Vulnerable
GMS-2023-56 Aliases: CVE-2023-22795 GHSA-8xww-x3g3-6jcv	ReDoS based DoS vulnerability in Action Dispatch There is a possible regular expression based DoS vulnerability in Action Dispatch related …	7.0.4.1 Vulnerable 6.1.7.1 Vulnerable
CVE-2013-4491	Reflective XSS Vulnerability There is a vulnerability in the internationalisation component of Ruby on Rails. When the i18n gem is …	4.0.2 Vulnerable 3.2.16 Vulnerable
CVE-2016-0751	Possible Object Leak and Denial of Service attack A carefully crafted `Accept` header can cause a global cache of mime …	3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 4.2.5.1 Vulnerable 5.0.0.beta1.1 Vulnerable
CVE-2013-0156	Multiple vulnerabilities in parameter parsing in Action Pack There are multiple weaknesses in the parameter parsing code for Ruby on …	2.3.15 Vulnerable 3.0.19 Vulnerable 3.1.10 Vulnerable 3.2.11 Vulnerable
CVE-2013-6414	Improper Input Validation actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails allows remote attackers to cause a denial of service …	4.0.2 Vulnerable 3.2.16 Vulnerable
CVE-2020-8164	Deserialization of Untrusted Data A deserialization of untrusted data vulnerability exists in rails, rails which can allow an attacker to …	5.2.4.3 Vulnerable 6.0.3.1 Vulnerable
CVE-2016-6316	Possible XSS Vulnerability in ActionView There is a possible XSS vulnerability in Action View. Text declared as `HTML safe` will …	3.2.22.3 Vulnerable
CVE-2014-0081	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on …	4.1.1 Vulnerable 3.2.17 Vulnerable 4.0.3 Vulnerable
CVE-2013-6415	XSS Vulnerability in number_to_currency The number_to_currency helper allows users to nicely format a numeric value. The unit parameter is not …	4.0.2 Vulnerable 3.2.16 Vulnerable
GMS-2023-58 Aliases: CVE-2023-22792 GHSA-p84v-45xj-wwqj	ReDoS based DoS vulnerability in Action Dispatch There is a possible regular expression based DoS vulnerability in Action Dispatch. Specially …	6.1.7.1 Vulnerable
CVE-2015-7576	Timing attack vulnerability in basic authentication Due to the way that Action Controller compares user names and passwords in basic …	3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 4.2.5.1 Vulnerable 5.0.0.beta1.1 Vulnerable
CVE-2014-0082	Improper Input Validation actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails converts MIME type strings to symbols during use of …	3.2.17 Vulnerable
CVE-2013-6417	Incomplete fix to CVE-2013-0155 (Unsafe Query Generation Risk) Due to the way that `Rack::Request` and `Rails::Request` interact, it is possible …	4.0.2 Vulnerable 3.2.16 Vulnerable
CVE-2022-27777	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A XSS Vulnerability in Action View tag helpers >= 5.2.0 …	5.2.7.1 Vulnerable 6.0.4.8 Vulnerable 6.1.5.1 Vulnerable 7.0.2.4 Vulnerable
CVE-2011-4319 Aliases: GHSA-xxr8-833v-c7wc OSV-77199	Cross-site Scripting vulnerability in i18n translations helper method A cross-site scripting (XSS) flaw was found in the way the 'translate' …	There are no reported fixed by versions.
CVE-2012-3463 Aliases: GHSA-98mf-8f57-64qf OSV-84515	CVE-2012-3463 rubygem-actionpack: potential XSS vulnerability in select_tag prompt Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before …	There are no reported fixed by versions.
CVE-2021-22885 Aliases: GHSA-hjg4-8q5f-x6fm	Possible Information Disclosure / Unintended Method Execution in Action Pack There is a possible information disclosure / unintended method execution …	There are no reported fixed by versions.
CVE-2014-7829 Aliases: GHSA-h56m-vwxc-3qpw	Arbitrary file existence disclosure in Action Pack Specially crafted requests can be used to determine whether a file exists on …	There are no reported fixed by versions.
CVE-2009-3086 Aliases: GHSA-fg9w-g6m4-557j	Moderate severity vulnerability that affects rails A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, …	There are no reported fixed by versions.
CVE-2013-6416 Aliases: GHSA-w37c-q653-qg95 OSV-100526	XSS Vulnerability in simple_format helper There is a vulnerability in the simple_format helper in Ruby on Rails. The simple_format helper …	There are no reported fixed by versions.
CVE-2023-22792 Aliases: GHSA-p84v-45xj-wwqj	ReDoS based DoS vulnerability in Action Dispatch There is a possible regular expression based DoS vulnerability in Action Dispatch. This …	There are no reported fixed by versions.
CVE-2011-0449 Aliases: GHSA-4ww3-3rxj-8v6q	Filter Problems on Case-Insensitive Filesystems in rails/actionpack actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is …	There are no reported fixed by versions.
CVE-2008-7248 Aliases: GHSA-8fqx-7pv4-3jwm	Improper Input Validation in rails Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for …	There are no reported fixed by versions.
CVE-2013-6414 Aliases: GHSA-mpxf-gcw2-pw5q OSV-100525	Denial of Service Vulnerability in Action View There is a denial of service vulnerability in the header handling component of …	There are no reported fixed by versions.
CVE-2016-0752 Aliases: GHSA-xrr4-p6fq-hjg7	Possible Information Leak Vulnerability in Action View There is a possible directory traversal and information leak vulnerability in Action View. …	There are no reported fixed by versions.
CVE-2009-3009 Aliases: GHSA-8qrh-h9m2-5fvf OSV-57666	Moderate severity XSS vulnerability that affects rails Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x …	There are no reported fixed by versions.
CVE-2011-2929 Aliases: GHSA-r7q2-5gqg-6c7q	Filter Skipping Vulnerability in Ruby on Rails 3.0/actionpack The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before …	There are no reported fixed by versions.
CVE-2024-41128 Aliases: GHSA-x76w-6vjr-8xgj	Possible ReDoS vulnerability in query parameter filtering in Action Dispatch There is a possible ReDoS vulnerability in the query parameter …	There are no reported fixed by versions.
CVE-2016-6316 Aliases: GHSA-pc3m-v286-2jwj	Possible XSS Vulnerability in Action View There is a possible XSS vulnerability in Action View. Text declared as "HTML safe" …	There are no reported fixed by versions.
CVE-2011-0447 Aliases: GHSA-24fg-p96v-hxh8	CSRF Protection Bypass in Ruby on Rails Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, …	There are no reported fixed by versions.
CVE-2011-2931 Aliases: GHSA-v5jg-558j-q67c	XSS Vulnerability in strip_tags helper in rails/actionpack Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on …	There are no reported fixed by versions.
CVE-2012-3424 Aliases: GHSA-92w9-2pqw-rhjj OSV-84243	CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before …	There are no reported fixed by versions.
CVE-2014-0082 Aliases: GHSA-7cgp-c3g7-qvrw OSV-103440	CVE-2014-0082 rubygem-actionpack: Action View string handling denial of service actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 …	There are no reported fixed by versions.
CVE-2016-2097 Aliases: GHSA-vx9j-46rh-fqr8	Possible Information Leak Vulnerability in Action View There is a possible directory traversal and information leak vulnerability in Action View. …	There are no reported fixed by versions.
CVE-2011-3187 Aliases: GHSA-3vfw-7rcp-3xgm	Ruby on rails 3.0.5 Remote_IP.rb Input Validation in rails/actionpack The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does …	There are no reported fixed by versions.
CVE-2015-7581 Aliases: GHSA-9h6g-gp95-x3q5	Object leak vulnerability for wildcard controller routes in Action Pack There is an object leak vulnerability for wildcard controllers in …	There are no reported fixed by versions.
CVE-2014-7818 Aliases: GHSA-29gr-w57f-rpfw	Arbitrary file existence disclosure in Action Pack Specially crafted requests can be used to determine whether a file exists on …	There are no reported fixed by versions.
CVE-2016-2098 Aliases: GHSA-78rc-8c29-p45g	Possible remote code execution vulnerability in Action Pack There is a possible remote code execution vulnerability in Action Pack. This …	There are no reported fixed by versions.
GHSA-x76w-6vjr-8xgj Aliases: CVE-2024-41128	Possible ReDoS vulnerability in query parameter filtering in Action Dispatch There is a possible ReDoS vulnerability in the query parameter …	6.1.7.9 Vulnerable
GHSA-92w9-2pqw-rhjj Aliases: CVE-2012-3424	actionpack Improper Authentication vulnerability The `decode_credentials` method in `actionpack/lib/action_controller/metal/http_authentication.rb` in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x …	3.1.7 Vulnerable
GHSA-2xjj-5x6h-8vmf Aliases: CVE-2012-1099	Cross-site Scripting in actionpack Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_options_helper.rb` in the select helper in Ruby on Rails 3.0.x before …	3.1.4 Vulnerable
GHSA-6h5q-96hp-9jgm Aliases: CVE-2013-6415	actionpack vulnerable to Cross-site Scripting Cross-site scripting (XSS) vulnerability in the `number_to_currency` helper in `actionpack/lib/action_view/helpers/number_helper.rb` in Ruby on Rails before …	3.2.16 Vulnerable
GHSA-hgpp-pp89-4fgf Aliases: CVE-2012-2660	Action Pack contains database-query restrictions bypass `actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and …	3.1.5 Vulnerable
GHSA-q34c-48gc-m9g8 Aliases: CVE-2012-2694	actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request `actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before …	3.1.6 Vulnerable
GHSA-699m-mcjm-9cw8 Aliases: CVE-2013-4491	actionpack vulnerable to Cross-site Scripting Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/translation_helper.rb` in the internationalization component in Ruby on Rails 3.x …	3.2.16 Vulnerable
GHSA-q759-hwvc-m3jg Aliases: CVE-2013-1855	actionpack Cross-site Scripting vulnerability The `sanitize_css` method in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, …	3.1.12 Vulnerable
GHSA-j838-vfpq-fmf2 Aliases: CVE-2013-1857	actionpack Cross-site Scripting vulnerability The sanitize helper in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, …	3.1.12 Vulnerable
GHSA-7cgp-c3g7-qvrw Aliases: CVE-2014-0082	actionpack Improper Input Validation vulnerability `actionpack/lib/action_view/template/text.rb` in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings …	3.2.17 Vulnerable
GHSA-wpw7-wxjm-cw8r Aliases: CVE-2013-6417	actionpack allows bypass of database-query restrictions `actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly …	3.2.16 Vulnerable
GHSA-7g65-ghrg-hpf5 Aliases: CVE-2012-3465	actionpack Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/sanitize_helper.rb` in the `strip_tags` helper in Ruby on Rails before 2.3.16, …	3.1.8 Vulnerable
GHSA-mpxf-gcw2-pw5q Aliases: CVE-2013-6414	actionpack Improper Input Validation vulnerability `actionpack/lib/action_view/lookup_context.rb` in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 …	3.2.16 Vulnerable
GHSA-h56m-vwxc-3qpw Aliases: CVE-2014-7829	Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before …	3.2.21 Vulnerable
GHSA-98mf-8f57-64qf Aliases: CVE-2012-3463	actionpack Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_tag_helper.rb` in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, …	3.1.8 Vulnerable
GHSA-29gr-w57f-rpfw Aliases: CVE-2014-7818	actionpack vulnerable to Path Traversal Directory traversal vulnerability in `actionpack/lib/action_dispatch/middleware/static.rb` in Action Pack in Ruby on Rails 3.x before 3.2.20, …	3.2.20 Vulnerable
GHSA-6x85-j5j2-27jx Aliases: CVE-2014-0130	actionpack Path Traversal vulnerability Directory traversal vulnerability in `actionpack/lib/abstract_controller/base.rb` in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x …	3.2.18 Vulnerable
GHSA-jmgw-6vjg-jjwg Aliases: CVE-2013-0156	actionpack Improper Input Validation vulnerability `active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x …	3.1.10 Vulnerable
GHSA-m46p-ggm5-5j83 Aliases: CVE-2014-0081	Rails vulnerable to Cross-site Scripting There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in Ruby on …	3.2.17 Vulnerable
GHSA-p84v-45xj-wwqj Aliases: CVE-2023-22792	ReDoS based DoS vulnerability in Action Dispatch There is a possible regular expression based DoS vulnerability in Action Dispatch. This …	There are no reported fixed by versions.
GHSA-4g8v-vg43-wpgf Aliases: CVE-2023-28362	Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to The `redirect_to` method in Rails allows provided values …	6.1.7.4 Vulnerable
GHSA-23v3-qfrj-wmgh	Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby …	3.2.20 Vulnerable
GHSA-5xmj-wm96-fmw8	Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby …	3.2.21 Vulnerable
GHSA-qf5x-qgx7-437h	Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in …	3.2.18 Vulnerable
GHSA-9chr-4fjh-5rgw Aliases: CVE-2022-3704	Cross-site Scripting in actionpack actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error …	There are no reported fixed by versions.
CVE-2016-0752 Aliases: GHSA-xrr4-p6fq-hjg7	Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, …	3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 4.2.5.1 Vulnerable 3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 4.2.5.1 Vulnerable
CVE-2012-1099	XSS via posted select tag options Ruby on Rails is vulnerable to remote cross-site scripting because the application does not …	3.0.12 Vulnerable 3.1.4 Vulnerable 3.2.2 Vulnerable 3.0.12 Vulnerable 3.1.4 Vulnerable 3.2.2 Vulnerable
GHSA-vx9j-46rh-fqr8 Aliases: CVE-2016-2097	actionview contains Path Traversal vulnerability There is a possible directory traversal and information leak vulnerability in Action View. This was …	3.2.22.2 Vulnerable 4.1.14.2 Vulnerable 3.2.22.2 Vulnerable 4.1.14.2 Vulnerable 3.2.22.2 Vulnerable
GHSA-78rc-8c29-p45g Aliases: CVE-2016-2098	actionpack allows remote code execution via application's unrestricted use of render method Action Pack in Ruby on Rails before 3.2.22.2, …	3.2.22.2 Vulnerable 4.1.14.2 Vulnerable 4.2.5.2 Vulnerable 3.2.22.2 Vulnerable 4.1.14.2 Vulnerable 4.2.5.2 Vulnerable 3.2.22.2 Vulnerable
GHSA-ffpv-c4hm-3x6v Aliases: CVE-2016-0751	actionpack is vulnerable to denial of service via a crafted HTTP Accept header actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on …	4.2.5.1 Vulnerable 3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 4.2.5.1 Vulnerable 3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 3.2.22.1 Vulnerable
GHSA-xrr4-p6fq-hjg7 Aliases: CVE-2016-0752	Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, …	4.1.14.1 Vulnerable 4.2.5.1 Vulnerable 3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 4.2.5.1 Vulnerable 3.2.22.1 Vulnerable 3.2.22.1 Vulnerable
GHSA-p692-7mm3-3fxg Aliases: CVE-2015-7576	actionpack is vulnerable to remote bypass authentication The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller …	3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 3.2.22.1 Vulnerable
GHSA-hjg4-8q5f-x6fm Aliases: CVE-2021-22885	Action Pack contains Information Disclosure / Unintended Method Execution vulnerability Impact ------ There is a possible information disclosure / unintended …	6.0.3.7 Vulnerable 6.1.3.2 Vulnerable 5.2.4.6 Vulnerable 5.2.4.6 Vulnerable
GHSA-m53f-rhq8-q6hf	Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, …	3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 4.2.5.1 Vulnerable 3.2.22.1 Vulnerable
GHSA-vwfg-qj3r-6v3r	Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation …	4.2.5.1 Vulnerable 3.2.22.1 Vulnerable 4.1.14.1 Vulnerable 3.2.22.1 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0