Search for packages
| purl | pkg:gem/actionpack@4.1.2.rc2 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2021-22903
|
URL Redirection to Untrusted Site ('Open Redirect') The actionpack ruby gem suffers from a possible open redirect vulnerability. Specially crafted … |
Vulnerable |
|
CVE-2020-8185
|
Uncontrolled Resource Consumption A denial of service vulnerability exists in Rails that allowed an untrusted user to run any pending … |
Vulnerable |
|
CVE-2014-7829
|
Arbitrary file existence disclosure Specially crafted requests can be used to determine whether a file exists on the filesystem that … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-22904
|
Uncontrolled Resource Consumption The actionpack ruby gem suffers from a possible denial of service vulnerability in the Token Authentication logic … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GMS-2023-56
Aliases: CVE-2023-22795 GHSA-8xww-x3g3-6jcv |
ReDoS based DoS vulnerability in Action Dispatch There is a possible regular expression based DoS vulnerability in Action Dispatch related … |
Vulnerable Vulnerable |
|
CVE-2016-0751
|
Possible Object Leak and Denial of Service attack A carefully crafted `Accept` header can cause a global cache of mime … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-8164
|
Deserialization of Untrusted Data A deserialization of untrusted data vulnerability exists in rails, rails which can allow an attacker to … |
Vulnerable Vulnerable |
|
GMS-2023-58
Aliases: CVE-2023-22792 GHSA-p84v-45xj-wwqj |
ReDoS based DoS vulnerability in Action Dispatch There is a possible regular expression based DoS vulnerability in Action Dispatch. Specially … |
Vulnerable |
|
CVE-2015-7576
|
Timing attack vulnerability in basic authentication Due to the way that Action Controller compares user names and passwords in basic … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2015-7581
|
Object leak vulnerability for wildcard controller routes Users that have a route that contains the string `:controller` are susceptible to … |
Vulnerable Vulnerable |
|
CVE-2014-7818
|
Arbitrary file existence disclosure Specially crafted requests can be used to determine whether a file exists on the filesystem that … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2016-2098
|
Possible remote code execution vulnerability Applications that pass unverified user input to the `render` method in a controller or a … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2022-27777
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A XSS Vulnerability in Action View tag helpers >= 5.2.0 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2011-4319
Aliases: GHSA-xxr8-833v-c7wc OSV-77199 |
Cross-site Scripting vulnerability in i18n translations helper method A cross-site scripting (XSS) flaw was found in the way the 'translate' … | There are no reported fixed by versions. |
|
CVE-2012-3463
Aliases: GHSA-98mf-8f57-64qf OSV-84515 |
CVE-2012-3463 rubygem-actionpack: potential XSS vulnerability in select_tag prompt Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before … | There are no reported fixed by versions. |
|
CVE-2021-22885
Aliases: GHSA-hjg4-8q5f-x6fm |
Possible Information Disclosure / Unintended Method Execution in Action Pack There is a possible information disclosure / unintended method execution … | There are no reported fixed by versions. |
|
CVE-2014-7829
Aliases: GHSA-h56m-vwxc-3qpw |
Arbitrary file existence disclosure in Action Pack Specially crafted requests can be used to determine whether a file exists on … | There are no reported fixed by versions. |
|
CVE-2009-3086
Aliases: GHSA-fg9w-g6m4-557j |
Moderate severity vulnerability that affects rails A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, … | There are no reported fixed by versions. |
|
CVE-2013-6416
Aliases: GHSA-w37c-q653-qg95 OSV-100526 |
XSS Vulnerability in simple_format helper There is a vulnerability in the simple_format helper in Ruby on Rails. The simple_format helper … | There are no reported fixed by versions. |
|
CVE-2023-22792
Aliases: GHSA-p84v-45xj-wwqj |
ReDoS based DoS vulnerability in Action Dispatch There is a possible regular expression based DoS vulnerability in Action Dispatch. This … | There are no reported fixed by versions. |
|
CVE-2011-0449
Aliases: GHSA-4ww3-3rxj-8v6q |
Filter Problems on Case-Insensitive Filesystems in rails/actionpack actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is … | There are no reported fixed by versions. |
|
CVE-2021-22904
Aliases: GHSA-7wjx-3g7j-8584 |
Possible DoS Vulnerability in Action Controller Token Authentication There is a possible DoS vulnerability in the Token Authentication logic in … | There are no reported fixed by versions. |
|
CVE-2008-7248
Aliases: GHSA-8fqx-7pv4-3jwm |
Improper Input Validation in rails Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for … | There are no reported fixed by versions. |
|
CVE-2013-6414
Aliases: GHSA-mpxf-gcw2-pw5q OSV-100525 |
Denial of Service Vulnerability in Action View There is a denial of service vulnerability in the header handling component of … | There are no reported fixed by versions. |
|
CVE-2009-3009
Aliases: GHSA-8qrh-h9m2-5fvf OSV-57666 |
Moderate severity XSS vulnerability that affects rails Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x … | There are no reported fixed by versions. |
|
CVE-2011-2929
Aliases: GHSA-r7q2-5gqg-6c7q |
Filter Skipping Vulnerability in Ruby on Rails 3.0/actionpack The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before … | There are no reported fixed by versions. |
|
CVE-2020-8164
Aliases: GHSA-8727-m6gj-mc37 |
Possible Strong Parameters Bypass in ActionPack There is a strong parameters bypass vector in ActionPack. Versions Affected: rails <= 6.0.3 … | There are no reported fixed by versions. |
|
CVE-2024-41128
Aliases: GHSA-x76w-6vjr-8xgj |
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch There is a possible ReDoS vulnerability in the query parameter … | There are no reported fixed by versions. |
|
CVE-2016-6316
Aliases: GHSA-pc3m-v286-2jwj |
Possible XSS Vulnerability in Action View There is a possible XSS vulnerability in Action View. Text declared as "HTML safe" … | There are no reported fixed by versions. |
|
CVE-2011-0447
Aliases: GHSA-24fg-p96v-hxh8 |
CSRF Protection Bypass in Ruby on Rails Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, … | There are no reported fixed by versions. |
|
CVE-2011-2931
Aliases: GHSA-v5jg-558j-q67c |
XSS Vulnerability in strip_tags helper in rails/actionpack Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on … | There are no reported fixed by versions. |
|
CVE-2012-3424
Aliases: GHSA-92w9-2pqw-rhjj OSV-84243 |
CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before … | There are no reported fixed by versions. |
|
CVE-2011-3187
Aliases: GHSA-3vfw-7rcp-3xgm |
Ruby on rails 3.0.5 Remote_IP.rb Input Validation in rails/actionpack The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does … | There are no reported fixed by versions. |
|
CVE-2015-7581
Aliases: GHSA-9h6g-gp95-x3q5 |
Object leak vulnerability for wildcard controller routes in Action Pack There is an object leak vulnerability for wildcard controllers in … | There are no reported fixed by versions. |
|
CVE-2014-7818
Aliases: GHSA-29gr-w57f-rpfw |
Arbitrary file existence disclosure in Action Pack Specially crafted requests can be used to determine whether a file exists on … | There are no reported fixed by versions. |
|
CVE-2016-2098
Aliases: GHSA-78rc-8c29-p45g |
Possible remote code execution vulnerability in Action Pack There is a possible remote code execution vulnerability in Action Pack. This … | There are no reported fixed by versions. |
|
GHSA-vfg9-r3fq-jvx4
Aliases: CVE-2024-47887 |
Possible ReDoS vulnerability in HTTP Token authentication in Action Controller There is a possible ReDoS vulnerability in Action Controller's HTTP … |
Vulnerable |
|
GHSA-x76w-6vjr-8xgj
Aliases: CVE-2024-41128 |
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch There is a possible ReDoS vulnerability in the query parameter … |
Vulnerable |
|
GHSA-h56m-vwxc-3qpw
Aliases: CVE-2014-7829 |
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before … |
Vulnerable |
|
GHSA-29gr-w57f-rpfw
Aliases: CVE-2014-7818 |
actionpack vulnerable to Path Traversal Directory traversal vulnerability in `actionpack/lib/action_dispatch/middleware/static.rb` in Action Pack in Ruby on Rails 3.x before 3.2.20, … |
Vulnerable |
|
GHSA-p84v-45xj-wwqj
Aliases: CVE-2023-22792 |
ReDoS based DoS vulnerability in Action Dispatch There is a possible regular expression based DoS vulnerability in Action Dispatch. This … | There are no reported fixed by versions. |
|
GHSA-8xww-x3g3-6jcv
Aliases: CVE-2023-22795 |
ReDoS based DoS vulnerability in Action Dispatch There is a possible regular expression based DoS vulnerability in Action Dispatch related … |
Vulnerable |
|
GHSA-4g8v-vg43-wpgf
Aliases: CVE-2023-28362 |
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to The `redirect_to` method in Rails allows provided values … |
Vulnerable |
|
GHSA-23v3-qfrj-wmgh
|
Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby … |
Vulnerable |
|
GHSA-5xmj-wm96-fmw8
|
Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby … |
Vulnerable |
|
GHSA-9chr-4fjh-5rgw
Aliases: CVE-2022-3704 |
Cross-site Scripting in actionpack actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error … | There are no reported fixed by versions. |
|
CVE-2016-0752
Aliases: GHSA-xrr4-p6fq-hjg7 |
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2024-47887
Aliases: GHSA-vfg9-r3fq-jvx4 |
Possible ReDoS vulnerability in HTTP Token authentication in Action Controller There is a possible ReDoS vulnerability in Action Controller's HTTP … | There are no reported fixed by versions. |
|
GHSA-vx9j-46rh-fqr8
Aliases: CVE-2016-2097 |
actionview contains Path Traversal vulnerability There is a possible directory traversal and information leak vulnerability in Action View. This was … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-78rc-8c29-p45g
Aliases: CVE-2016-2098 |
actionpack allows remote code execution via application's unrestricted use of render method Action Pack in Ruby on Rails before 3.2.22.2, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-ffpv-c4hm-3x6v
Aliases: CVE-2016-0751 |
actionpack is vulnerable to denial of service via a crafted HTTP Accept header actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-xrr4-p6fq-hjg7
Aliases: CVE-2016-0752 |
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-p692-7mm3-3fxg
Aliases: CVE-2015-7576 |
actionpack is vulnerable to remote bypass authentication The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-9h6g-gp95-x3q5
Aliases: CVE-2015-7581 |
actionpack is vulnerable to denial of service because of a wildcard controller route actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-7wjx-3g7j-8584
Aliases: CVE-2021-22904 |
Possible DoS Vulnerability in Action Controller Token Authentication There is a possible DoS vulnerability in the Token Authentication logic in … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-hjg4-8q5f-x6fm
Aliases: CVE-2021-22885 |
Action Pack contains Information Disclosure / Unintended Method Execution vulnerability Impact ------ There is a possible information disclosure / unintended … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-544j-77x9-h938
|
Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-m53f-rhq8-q6hf
|
Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-vwfg-qj3r-6v3r
|
Moderate severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-hx46-vwmx-wx95
|
High severity vulnerability that affects actionpack Withdrawn, accidental duplicate publish. Action Pack in Ruby on Rails before 3.2.22.2, 4.x before … |
Vulnerable Vulnerable Vulnerable |