Search for packages
| purl | pkg:gem/rails@0.9.4.1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2014-0130
|
Directory Traversal Vulnerability With Certain Route Configurations The implicit render functionality allows controllers to render a template, even if there … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-8167
|
Cross-Site Request Forgery (CSRF) A CSRF vulnerability exists in Rails' rails-ujs module that could allow attackers to send CSRF tokens … |
Vulnerable Vulnerable |
|
CVE-2011-0446
Aliases: GHSA-75w6-p6mg-vh8j |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in … |
Vulnerable Vulnerable |
|
CVE-2020-8165
|
Deserialization of Untrusted Data A deserialization of untrusted data vulnernerability exists in rails that can allow an attacker to unmarshal … |
Vulnerable Vulnerable |
|
CVE-2021-22904
|
Uncontrolled Resource Consumption There is a possible DoS vulnerability in the Token Authentication logic in Action Controller. Impacted code uses … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-8163
|
Code Injection There is a code injection vulnerability in versions of Rails that would allow an attacker who controlled the … |
Vulnerable |
|
CVE-2023-22795
|
Inefficient Regular Expression Complexity A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match … |
Vulnerable Vulnerable |
|
CVE-2019-5419
|
Uncontrolled Resource Consumption There is a possible denial of service vulnerability in Action View (Rails) where specially crafted `Accept` headers … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-8162
|
Unrestricted Upload of File with Dangerous Type A client side enforcement of server side security vulnerability exists in rails and … |
Vulnerable Vulnerable |
|
CVE-2020-8164
|
Deserialization of Untrusted Data A deserialization of untrusted data vulnerability exists in rails which can allow an attacker to supply … |
Vulnerable Vulnerable |
|
CVE-2014-0081
|
XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-8166
|
Cross-Site Request Forgery (CSRF) A CSRF vulnerability exists in rails that makes it possible for an attacker to, given a … |
Vulnerable Vulnerable |
|
CVE-2019-5418
|
Information Exposure There is a File Content Disclosure vulnerability in Action View where specially crafted `Accept` headers can cause contents … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2008-4094
Aliases: GHSA-xf96-32q2-9rw2 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Multiple SQL injection vulnerabilities in Ruby on Rails … |
Vulnerable |
|
CVE-2016-2097
|
Path Traversal Directory traversal vulnerability in Action View in Ruby on Rails before allows remote attackers to read arbitrary files … |
Vulnerable Vulnerable |
|
GHSA-jmgf-p46x-982h
Aliases: CVE-2008-5189 |
rails is vulnerable to CRLF injection CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject … |
Vulnerable |
|
GHSA-rxq3-gm4p-5fj4
Aliases: CVE-2009-2422 |
rails vulnerable to improper authentication The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 … |
Vulnerable |
|
GHSA-gm25-fpmr-43fj
Aliases: CVE-2007-3227 |
Moderate severity vulnerability that affects rails Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before … |
Vulnerable |
|
GHSA-9p3v-wf2w-v29c
Aliases: CVE-2009-4214 |
Moderate severity vulnerability that affects rails Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, … |
Vulnerable |
|
GHSA-p4c6-77gc-694x
Aliases: CVE-2007-6077 |
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute … |
Vulnerable |
|
GHSA-fjfg-q662-gm6j
Aliases: CVE-2007-5379 |
Moderate severity vulnerability that affects rails Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource … |
Vulnerable |
|
GHSA-jwhv-rgqc-fqj5
Aliases: CVE-2007-5380 |
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions … |
Vulnerable |
|
CVE-2011-1497
Aliases: GHSA-q58j-fmvf-9rq6 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A cross-site scripting vulnerability flaw was found in the auto_link … |
Vulnerable Vulnerable |