Skip to content
Noroxi

rubyonrails records

148 published records for vendor rubyonrails. 3 of them have been exploited in the wild (listed in CISA KEV) and 9 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
3 · 2%
Weaponized
9 · 6.1%
Pre-auth RCE
20
With a fix record
95.3%
Median publish → KEV
2294 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

148 records
  • CVE-2019-5418
    90Now

    There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accep

    HighCVSS 7.5KEVWeaponizedEPSS 98%

    rubyonrails · railsMar 27, 2019

  • CVE-2016-0752
    89Now

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an

    HighCVSS 7.5KEVWeaponizedEPSS 95%

    rubyonrails · railsFeb 15, 2016

  • CVE-2014-0130
    76This week

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails befor

    HighCVSS 7.5KEVWeaponizedEPSS 53%

    redhat · subscription asset managerMay 7, 2014

  • CVE-2019-5420
    66This week

    A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically gene

    CriticalCVSS 9.8WeaponizedEPSS 89%

    rubyonrails · railsMar 27, 2019

  • CVE-2013-0156
    60This week

    active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.1

    HighCVSS 7.5WeaponizedEPSS 98%

    rubyonrails · railsJan 13, 2013

  • CVE-2020-8163
    60This week

    The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument o

    HighCVSS 8.8Proof of conceptEPSS 82%

    rubyonrails · railsJul 2, 2020

  • CVE-2016-2098
    60This week

    Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Rub

    HighCVSS 7.3WeaponizedEPSS 81%

    debian · debian linuxApr 7, 2016

  • CVE-2013-0333
    59Plan

    lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to

    HighCVSS 7.5WeaponizedEPSS 95%

    rubyonrails · railsJan 30, 2013

  • CVE-2020-8165
    53Plan

    A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user

    CriticalCVSS 9.8Proof of conceptEPSS 45%

    rubyonrails · railsJun 19, 2020

  • CVE-2021-22881
    50Plan

    The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability.

    MediumCVSS 6.1Proof of conceptEPSS 87%

    rubyonrails · railsFeb 11, 2021

  • CVE-2020-8264
    44Plan

    In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to s

    MediumCVSS 6.1No exploitEPSS 66%

    rubyonrails · railsJan 6, 2021

  • CVE-2013-0277
    42Plan

    ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary c

    CriticalCVSS 10.0No exploitEPSS 7%

    rubyonrails · railsFeb 12, 2013

  • CVE-2020-8159
    41Plan

    There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potential

    CriticalCVSS 9.8No exploitEPSS 5%

    rubyonrails · actionpack page-cachingMay 12, 2020

  • CVE-2015-3224
    40Plan

    request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For header

    MediumCVSS 4.3WeaponizedEPSS 48%

    rubyonrails · web consoleJul 26, 2015

  • CVE-2013-6414
    40Plan

    actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers

    MediumCVSS 5.0WeaponizedEPSS 20%

    rubyonrails · railsDec 6, 2013

  • CVE-2009-2422
    40Plan

    The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_

    CriticalCVSS 9.8No exploitEPSS 3%

    rubyonrails · ruby on railsJul 10, 2009

  • CVE-2022-21831
    40Plan

    A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing argu

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    rubyonrails · active storageMay 26, 2022

  • CVE-2024-28103
    39Monitor

    Action Pack is missing security headers on non-HTML responses

    CriticalCVSS 9.8No exploitEPSS 0%

    rubyonrails · railsJun 4, 2024

  • CVE-2016-0751
    33Monitor

    actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x bef

    HighCVSS 7.5No exploitEPSS 9%

    rubyonrails · railsFeb 15, 2016

  • CVE-2019-5419
    33Monitor

    There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted a

    HighCVSS 7.5No exploitEPSS 8%

    rubyonrails · railsMar 27, 2019

  • CVE-2017-17917
    33Monitor

    SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comman

    HighCVSS 8.1Proof of conceptEPSS 2%

    rubyonrails · railsDec 29, 2017

  • CVE-2022-32209
    32Monitor

    # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sani

    MediumCVSS 6.1No exploitEPSS 26%

    rubyonrails · rails html sanitizersJun 24, 2022

  • CVE-2015-7581
    32Monitor

    actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows r

    HighCVSS 7.5No exploitEPSS 6%

    rubyonrails · railsFeb 15, 2016

  • CVE-2017-17916
    32Monitor

    SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comm

    HighCVSS 8.1No exploitEPSS 1%

    rubyonrails · railsDec 29, 2017

  • CVE-2017-17920
    32Monitor

    SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comm

    HighCVSS 8.1No exploitEPSS 1%

    rubyonrails · ruby on railsDec 29, 2017