İçeriğe atla
Noroxi

rubyonrails kayıtları

rubyonrails üreticisine ait 148 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
3 · %2
Silahlaştırılmış
9 · %6,1
Pre-auth RCE
20
Düzeltme kaydı olan
%95,3
Yayından KEV’e ortanca
2294 gün

Yıllara göre kayıt

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Bug bounty kapsamı

Ürünün üreticisi herkese açık bir programda görünüyor. Eşleşme ad üzerinden yapıldı; kapsam metnini programda doğrulayın.

Tüm kayıtlar

148 kayıt
  • CVE-2019-5418
    90Hemen

    There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accep

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %98

    rubyonrails · rails27 Mar 2019

  • CVE-2016-0752
    89Hemen

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %95

    rubyonrails · rails15 Şub 2016

  • CVE-2014-0130
    76Bu hafta

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails befor

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %53

    redhat · subscription asset manager7 May 2014

  • CVE-2019-5420
    66Bu hafta

    A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically gene

    KritikCVSS 9,8SilahlaştırılmışEPSS %89

    rubyonrails · rails27 Mar 2019

  • CVE-2013-0156
    60Bu hafta

    active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.1

    YüksekCVSS 7,5SilahlaştırılmışEPSS %99

    rubyonrails · rails13 Oca 2013

  • CVE-2020-8163
    60Bu hafta

    The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument o

    YüksekCVSS 8,8Kavram kanıtıEPSS %82

    rubyonrails · rails2 Tem 2020

  • CVE-2016-2098
    60Bu hafta

    Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Rub

    YüksekCVSS 7,3SilahlaştırılmışEPSS %81

    debian · debian linux7 Nis 2016

  • CVE-2013-0333
    59Planlayın

    lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to

    YüksekCVSS 7,5SilahlaştırılmışEPSS %95

    rubyonrails · rails30 Oca 2013

  • CVE-2020-8165
    53Planlayın

    A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user

    KritikCVSS 9,8Kavram kanıtıEPSS %45

    rubyonrails · rails19 Haz 2020

  • CVE-2021-22881
    50Planlayın

    The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability.

    OrtaCVSS 6,1Kavram kanıtıEPSS %87

    rubyonrails · rails11 Şub 2021

  • CVE-2020-8264
    44Planlayın

    In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to s

    OrtaCVSS 6,1İstismar yokEPSS %66

    rubyonrails · rails6 Oca 2021

  • CVE-2013-0277
    42Planlayın

    ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary c

    KritikCVSS 10,0İstismar yokEPSS %7

    rubyonrails · rails12 Şub 2013

  • CVE-2020-8159
    41Planlayın

    There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potential

    KritikCVSS 9,8İstismar yokEPSS %5

    rubyonrails · actionpack page-caching12 May 2020

  • CVE-2015-3224
    40Planlayın

    request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For header

    OrtaCVSS 4,3SilahlaştırılmışEPSS %44

    rubyonrails · web console26 Tem 2015

  • CVE-2013-6414
    40Planlayın

    actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers

    OrtaCVSS 5,0SilahlaştırılmışEPSS %20

    rubyonrails · rails6 Ara 2013

  • CVE-2009-2422
    40Planlayın

    The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_

    KritikCVSS 9,8İstismar yokEPSS %3

    rubyonrails · ruby on rails10 Tem 2009

  • CVE-2022-21831
    40Planlayın

    A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing argu

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    rubyonrails · active storage26 May 2022

  • CVE-2024-28103
    39İzleyin

    Action Pack is missing security headers on non-HTML responses

    KritikCVSS 9,8İstismar yokEPSS %0

    rubyonrails · rails4 Haz 2024

  • CVE-2022-32209
    33İzleyin

    # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sani

    OrtaCVSS 6,1İstismar yokEPSS %30

    rubyonrails · rails html sanitizers24 Haz 2022

  • CVE-2016-0751
    33İzleyin

    actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x bef

    YüksekCVSS 7,5İstismar yokEPSS %9

    rubyonrails · rails15 Şub 2016

  • CVE-2019-5419
    33İzleyin

    There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted a

    YüksekCVSS 7,5İstismar yokEPSS %8

    rubyonrails · rails27 Mar 2019

  • CVE-2017-17917
    33İzleyin

    SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comman

    YüksekCVSS 8,1Kavram kanıtıEPSS %2

    rubyonrails · rails29 Ara 2017

  • CVE-2015-7581
    32İzleyin

    actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows r

    YüksekCVSS 7,5İstismar yokEPSS %6

    rubyonrails · rails15 Şub 2016

  • CVE-2017-17916
    32İzleyin

    SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comm

    YüksekCVSS 8,1İstismar yokEPSS %1

    rubyonrails · rails29 Ara 2017

  • CVE-2017-17920
    32İzleyin

    SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL comm

    YüksekCVSS 8,1İstismar yokEPSS %1

    rubyonrails · ruby on rails29 Ara 2017