Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

actionpack

62 known vulnerabilities (5 high, 7 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
62 · 5 high, 7 medium, 2 low
Registry
RubyGems

Advisories 62

  • Rails has a possible XSS vulnerability in its Action Pack debug exceptions

    Affected: from 8.1.0, fixed in 8.1.2.1.

  • CVE-2023-28362Medium 4.0

    The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value.

    Affected: fixed in 6.1.7.4; from 7.0.0, fixed in 7.0.5.1.

  • Possible Content Security Policy bypass in Action Dispatch

    Affected: from 5.2.0, fixed in 7.0.8.7; from 7.1.0, fixed in 7.1.5.1; from 7.2.0, fixed in 7.2.2.1; from 8.0.0, fixed in 8.0.0.1.

  • CVE-2024-47887Medium 6.6

    Action Controller has possible ReDoS vulnerability in HTTP Token authentication

    Affected: from 4.0.0, fixed in 6.1.7.9; from 7.0.0, fixed in 7.0.8.5; from 7.1.0, fixed in 7.1.4.1; from 7.2.0, fixed in 7.2.1.1.

  • CVE-2024-41128Medium 6.6

    Action Dispatch has possible ReDoS vulnerability in query parameter filtering

    Affected: from 3.1.0, fixed in 6.1.7.9; from 7.0.0, fixed in 7.0.8.5; from 7.1.0, fixed in 7.1.4.1; from 7.2.0, fixed in 7.2.1.1.

  • CVE-2024-28103Medium 5.4

    Action Pack is missing security headers on non-HTML responses

    Affected: from 6.1.0, fixed in 6.1.7.8; from 7.0.0, fixed in 7.0.8.4; from 7.1.0, fixed in 7.1.3.4; from 7.2.0.beta1, fixed in 7.2.0.beta2.

  • CVE-2024-26143Medium 6.1

    Rails Possible XSS Vulnerability in Action Controller

    Affected: from 7.0.0, fixed in 7.0.8.1; from 7.1.0, fixed in 7.1.3.1.

  • Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch

    Affected: from 7.1.0, fixed in 7.1.3.1.

  • CVE-2023-22797Medium 6.1

    An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with…

    Affected: from 7.0.0, fixed in 7.0.4.1.

  • A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header.

    Affected: from 4.0.0.beta1, fixed in 6.1.7.1; from 7.0.0, fixed in 7.0.4.1.

  • A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1.

    Affected: from 3.0.0, fixed in 5.2.8.15; from 6.0.0, fixed in 6.1.7.1; from 7.0.0, fixed in 7.0.4.1.

  • An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.

    Affected: from 5.2.0, fixed in 5.2.7.1; from 6.0.0, fixed in 6.0.4.8; from 6.1.0, fixed in 6.1.5.1; from 7.0.0, fixed in 7.0.2.4.

  • Exposure of sensitive information in Action Pack

    Affected: from 5.0.0.0, fixed in 5.2.6.2; from 6.0.0.0, fixed in 6.0.4.6; from 6.1.0.0, fixed in 6.1.4.6; from 7.0.0.0, fixed in 7.0.2.2.

  • A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in…

    Affected: from 6.0.0, fixed in 6.0.4.2; from 6.1.0, fixed in 6.1.4.2.

  • A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.

    Affected: from 3.0.0.rc, fixed in 3.0.6.

Show all 62 advisoriesShow fewer advisories

  • A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect…

    Affected: from 6.0.0, fixed in 6.0.4.1; from 6.1.0, fixed in 6.1.4.1.

  • The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token…

    Affected: from 6.0.0, fixed in 6.0.3.7; from 6.1.0, fixed in 6.1.3.2; from 5.2.5, fixed in 5.2.6; from 4.0.0, fixed in 5.2.4.6.

  • The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability.

    Affected: from 6.1.0.rc2, fixed in 6.1.3.2.

  • The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible…

    Affected: from 6.0.0, fixed in 6.0.3.7; from 6.1.0, fixed in 6.1.3.2.

  • A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or…

    Affected: from 6.0.0, fixed in 6.0.3.7; from 6.1.0, fixed in 6.1.3.2; from 5.2.5, fixed in 5.2.6; from 2.0.0, fixed in 5.2.4.6.

  • The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability.

    Affected: from 6.0.0, fixed in 6.0.3.5; from 6.1.0, fixed in 6.1.2.1.

  • In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to…

    Affected: from 6.0.0, fixed in 6.0.3.4.

  • CVE-2020-8166Medium 4.3

    A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token…

    Affected: from 5.0.0, fixed in 5.2.4.3; from 6.0.0, fixed in 6.0.3.1.

  • A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app…

    Affected: from 6.0.0, fixed in 6.0.3.2.

  • A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply…

    Affected: from 5.0.0, fixed in 5.2.4.3; from 6.0.0, fixed in 6.0.3.1.

  • Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary…

    Affected: from 3.0.0, fixed in 3.2.22.2; from 4.0.0, fixed in 4.1.14.2; from 4.2.0, fixed in 4.2.5.2.

  • Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read…

    Affected: from 3.0.0, fixed in 3.2.22.2; from 4.0.0, fixed in 4.1.14.2.

  • CVE-2016-0752High 7.5 · KEV

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an

    Affected: from 4.0.0, fixed in 4.1.14.1; from 4.2.0, fixed in 4.2.5.1; fixed in 3.2.22.1.

  • actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x…

    Affected: from 4.2.0, fixed in 4.2.5.1; fixed in 3.2.22.1; from 4.0.0, fixed in 4.1.14.1.

  • actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows…

    Affected: from 4.0.0, fixed in 4.2.5.1.

  • The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication…

    Affected: from 3.1.0, fixed in 3.2.22.1; from 4.0.0, fixed in 4.1.14.1.

  • Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before…

    Affected: from 4.1.0, fixed in 4.1.8; from 3.0.0, fixed in 3.2.21; from 4.0.0, fixed in 4.0.12; from 4.2.0.beta1, fixed in 4.2.0.beta4.

  • Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before…

    Affected: from 3.0.0, fixed in 3.2.20; from 4.0.0, fixed in 4.0.11; from 4.1.0, fixed in 4.1.7; from 4.2.0.beta1, fixed in 4.2.0.beta3.

  • CVE-2014-0130High 7.5 · KEV

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails befor

    Affected: from 3.0.0, fixed in 3.2.18; from 4.0.0, fixed in 4.0.5; from 4.1.0, fixed in 4.1.1.

  • actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during…

    Affected: from 3.0.0, fixed in 3.2.17.

  • Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17…

    Affected: from 3.0.0, fixed in 3.2.17; from 4.0.0, fixed in 4.0.3.

  • actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences…

    Affected: from 3.0.0, fixed in 3.2.16; from 4.0.0, fixed in 4.0.2.

  • Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails…

    Affected: from 4.0.0, fixed in 4.0.2.

  • Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby…

    Affected: from 3.0.0, fixed in 3.2.16; from 4.0.0, fixed in 4.0.2.

  • actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote…

    Affected: from 3.0.0, fixed in 3.2.16; from 4.0.0, fixed in 4.0.2.

  • Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component…

    Affected: from 3.0.0, fixed in 3.2.16; from 4.0.0, fixed in 4.0.2.

  • The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before…

    Affected: fixed in 2.3.18; from 3.0.0, fixed in 3.1.12; from 3.2.0, fixed in 3.2.13.

  • The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails…

    Affected: fixed in 2.3.18; from 3.0.0, fixed in 3.1.12; from 3.2.0, fixed in 3.2.13.

  • active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before…

    Affected: fixed in 2.3.15; from 3.0.0, fixed in 3.0.19; from 3.1.0, fixed in 3.1.10; from 3.2.0, fixed in 3.2.11.

  • Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on…

    Affected: from 3.0.0.beta, fixed in 3.0.17; from 3.1.0, fixed in 3.1.8; from 3.2.0, fixed in 3.2.8; fixed in 2.3.16.

  • Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17…

    Affected: from 3.0, fixed in 3.0.17; from 3.1.0, fixed in 3.1.8; from 3.2.0, fixed in 3.2.8.

  • The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x…

    Affected: from 3.0.0.beta, fixed in 3.0.16; from 3.1.0, fixed in 3.1.7; from 3.2.0, fixed in 3.2.7; fixed in 2.3.5.

  • actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not…

    Affected: from 3.0.13, fixed in 3.0.14; from 3.1.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.6.

  • actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not…

    Affected: from 3.0.0.beta, fixed in 3.0.13; from 3.1.0, fixed in 3.1.5; from 3.2.0, fixed in 3.2.4; fixed in 2.3.16.

  • Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on…

    Affected: from 3.0.0, fixed in 3.0.12; from 3.1.0, fixed in 3.1.4; from 3.2.0, fixed in 3.2.2.

  • Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before…

    Affected: from 3.0.0, fixed in 3.0.11; from 3.1.0, fixed in 3.1.2.

  • The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For…

    Affected: from 2.3.0, fixed in 2.3.13.

  • CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers…

    Affected: from 2.3.0, fixed in 2.3.13.

  • Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in…

    Affected: from 2.0.0, fixed in 2.3.13; from 3.0.0, fixed in 3.0.10.

  • The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x…

    Affected: from 3.0.0, fixed in 3.0.10.

  • The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does…

    Affected: from 2.0.0, fixed in 2.3.12; from 3.0.0, fixed in 3.0.8.

  • actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not…

    Affected: from 3.0.0, fixed in 3.0.4.

  • Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an…

    Affected: from 2.1.0, fixed in 2.3.11; from 3.0.0, fixed in 3.0.4.

  • Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when…

    Affected: fixed in 2.3.11; from 3.0.0, fixed in 3.0.4.

  • Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote…

    Affected: from 2.1.0, fixed in 2.1.3; from 2.2.0, fixed in 2.2.2.

  • A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest…

    Affected: from 2.1.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.4.

  • Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject…

    Affected: from 2.0.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.4.