Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

actionview

13 known vulnerabilities (2 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
13 · 2 high, 3 medium, 1 low
Registry
RubyGems

Advisories 13

  • Rails has a possible XSS vulnerability in its Action View tag helpers

    Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1.

  • CVE-2023-23913Medium 6.3

    There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are…

    Affected: from 5.1.0, fixed in 6.1.7.3; from 7.0.0, fixed in 7.0.4.3.

  • A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control…

    Affected: fixed in 5.2.7.1; from 6.0.0, fixed in 6.0.4.8; from 6.1.0, fixed in 6.1.5.1; from 7.0.0, fixed in 7.0.2.4.

  • CVE-2020-15169Medium 5.4

    XSS in Action View

    Affected: fixed in 5.2.4.4; from 6.0.0.0, fixed in 6.0.3.3.

  • The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument…

    Affected: fixed in 4.2.11.3.

  • A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

    Affected: from 5.0.0, fixed in 5.2.4.3; from 6.0.0, fixed in 6.0.3.1.

  • CVE-2020-5267Medium 4.0

    Possible XSS vulnerability in ActionView

    Affected: fixed in 5.2.4.2; from 6.0.0, fixed in 6.0.2.2.

  • There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted…

    Affected: from 4.0.0, fixed in 4.2.11.1; from 5.2.0, fixed in 5.2.2.1; from 5.1.0, fixed in 5.1.6.2; from 5.0.0, fixed in 5.0.7.2; from 6.0.0.beta1, fixed in 6.0.0.beta3.

  • CVE-2019-5418High 7.5 · KEV

    There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accep

    Affected: from 5.2.0, fixed in 5.2.2.1; from 4.0.0, fixed in 4.2.11.1; from 5.1.0, fixed in 5.1.6.2; from 5.0.0, fixed in 5.0.7.2.

  • Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1…

    Affected: from 3.0.0, fixed in 3.2.22.3; from 4.0.0, fixed in 4.2.7.1; from 5.0.0, fixed in 5.0.0.1.

  • Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read…

    Affected: from 3.0.0, fixed in 3.2.22.2; from 4.0.0, fixed in 4.1.14.2.

  • CVE-2016-0752High 7.5 · KEV

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an

    Affected: from 4.0.0, fixed in 4.1.14.1; from 4.2.0, fixed in 4.2.5.1.

  • Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when…

    Affected: fixed in 2.3.11; from 3.0.0, fixed in 3.0.4.