- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 11 · 1 medium
- Registry
- RubyGems
Advisories 11
- CVE-2024-26143Medium 6.1
Rails Possible XSS Vulnerability in Action Controller
Affected: from 7.0.0, fixed in 7.0.8.1; from 7.1.0, fixed in 7.1.3.1.
- CVE-2014-0081Unrated
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17…
Affected: from 3.0.0, fixed in 3.2.17; from 4.0.0, fixed in 4.0.3.
- CVE-2009-4214Unrated
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote…
Affected: fixed in 2.2.2; from 2.3.0, fixed in 2.3.5.
- CVE-2009-2422Unrated
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an…
Affected: fixed in 2.3.3.
- CVE-2008-5189Unrated
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP…
Affected: fixed in 2.0.5.
- CVE-2007-6077Unrated
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute…
Affected: fixed in 1.2.6.
- CVE-2007-5380Unrated
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via…
Affected: fixed in 1.2.4.
- CVE-2007-5379Unrated
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary…
Affected: fixed in 1.2.4.
- CVE-2007-3227Unrated
Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows…
Affected: fixed in 1.2.5.
- CVE-2006-4112Unrated
Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute…
Affected: from 1.1.0, fixed in 1.1.6.
- CVE-2006-4111Unrated
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with…
Affected: from 1.1.0, fixed in 1.1.6.