← Back

Rubyonrails

rubyonrails

144 CVEs • 14 products

Products (14)

Click to collapse
Toggle
Rails
rails
117 CVEs
Ruby On Rails
ruby_on_rails
49 CVEs
Rails Html Sanitizers
rails_html_sanitizers
10 CVEs
Html Sanitizer
html_sanitizer
4 CVEs
Actionpack Page Caching
actionpack_page-caching
2 CVEs
Actionpack
actionpack
2 CVEs
Jquery Rails
jquery-rails
1 CVE
Jquery Ujs
jquery-ujs
1 CVE
Web Console
web_console
1 CVE
Actionview
actionview
1 CVE
Active Resource
active_resource
1 CVE
Active Record Session Store
active_record_session_store
1 CVE
Active Storage
active_storage
1 CVE
Globalid
globalid
1 CVE

CVEs (144)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2007-6077
1Rubyonrails
1Rails
Apr 23, 2026
Nov 21, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to...Show more
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.Show less
CVE-2007-3227
1Rubyonrails
1Rails
Apr 23, 2026
Jun 14, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.
CVE-2006-4112
1Rubyonrails
1Rails
Apr 16, 2026
Aug 14, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, w...Show more
Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.Show less
CVE-2006-4111
1Rubyonrails
2Rails
Ruby On Rails
Apr 16, 2026
Aug 14, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than...Show more
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.Show less