rails (RubyGems) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the RubyGems package rails, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (11)

• CVE-2009-2422 — CVSS 9.8 (critical): The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an…
• CVE-2006-4111 — CVSS 7.5 (high): Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an…
• CVE-2006-4112 — CVSS 7.5 (high): Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute…
• CVE-2007-6077 — CVSS 6.8 (medium): The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute…
• CVE-2007-5380 — CVSS 6.8 (medium): Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via…
• CVE-2024-26143 — CVSS 6.1 (medium): Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller…
• CVE-2007-5379 — CVSS 5.0 (medium): Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary…
• CVE-2008-5189 — CVSS 5.0 (medium): CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP…
• CVE-2007-3227 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows…
• CVE-2009-4214 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote…
• CVE-2014-0081 — CVSS 4.3 (medium): Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17…