Veille CVE

Recherche « Rubyonrails rails »

5 CVE

Critique 0 Élevée 5 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Rubyonrails rails » ✕
  1. CVE-2023-22799 7.5 Élevée

    https://github.com/rails/globalid · Rubyonrails globalid

    A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.

  2. CVE-2023-22795 7.5 Élevée

    https://github.com/rails/rails · Rubyonrails rails · Debian debian linux

    A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

  3. CVE-2023-22792 7.5 Élevée

    https://github.com/rails/rails · Rubyonrails rails

    A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

  4. CVE-2019-5418 7.5 Élevée Exploitée

    Rails https://github.com/rails/rails · Rubyonrails rails · Debian debian linux · Redhat cloudforms

    There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

  5. CVE-2016-0752 7.5 Élevée Exploitée

    Rubyonrails rails · Opensuse leap · Opensuse opensuse · Suse linux enterprise module for containers

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.