Ruby/rails/3.0.4.rc1
Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
https://rubygems.org/gems/rails
UNKNOWN
7 Security Vulnerabilities
rails Cross-Site Request Forgery vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2011-0447
- https://github.com/advisories/GHSA-24fg-p96v-hxh8
- http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
- http://secunia.com/advisories/43274
- http://secunia.com/advisories/43666
- http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
- http://www.debian.org/security/2011/dsa-2247
- http://www.securityfocus.com/bid/46291
- http://www.securitytracker.com/id?1025060
- http://www.vupen.com/english/advisories/2011/0587
- http://www.vupen.com/english/advisories/2011/0877
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml
- https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
- https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage combinations of browser plugins and HTTP redirects,
a related issue to CVE-2011-0696.
rails vulnerable to Cross-site Scripting
- https://nvd.nist.gov/vuln/detail/CVE-2011-0446
- https://github.com/advisories/GHSA-75w6-p6mg-vh8j
- http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
- http://secunia.com/advisories/43274
- http://secunia.com/advisories/43666
- http://www.debian.org/security/2011/dsa-2247
- http://www.securityfocus.com/bid/46291
- http://www.securitytracker.com/id?1025064
- http://www.vupen.com/english/advisories/2011/0587
- http://www.vupen.com/english/advisories/2011/0877
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2011-0446.yml
- https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ
- https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
- https://web.archive.org/web/20200812054342/http://www.securitytracker.com/id?1025064
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
Rails vulnerable to Cross-site Scripting
- https://nvd.nist.gov/vuln/detail/CVE-2014-0081
- https://github.com/advisories/GHSA-m46p-ggm5-5j83
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
- http://openwall.com/lists/oss-security/2014/02/18/8
- http://rhn.redhat.com/errata/RHSA-2014-0215.html
- http://rhn.redhat.com/errata/RHSA-2014-0306.html
- http://secunia.com/advisories/57376
- http://www.securityfocus.com/bid/65647
- http://www.securitytracker.com/id/1029782
- https://web.archive.org/web/20140911141416/http://www.securitytracker.com/id/1029782
- https://web.archive.org/web/20170307202606/http://www.securityfocus.com/bid/65647
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb
in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negativeformat, or (3) units parameter to the (a) numbertocurrency, (b) numbertopercentage, or (c) numberto_human helper.
Cross site scripting in rails
- https://nvd.nist.gov/vuln/detail/CVE-2011-1497
- https://github.com/rails/rails/blob/38df020c95beca7e12f0188cb7e18f3c37789e20/actionpack/CHANGELOG
- https://www.openwall.com/lists/oss-security/2011/04/06/13
- https://github.com/advisories/GHSA-q58j-fmvf-9rq6
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-1497.yml
A cross-site scripting vulnerability flaw was found in the auto_link
function in Rails before version 3.0.6.
rails Cross-site Scripting vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2011-2197
- https://github.com/advisories/GHSA-v9v4-7jp6-8c73
- http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html
- http://openwall.com/lists/oss-security/2011/06/09/2
- http://openwall.com/lists/oss-security/2011/06/13/9
- http://secunia.com/advisories/44789
- http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications
- https://github.com/rails/rails/commit/53a2c0baf2b128dd4808eca313256f6f4bb8c4cd
- https://github.com/rails/rails/commit/ed3796434af6069ced6a641293cf88eef3b284da
- https://gist.github.com/NZKoz/b2ceb626fc2bcdfe497f
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2197.yml
The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
Cross-site Scripting vulnerability in i18n translations helper method
- https://nvd.nist.gov/vuln/detail/CVE-2011-4319
- https://github.com/advisories/GHSA-xxr8-833v-c7wc
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71364
- http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5?pli=1
- http://groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain
- http://openwall.com/lists/oss-security/2011/11/18/8
- http://osvdb.org/77199
- http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released
- http://weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released
- http://www.securityfocus.com/bid/50722
- http://www.securitytracker.com/id?1026342
Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an html
substring.
Rails vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in
actionview/lib/action_view/helpers/number_helper.rb
in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2
allow remote attackers to inject arbitrary web script or HTML via the
(1) format, (2) negativeformat, or (3) units parameter to the
(a) numbertocurrency, (b) numbertopercentage, or (c) numberto_human helper.
445 Other Versions
Version | License | Security | Released | |
---|---|---|---|---|
3.2.4.rc1 | UNKNOWN | 1 | 2012-05-28 - 19:01 | about 11 years |
3.2.3 | UNKNOWN | 1 | 2012-03-30 - 22:26 | about 11 years |
3.2.3.rc2 | UNKNOWN | 1 | 2012-03-29 - 16:14 | about 11 years |
3.2.3.rc1 | UNKNOWN | 1 | 2012-03-27 - 17:11 | about 11 years |
3.2.2 | UNKNOWN | 1 | 2012-03-01 - 17:52 | over 11 years |
3.2.2.rc1 | UNKNOWN | 1 | 2012-02-22 - 21:39 | over 11 years |
3.2.1 | UNKNOWN | 1 | 2012-01-26 - 23:09 | over 11 years |
3.2.0 | UNKNOWN | 1 | 2012-01-20 - 16:47 | over 11 years |
3.2.0.rc2 | UNKNOWN | 1 | 2012-01-04 - 21:05 | over 11 years |
3.2.0.rc1 | UNKNOWN | 1 | 2011-12-20 - 00:41 | over 11 years |
3.1.12 | UNKNOWN | 2 | 2013-03-18 - 17:13 | about 10 years |
3.1.11 | UNKNOWN | 2 | 2013-02-11 - 18:17 | over 10 years |
3.1.10 | UNKNOWN | 2 | 2013-01-08 - 20:08 | over 10 years |
3.1.9 | UNKNOWN | 2 | 2013-01-02 - 21:19 | over 10 years |
3.1.8 | UNKNOWN | 2 | 2012-08-09 - 21:20 | almost 11 years |
3.1.7 | UNKNOWN | 2 | 2012-07-26 - 22:09 | almost 11 years |
3.1.6 | UNKNOWN | 2 | 2012-06-12 - 21:26 | almost 11 years |
3.1.5 | UNKNOWN | 2 | 2012-05-31 - 18:25 | about 11 years |
3.1.5.rc1 | UNKNOWN | 2 | 2012-05-28 - 19:01 | about 11 years |
3.1.4 | UNKNOWN | 2 | 2012-03-01 - 17:52 | over 11 years |
3.1.4.rc1 | UNKNOWN | 2 | 2012-02-22 - 21:39 | over 11 years |
3.1.3 | UNKNOWN | 2 | 2011-11-20 - 22:52 | over 11 years |
3.1.2 | UNKNOWN | 2 | 2011-11-18 - 01:33 | over 11 years |
3.1.2.rc2 | UNKNOWN | 3 | 2011-11-14 - 15:49 | over 11 years |
3.1.2.rc1 | UNKNOWN | 3 | 2011-11-14 - 14:17 | over 11 years |
3.1.1 | UNKNOWN | 3 | 2011-10-07 - 15:30 | over 11 years |
3.1.1.rc3 | UNKNOWN | 3 | 2011-10-06 - 02:31 | over 11 years |
3.1.1.rc2 | UNKNOWN | 3 | 2011-09-29 - 22:17 | over 11 years |
3.1.1.rc1 | UNKNOWN | 3 | 2011-09-15 - 00:27 | over 11 years |
3.1.0 | UNKNOWN | 3 | 2011-08-31 - 02:18 | almost 12 years |
3.1.0.rc8 | UNKNOWN | 2 | 2011-08-29 - 03:27 | almost 12 years |
3.1.0.rc6 | UNKNOWN | 2 | 2011-08-16 - 22:33 | almost 12 years |
3.1.0.rc5 | UNKNOWN | 2 | 2011-07-25 - 23:05 | almost 12 years |
3.1.0.rc4 | UNKNOWN | 2 | 2011-06-09 - 22:56 | almost 12 years |
3.1.0.rc3 | UNKNOWN | 2 | 2011-06-08 - 21:27 | almost 12 years |
3.1.0.rc2 | UNKNOWN | 2 | 2011-06-08 - 00:16 | almost 12 years |
3.1.0.rc1 | UNKNOWN | 2 | 2011-05-22 - 02:26 | about 12 years |
3.1.0.beta1 | UNKNOWN | 2 | 2011-05-05 - 01:23 | about 12 years |
3.0.20 | UNKNOWN | 2 | 2013-01-28 - 21:01 | over 10 years |
3.0.19 | UNKNOWN | 2 | 2013-01-08 - 20:08 | over 10 years |
3.0.18 | UNKNOWN | 2 | 2013-01-02 - 21:19 | over 10 years |
3.0.17 | UNKNOWN | 2 | 2012-08-09 - 21:16 | almost 11 years |
3.0.16 | UNKNOWN | 2 | 2012-07-26 - 22:08 | almost 11 years |
3.0.15 | UNKNOWN | 2 | 2012-06-13 - 03:07 | almost 11 years |
3.0.14 | UNKNOWN | 2 | 2012-06-12 - 21:26 | almost 11 years |
3.0.13 | UNKNOWN | 2 | 2012-05-31 - 18:24 | about 11 years |
3.0.13.rc1 | UNKNOWN | 2 | 2012-05-28 - 19:01 | about 11 years |
3.0.12 | UNKNOWN | 2 | 2012-03-01 - 17:52 | over 11 years |
3.0.12.rc1 | UNKNOWN | 2 | 2012-02-22 - 21:39 | over 11 years |
3.0.11 | UNKNOWN | 2 | 2011-11-18 - 01:23 | over 11 years |
3.0.10 | UNKNOWN | 3 | 2011-08-16 - 22:14 | almost 12 years |
3.0.10.rc1 | UNKNOWN | 3 | 2011-08-05 - 00:12 | almost 12 years |
3.0.9 | UNKNOWN | 3 | 2011-06-16 - 10:05 | almost 12 years |
3.0.9.rc5 | UNKNOWN | 3 | 2011-06-12 - 21:30 | almost 12 years |
3.0.9.rc4 | UNKNOWN | 3 | 2011-06-12 - 21:24 | almost 12 years |
3.0.9.rc3 | UNKNOWN | 3 | 2011-06-09 - 22:51 | almost 12 years |
3.0.9.rc1 | UNKNOWN | 3 | 2011-06-08 - 21:20 | almost 12 years |
3.0.8 | UNKNOWN | 3 | 2011-06-08 - 00:16 | almost 12 years |
3.0.8.rc4 | UNKNOWN | 3 | 2011-05-31 - 00:08 | about 12 years |
3.0.8.rc2 | UNKNOWN | 3 | 2011-05-27 - 16:32 | about 12 years |
3.0.8.rc1 | UNKNOWN | 3 | 2011-05-26 - 00:11 | about 12 years |
3.0.7 | UNKNOWN | 3 | 2011-04-18 - 21:05 | about 12 years |
3.0.7.rc2 | UNKNOWN | 4 | 2011-04-15 - 17:33 | about 12 years |
3.0.7.rc1 | UNKNOWN | 4 | 2011-04-14 - 21:57 | about 12 years |
3.0.6 | UNKNOWN | 4 | 2011-04-05 - 23:05 | about 12 years |
3.0.6.rc2 | UNKNOWN | 5 | 2011-03-31 - 05:28 | about 12 years |
3.0.6.rc1 | UNKNOWN | 5 | 2011-03-29 - 20:47 | about 12 years |
3.0.5 | UNKNOWN | 5 | 2011-02-27 - 02:30 | over 12 years |
3.0.5.rc1 | UNKNOWN | 5 | 2011-02-23 - 19:08 | over 12 years |
3.0.4 | UNKNOWN | 5 | 2011-02-08 - 21:17 | over 12 years |
3.0.4.rc1 | UNKNOWN | 7 | 2011-01-30 - 23:00 | over 12 years |
3.0.3 | UNKNOWN | 7 | 2010-11-16 - 16:29 | over 12 years |
3.0.2 | UNKNOWN | 7 | 2010-11-15 - 19:33 | over 12 years |
3.0.1 | UNKNOWN | 7 | 2010-10-14 - 20:55 | over 12 years |
3.0.0 | UNKNOWN | 8 | 2010-08-29 - 23:11 | almost 13 years |
3.0.0.rc2 | UNKNOWN | 2 | 2010-08-24 - 03:04 | almost 13 years |
3.0.0.rc | UNKNOWN | 2 | 2010-07-26 - 21:43 | almost 13 years |
3.0.0.beta4 | UNKNOWN | 2 | 2010-06-08 - 22:33 | almost 13 years |
3.0.0.beta3 | UNKNOWN | 2 | 2010-04-13 - 19:23 | about 13 years |
3.0.0.beta2 | UNKNOWN | 2 | 2010-04-01 - 21:26 | about 13 years |
3.0.0.beta | UNKNOWN | 2 | 2010-02-05 - 03:02 | over 13 years |
2.3.18 | UNKNOWN | 2 | 2013-03-18 - 17:13 | about 10 years |
2.3.17 | UNKNOWN | 2 | 2013-02-11 - 18:17 | over 10 years |
2.3.16 | UNKNOWN | 2 | 2013-01-28 - 21:01 | over 10 years |
2.3.15 | UNKNOWN | 2 | 2013-01-08 - 20:08 | over 10 years |
2.3.14 | UNKNOWN | 2 | 2011-08-16 - 22:01 | almost 12 years |
2.3.12 | UNKNOWN | 2 | 2011-06-08 - 00:22 | almost 12 years |
2.3.11 | UNKNOWN | 2 | 2011-02-08 - 21:17 | over 12 years |
2.3.10 | UNKNOWN | 5 | 2010-10-14 - 20:53 | over 12 years |
2.3.9 | UNKNOWN | 6 | 2010-09-04 - 21:54 | almost 13 years |
2.3.9.pre | UNKNOWN | 5 | 2010-08-30 - 03:32 | almost 13 years |
2.3.8 | UNKNOWN | 5 | 2010-05-25 - 04:53 | about 13 years |
2.3.8.pre1 | UNKNOWN | 5 | 2010-05-24 - 21:17 | about 13 years |
2.3.7 | UNKNOWN | 5 | 2010-05-24 - 08:23 | about 13 years |
2.3.6 | UNKNOWN | 5 | 2010-05-23 - 07:49 | about 13 years |
2.3.5 | UNKNOWN | 5 | 2009-11-27 - 00:12 | over 13 years |
2.3.4 | UNKNOWN | 7 | 2009-09-04 - 17:33 | almost 14 years |
2.3.3 | UNKNOWN | 9 | 2009-08-05 - 13:21 | almost 14 years |
2.3.2 | UNKNOWN | 11 | 2009-07-25 - 18:01 | almost 14 years |
2.2.3 | UNKNOWN | 7 | 2009-09-28 - 09:25 | over 13 years |