Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Rails Component: Actionpack Page-caching Clear all filters
TI-2021-05746 CVE-2021-22885 · GHSA-hjg4-8q5f-x6fm

Information disclosure through error messages in https://github.com/rails/rails

Priority MEDIUM 40

A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0405 Published 2021-05-27 Partial fix · 6.0.3.7, 6.1.3.2 +2 CWE-209
TI-2020-06577 CVE-2020-8159 · GHSA-mg5p-95m9-rmfp

Path traversal in https://github.com/rails/actionpack-page_caching

Priority MEDIUM 50

There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0538 Published 2020-05-12 Fixed in 1.2.1 CWE-22