Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Rails https://github.com/rails/rails — FEDORA-2019-1cfe24db5c Clear all filters
TI-2019-03830 CVE-2019-5420 · GHSA-m42h-mh85-4qgc

Command injection in Rails https://github.com/rails/rails

Priority CRITICAL 85

A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.8933 Published 2019-03-27 Fixed in 5.2.2.1 CWE-77
TI-2019-03829 CVE-2019-5419 · GHSA-m63j-wh5w-c252

Uncontrolled resource consumption in Rails https://github.com/rails/rails

Priority MEDIUM 44

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unre…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0844 Published 2019-03-27 Fixed in 4.2.11.1, 5.2.2.1 +3 CWE-400
TI-2019-03828 CVE-2019-5418 · GHSA-86g5-2wh3-gc9j

Path traversal in Rails https://github.com/rails/rails

Priority CRITICAL 90KEV

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesyste…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.98507 Published 2019-03-27 Fixed in 5.2.2.1, 4.2.11.1 +2 CWE-22