Vulnerabilities

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when…

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.

Action Pack is a framework for handling and responding to web requests.

Active Storage allows users to attach cloud and local files in Rails applications.

Active Storage allows users to attach cloud and local files in Rails applications.

Active Storage allows users to attach cloud and local files in Rails applications.

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.

Active Storage allows users to attach cloud and local files in Rails applications.

Active Storage allows users to attach cloud and local files in Rails applications.

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.

Action View provides conventions and helpers for building web pages with the Rails framework.

Action Pack is a Rubygem for building web applications on the Rails framework.

# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

Active Record connects classes to relational database tables.

Thor before 1.4.0 can construct an unsafe shell command from library input.

There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute.

There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code

There is a denial of service vulnerability in the header parsing component of Rack.

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value.

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file.

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.

Action Pack is a framework for handling and responding to web requests.

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.