{"kind": "product", "path": "vulns/debian-14/rails", "name": "rails", "product": "rails", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-66066", "noindex": false, "published": "2026-07-30T18:32:11.419Z", "modified": "2026-08-05T13:46:21.375Z", "cvss": 9.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.30071, "kev": false, "exploits": ["metasploit", "public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-66066", "title": "Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing", "description": "Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code exec", "references": ["https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm", "https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e", "https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5"], "fixes": ["2:7.2.3.2+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-33658", "noindex": false, "published": "2026-03-26T21:03:25.319Z", "modified": "2026-03-30T11:42:24.885Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "low", "epss": 0.00451, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33658", "title": "Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests", "description": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1\nActive Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.", "references": ["https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg", "https://github.com/rails/rails/releases/tag/v7.2.3.1", "https://github.com/rails/rails/releases/tag/v8.0.4.1"], "fixes": ["2:7.2.3.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-33202", "noindex": false, "published": "2026-03-23T23:34:52.715Z", "modified": "2026-03-24T15:44:19.018Z", "cvss": 6.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.00672, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33202", "title": "Rails Active Storage has possible glob injection in its DiskService", "description": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.", "references": ["https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m", "https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c", "https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf"], "fixes": ["2:7.2.3.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-33195", "noindex": false, "published": "2026-03-23T23:31:41.785Z", "modified": "2026-08-19T12:05:06.738Z", "cvss": 8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "severity": "high", "epss": 0.00577, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33195", "title": "Rails Active Storage has possible Path Traversal in DiskService", "description": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.", "references": ["https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87", "https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c", "https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655"], "fixes": ["2:7.2.3.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-33176", "noindex": false, "published": "2026-03-23T23:29:27.933Z", "modified": "2026-03-24T18:42:48.858Z", "cvss": 6.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.00858, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33176", "title": "Rails Active Support has a possible DoS vulnerability in its number helpers", "description": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.", "references": ["https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9", "https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb", "https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a"], "fixes": ["2:7.2.3.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-33174", "noindex": false, "published": "2026-03-23T23:24:55.594Z", "modified": "2026-03-24T13:40:32.031Z", "cvss": 6.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.00621, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33174", "title": "Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests", "description": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.", "references": ["https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg", "https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5", "https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a"], "fixes": ["2:7.2.3.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-33173", "noindex": false, "published": "2026-03-23T23:21:29.843Z", "modified": "2026-03-24T15:12:50.569Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00397, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33173", "title": "Rails Active Storage has possible content type bypass via metadata in direct uploads", "description": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.", "references": ["https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg", "https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53", "https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e"], "fixes": ["2:7.2.3.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-33170", "noindex": false, "published": "2026-03-23T23:09:48.923Z", "modified": "2026-03-25T19:20:28.280Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0034, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33170", "title": "Rails Active Support has a possible XSS vulnerability in SafeBuffer#%", "description": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.", "references": ["https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v", "https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7", "https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db"], "fixes": ["2:7.2.3.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-33169", "noindex": false, "published": "2026-03-23T23:07:07.630Z", "modified": "2026-03-24T15:46:43.465Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00656, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33169", "title": "Rails Active Support has a possible ReDoS vulnerability in number_to_delimited", "description": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.", "references": ["https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38", "https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11", "https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974"], "fixes": ["2:7.2.3.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-33168", "noindex": false, "published": "2026-03-23T23:01:22.019Z", "modified": "2026-03-24T13:36:44.829Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00678, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33168", "title": "Rails has a possible XSS vulnerability in its Action View tag helpers", "description": "Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.", "references": ["https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq", "https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c", "https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d"], "fixes": ["2:7.2.3.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-24293", "noindex": false, "published": "2026-01-30T20:11:15.219Z", "modified": "2026-07-15T01:26:46.864Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.05579, "kev": false, "exploits": ["metasploit"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-24293", "title": "CVE-2025-24293", "description": "# Active Storage allowed transformation methods potentially unsafe\r\n\r\nActive Storage attempts to prevent the use of potentially unsafe image\r\ntransformation methods and parameters by default.\r\n\r\nThe default allowed list contains three methods allow for the circumvention\r\nof the safe defaults which enables potential command injection\r\nvulnerabilities in cases where arbitrary user supplied input is accepted as\r\nvalid transformation methods or parameters.\r\n\r\n\r\nImpact\r\n------\r\nThis vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.\r\n\r\nVulnerable co", "references": ["https://github.com/advisories/GHSA-r4mg-4433-c7g3", "https://access.redhat.com/security/cve/CVE-2025-24293", "https://bugzilla.redhat.com/show_bug.cgi?id=2435565"], "fixes": ["2:7.2.2.2+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-55193", "noindex": false, "published": "2025-08-13T22:41:41.890Z", "modified": "2025-08-14T14:51:11.284Z", "cvss": 2.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U", "severity": "low", "epss": 0.00641, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-55193", "title": "Active Record logging vulnerable to ANSI escape injection", "description": "Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.", "references": ["https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776", "https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290", "https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b"], "fixes": ["2:7.2.2.2+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-23913", "noindex": false, "published": "2025-01-09T00:33:47.769Z", "modified": "2025-01-09T17:09:39.091Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00639, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-23913", "title": "CVE-2023-23913", "description": "There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.", "references": ["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263", "https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468", "https://github.com/rails/rails/commit/5037a13614d71727af8a175063bcf6ba1a74bdbd"], "fixes": ["2:6.1.7.3+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-28362", "noindex": false, "published": "2025-01-09T00:33:47.730Z", "modified": "2025-05-02T23:02:56.188Z", "cvss": 4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00333, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-28362", "title": "CVE-2023-28362", "description": "The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.", "references": ["https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132", "https://github.com/advisories/GHSA-4g8v-vg43-wpgf", "https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441"], "fixes": ["2:7.2.2.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-38037", "noindex": false, "published": "2025-01-09T00:33:47.704Z", "modified": "2025-02-15T00:10:27.790Z", "cvss": 5.5, "cvss_vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L", "severity": "medium", "epss": 0.00274, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-38037", "title": "CVE-2023-38037", "description": "ActiveSupport::EncryptedFile writes contents that will be encrypted to a\r\ntemporary file.  The temporary file's permissions are defaulted to the user's\r\ncurrent `umask` settings, meaning that it's possible for other users on the\r\nsame system to read the contents of the temporary file.\r\n\r\nAttackers that have access to the file system could possibly read the contents\r\nof this temporary file while a user is editing it.\r\n\r\nAll users running an affected release should either upgrade or use one of the\r\nworkarounds immediately.", "references": ["https://discuss.rubyonrails.org/t/cve-2023-38037-possible-file-disclosure-of-locally-encrypted-files/83544", "https://security.netapp.com/advisory/ntap-20250214-0010/", "https://nvd.nist.gov/vuln/detail/CVE-2023-38037"], "fixes": ["2:7.2.2.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-28120", "noindex": false, "published": "2025-01-09T00:33:47.658Z", "modified": "2025-01-09T21:46:38.220Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00948, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-28120", "title": "CVE-2023-28120", "description": "There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.", "references": ["https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469", "https://github.com/rails/rails/commit/3cf23c3f891e2e81c977ea4ab83b62bc2a444b70", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPV6PVCX4VDJHLFFT42EXBBSGAWZICOW/"], "fixes": ["2:6.1.7.3+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-54133", "noindex": false, "published": "2024-12-10T22:52:04.633Z", "modified": "2025-03-07T00:10:45.315Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "low", "epss": 0.01002, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-54133", "title": "Possible Content Security Policy bypass in Action Dispatch", "description": "Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability  in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applicati", "references": ["https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v", "https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49", "https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a"], "fixes": ["2:7.2.2.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-47889", "noindex": false, "published": "2024-10-16T20:55:33.958Z", "modified": "2024-10-17T16:31:00.794Z", "cvss": 6.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.00937, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-47889", "title": "Action Mailer has possible ReDoS vulnerability in block_format", "description": "Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling the `block_format` helper or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for thi", "references": ["https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6", "https://github.com/rails/rails/commit/0e5694f4d32544532d2301a9b4084eacb6986e94", "https://github.com/rails/rails/commit/3612e3eb3fbafed4f85e1c6ea4c7b6addbb0fdd3"], "fixes": ["2:7.2.2.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-47888", "noindex": false, "published": "2024-10-16T20:31:06.037Z", "modified": "2024-10-16T20:52:22.728Z", "cvss": 6.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.00984, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-47888", "title": "Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node", "description": "Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the `plain_text_for_blockquote_node helper` in Action Text. Carefully crafted text can cause the `plain_text_for_blockquote_node` helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling `plain_text_for_blockquote_node` or upgrade to Rub", "references": ["https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw", "https://github.com/rails/rails/commit/4f4312b21a6448336de7c7ab0c4d94b378def468", "https://github.com/rails/rails/commit/727b0946c3cab04b825c039435eac963d4e91822"], "fixes": ["2:7.2.2.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-47887", "noindex": false, "published": "2024-10-16T20:02:34.722Z", "modified": "2024-10-17T16:36:00.367Z", "cvss": 6.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.01041, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-47887", "title": "Action Controller has possible ReDoS vulnerability in HTTP Token authentication", "description": "Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For applications using HTTP Token authentication via `authenticate_or_request_with_http_token` or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may c", "references": ["https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4", "https://github.com/rails/rails/commit/56b2fc3302836405b496e196a8d5fc0195e55049", "https://github.com/rails/rails/commit/7c1398854d51f9bb193fb79f226647351133d08a"], "fixes": ["2:7.2.2.1+dfsg-1"], "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}]}], "total": 114, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 6, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "rails", "path": "vulns/debian-14/rails", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-19T12:05:06.738Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}