Known vulnerabilities in Ruby on Rails - page 2

Vendor: Rails
Software: Ruby on Rails
Software CPE: cpe:2.3:a:rails:ruby_on_rails:*:*:*:*:*:*:*:*
Total vulnerabilities: 60
Public exploits: 5
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ruby on Rails Ruby on Rails is affected by 60 known vulnerabilities: 4 high, 35 medium, 21 low Critical High Medium Low

Vulnerabilities (60)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU71306 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2023-22797
CWE-601 Medium
No
No
7.0.4.1 18.01.2023 SB2023011833
SB20230816140
#VU71305 - Improper input validation
CVE-2022-44566
CWE-20 Medium
No
No
6.1.7.1, 7.0.4.1 18.01.2023 SB2023011833
SB2023022358
SB2023022503
and 5 more
#VU71304 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-22794
CWE-89 High
No
No
6.0.6.1, 6.1.7.1, 7.0.4.1 18.01.2023 SB2023011833
SB20230816140
SB2023112747
and 2 more
#VU71303 - Improper input validation
CVE-2023-22796
CWE-20 Medium
No
No
6.1.7.1, 7.0.4.1 18.01.2023 SB2023011833
SB2023020662
SB2023030334
and 7 more
#VU61220 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-21831
CWE-94 High
No
No
5.2.6.3, 6.0.4.7, 6.1.4.7, 7.0.2.3 09.03.2022 SB2022030919
#VU53004 - Use After Free
CVE-2021-22904
CWE-416 Medium
No
No
5.2.4.6, 5.2.6, 6.0.3.7, 6.1.3.2 10.05.2021 SB2021051012
SB2021061020
SB2022062023
and 2 more
#VU53003 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2021-22903
CWE-601 Medium
No
No
6.1.3.2 10.05.2021 SB2021051013
#VU53002 - Use After Free
CVE-2021-22902
CWE-416 Medium
No
No
6.0.3.7, 6.1.0.2 10.05.2021 SB2021051011
SB2022091605
#VU53001 - Exposure of sensitive information to an unauthorized actor
CVE-2021-22885
CWE-200 Medium
No
No
5.2.4.6, 5.2.6, 6.0.3.7, 6.1.3.2 10.05.2021 SB2021051012
SB2021061020
SB2021051939
and 4 more
#VU50607 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2021-22881
CWE-601 Low
No
No
6.0.3.5, 6.1.2.1 11.02.2021 SB2021021104
SB2021030562
#VU50606 - Incorrect Regular Expression
CVE-2021-22880
CWE-185 Medium
No
No
5.2.4.5, 6.0.3.5, 6.1.2.1 11.02.2021 SB2021021104
SB2021061020
SB2021100413
and 3 more
#VU23688 - Information Exposure Through Timing Discrepancy
CVE-2019-16782
CWE-208 Medium
No
No
5.2.4.1, 6.0.2.1 19.12.2019 SB2019121904
SB2019121905
SB2020021222
and 5 more
#VU8585 - Resource exhaustion
CVE-2016-0751
CWE-400 Low
No
No
- 22.09.2017 SB2016042501
SB2016013103
SB2016021014
#VU8569 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2016-2097
CWE-22 Medium
No
No
- 22.09.2017 SB2016031602
SB2016031003
SB2016032201
and 3 more
#VU8575 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-6316
CWE-79 Low
No
No
- 14.09.2016 SB2016091402
SB2016082603
SB2016081711
and 4 more
#VU8567 - Improper Control of Generation of Code ('Code Injection')
CVE-2016-2098
CWE-94 High
Available
No
- 16.03.2016 SB2016031601
SB2016031003
SB2016032301
and 7 more
#VU8568 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2016-0752
CWE-22 Medium
Available
Exploited
- 16.02.2016 SB2016021701
SB2016031003
SB2016042501
and 3 more
#VU8579 - Covert Timing Channel
CVE-2015-7576
CWE-385 Low
No
No
- 26.01.2016 SB2016012702
SB2016042501
SB2016013103
and 3 more
#VU8580 - Permissions, Privileges, and Access Controls
CVE-2015-7577
CWE-264 Low
No
No
- 26.01.2016 SB2016012702
SB2016042501
SB2016013106
and 1 more
#VU8581 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2015-7578
CWE-79 Low
No
No
- 26.01.2016 SB2016012702
SB2016020903
SB2016020701
and 3 more


Showing elements 21 - 40 out of 60