Known vulnerabilities in Ruby on Rails - page 3

Vendor: Rails
Software: Ruby on Rails
Software CPE: cpe:2.3:a:rails:ruby_on_rails:*:*:*:*:*:*:*:*
Total vulnerabilities: 60
Public exploits: 5
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ruby on Rails Ruby on Rails is affected by 60 known vulnerabilities: 4 high, 35 medium, 21 low Critical High Medium Low

Vulnerabilities (60)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU116187 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2013-0333
CWE-89 Medium
Available
Exploited
2.3.16, 3.0.20 30.09.2025 SB2013013001
#VU116186 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-3464
CWE-79 Medium
No
No
3.0.17, 3.1.8, 3.2.8 30.09.2025 SB2012081002
#VU116169 - XML Injection
CVE-2015-3227
CWE-91 Medium
No
No
4.1.11, 4.2.2 29.09.2025 SB2015072708
#VU116167 - Permissions, Privileges, and Access Controls
CVE-2012-2660
CWE-264 Medium
No
No
3.0.13, 3.1.5, 3.2.4 29.09.2025 SB2012062226
#VU116162 - NULL Pointer Dereference
CVE-2012-2694
CWE-476 Medium
No
No
3.0.14, 3.1.6, 3.2.6 29.09.2025 SB2012062225
#VU116160 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-3465
CWE-79 Medium
No
No
3.0.17, 3.1.8, 3.2.8 29.09.2025 SB2012081001
#VU116156 - Improper input validation
CVE-2011-3187
CWE-20 Medium
Available
No
3.0.6 29.09.2025 SB2011082908
#VU116155 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2014-0081
CWE-79 Medium
No
No
3.2.17, 4.0.3, 4.1.0.beta2 29.09.2025 SB2014022005
#VU116153 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2012-2695
CWE-89 Medium
No
No
3.0.14, 3.1.6, 3.2.6 29.09.2025 SB2012062224
#VU116152 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2012-2661
CWE-89 Medium
No
No
3.0.13, 3.1.5, 3.2.4 29.09.2025 SB2012062223
#VU116149 - Improper input validation
CVE-2013-3221
CWE-20 Medium
No
No
4.0.0 29.09.2025 SB2013042220
#VU116148 - Deserialization of Untrusted Data
CVE-2013-0277
CWE-502 High
No
No
2.3.17, 3.1.0 29.09.2025 SB2013021310
#VU8576 - Improper input validation
CVE-2016-6317
CWE-20 Low
No
No
- 14.09.2016 SB2016012701
SB2016081711
SB2016081902
and 1 more
#VU8586 - Permissions, Privileges, and Access Controls
CVE-2016-0753
CWE-264 Low
No
No
- 16.02.2016 SB2016012702
SB2016042501
SB2016013104
and 4 more
#VU8582 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2015-7579
CWE-79 Low
No
No
- 26.01.2016 SB2016012702
SB2016020903
SB2016020701
and 3 more
#VU8583 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2015-7580
CWE-79 Low
No
No
- 26.01.2016 SB2016012702
SB2016020903
SB2016020701
and 3 more
#VU8584 - Improper input validation
CVE-2015-7581
CWE-20 Low
No
No
- 26.01.2016 SB2016012702
SB2016042501
SB2016013103
and 1 more
#VU32877 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2013-1855
CWE-79 Low
No
No
2.3.18, 3.1.12, 3.2.13 20.03.2013 SB2013032001
SB2013041204
#VU32878 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2013-1857
CWE-79 Low
No
No
2.3.18, 3.1.12, 3.2.13 20.03.2013 SB2013032002
SB2013041205
#VU31841 - Improper input validation
CVE-2013-0156
CWE-20 Medium
Available
No
3.1.10 14.01.2013 SB2013011401
SB2013011810


Showing elements 41 - 60 out of 60