Browse / Ruby on Rails

Ruby on Rails

See its reports on the map

What gets reported to Ruby on Rails

• Cross-site Scripting22
• Code Execution10
• Denial of Service9
• Path Traversal5
• Other weaknesses5
• Information Disclosure5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. File writing by Directory traversal at actionpack-page_caching and RCE by itPath Traversal · high
   $1,00080 votes
2. 1-Click Cross-Site Scripting via Custom Configuration in SafeListSanitizerInformativeCross-site Scripting (XSS) - Generic · medium
   70 votes
3. ActiveStorage Disk Service Path Traversal via Custom Blob Key InjectionPath Traversal · medium
   57 votes
4. XSS when using `translate` in Action Controller (Rails 7.0, 7.1)Cross-site Scripting (XSS) - Generic · low
   50 votes
5. Rack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookiesReliance on Cookies without Validation and Integrity Checking in a Security Decision · low
   46 votes
6. XSS vulnerabilities due to missing checks in tag helpersCross-site Scripting (XSS) - Generic · medium
   41 votes
7. RCE which may occur due to `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor` (especially Active storage)Command Injection - Generic · high
   $1,50041 votes
8. Path Traversal on Default Installed Rails Application (Asset Pipeline)Path Traversal · medium
   $1,50038 votes
9. Path traversal in AcitveStorage, and lead RCEInformativePath Traversal · high
   37 votes
10. Action Text XSS (Rails 7.1.x)Cross-site Scripting (XSS) - Stored · medium
    33 votes
11. Regular expression denial of service in ActiveRecord's PostgreSQL Money typeUncontrolled Resource Consumption · medium
    33 votes
12. Active Storage Vips Transformer Missing validate_transformation — CVE-2025-24293 Incomplete FixInformativePath Traversal · high
    30 votes
13. Action Text ReDoS (Ruby 3.1 or lower)Uncontrolled Resource Consumption · low
    28 votes
14. Argument/Code Injection via ActiveStorage's image transformation functionalityCode Injection · high
    27 votes
15. DoS with crafted "Range" headerUncontrolled Resource Consumption · high
    24 votes
16. ActionView sanitize helper bypass leading to XSS using SVG tag.Cross-site Scripting (XSS) - Generic · medium
    24 votes
17. Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary MarkdownCross-site Scripting (XSS) - Stored · medium
    23 votes
18. Rails::HTML::Sanitizer.allowed_uri? returns true for entity-encoded control-character-split javascript: URLslow
    23 votes
19. Sauce Labs API key unencrypted in an old commitDuplicateUse of Hard-coded Cryptographic Key · medium
    23 votes
20. Validation bypass for queries generated for PostgreSQLImproper Access Control - Generic
    $1,50021 votes
21. Content Security Policy is only active for HTML responses but not for image/svg+xmlCross-site Scripting (XSS) - Stored
    20 votes
22. Open Redirect (6.0.0 < rails < 6.0.3.2)Open Redirect · high
    $1,00019 votes
23. Possible DoS in NumberHelpersUncontrolled Resource Consumption · medium
    18 votes
24. ReDoS in Rack::Multiparthigh
    18 votes
25. XSS vulnerability in sanitize-method when parsing link's hrefCross-site Scripting (XSS) - Generic · medium
    18 votes
26. Subdomain Takeover at https://new.rubyonrails.org/Privilege Escalation · high
    17 votes
27. Specially constructed multi-part requests cause multi-second response times; vulnerable to DoSUncontrolled Resource Consumption · medium
    17 votes
28. ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754InformativeCross-site Scripting (XSS) - Reflected · medium
    15 votes
29. Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability.Cross-site Scripting (XSS) - Reflected · medium
    15 votes
30. URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tagCross-site Scripting (XSS) - Reflected · medium
    13 votes
31. Missing resource identifier encoding may lead to security vulnerabilitiesInformation Disclosure · medium
    13 votes
32. XSS due to incomplete JS escapingCross-site Scripting (XSS) - Generic · low
    13 votes
33. RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1Code Injection
    13 votes
34. ReDoS (Rails::Html::PermitScrubber.scrub_attribute)
    11 votes
35. redirect_to(["string"]) remote code executionInformation Exposure Through an Error Message · low
    9 votes
36. Nested attributes reject_if proc can be circumvented by providing "_destroy" parameterhigh
    9 votes
37. Explicit, dynamic render path: Dir. Trav + RCECode Injection · high
    $5009 votes
38. Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style)Cross-site Scripting (XSS) - Generic · medium
    8 votes
39. Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tagCross-site Scripting (XSS) - Generic · medium
    8 votes
40. ActiveStorage service's signed URLs can be hijacked via AppCache+Cookie stuffing trick when using GCS or DiskServiceInformation Disclosure · high
    8 votes
41. JSON keys are not properly escapedCross-site Scripting (XSS) - Generic · high
    8 votes
42. Denial of Service in Action Pack Exception HandlingUncontrolled Resource Consumption
    8 votes
43. Directory traversal attack in view resolverInformation Disclosure
    8 votes
44. Incomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations)Cross-site Scripting (XSS) - Generic · medium
    7 votes
45. HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection.Open Redirect · low
    7 votes
46. The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routesCross-Site Request Forgery (CSRF) · medium
    7 votes
47. Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypassImproper Access Control - Generic
    7 votes
48. Remote code execution using render :inlineCode Injection
    $1,5007 votes
49. http_basic_authenticate_with is suseptible to timing attacks.Improper Authentication - Generic
    7 votes
50. HTTP Host injection in redirect_to functionInformativeImproper Neutralization of HTTP Headers for Scripting Syntax
    6 votes
51. Regarding [CVE-2016-0752] Possible Information Leak Vulnerability in Action ViewCode Injection
    6 votes
52. Data-Tags and the New HTML Sanitizer Subverts CSRF protectionCross-site Scripting (XSS) - Generic
    6 votes
53. Server-side template injection at ujs test serverCommand Injection - Generic
    5 votes
54. ActiveStorage direct upload fails to sign content-length header for S3 serviceClient-Side Enforcement of Server-Side Security · medium
    5 votes
55. XSS by MathML at Active StorageDuplicateCross-site Scripting (XSS) - Stored · medium
    5 votes
56. Validation bypass for Active Record and Active ModelViolation of Secure Design Principles · medium
    5 votes
57. Potential XSS on sanitize/Rails::Html::WhiteListSanitizerCross-site Scripting (XSS) - Generic
    5 votes
58. Arbitrary file existence disclosure in Action PackInformation Disclosure
    5 votes
59. Regex Injection from request header (Rack::Sendfile, send_file)InformativeCode Injection
    4 votes
60. ActionController::Parameters .each returns an unsafe hashmedium
    4 votes
61. Changeable model ids on vanilla update can lead to severely bad side-effectsInformativeViolation of Secure Design Principles
    4 votes
62. Possible DOS in app with crashing `exceptions_app`Uncontrolled Resource Consumption · medium
    3 votes
63. XSS by file (Active Storage `Proxying`)Cross-site Scripting (XSS) - Stored · medium
    $5003 votes
64. Untrusted users able to run pending migrations in productionUncontrolled Resource Consumption · medium
    3 votes
65. DoS Attack in Controller Lookup CodeUncontrolled Resource Consumption
    3 votes
66. [Rails42] We can inject HTML tags when server is using strip_tags methodCross-site Scripting (XSS) - Generic
    3 votes
67. rails-ujs will send CSRF tokens to other originsCross-Site Request Forgery (CSRF)
    3 votes
68. Escape Sequence Injection vulnerability in RackCode Injection · medium
    2 votes
69. Prevent XSS when passing a parameter directly into link_to InformativeCross-site Scripting (XSS) - DOM · low
    2 votes
70. Untrusted strings that are cache fetched with raw option are automatically marshal loadedDeserialization of Untrusted Data · high
    2 votes
71. CSRF header is sent to external websites when using data-remote formsCross-Site Request Forgery (CSRF) · low
    2 votes
72. Active Record SQL Injection Vulnerability Affecting PostgreSQLSQL Injection
    2 votes
73. Active Record SQL Injection Vulnerability Affecting PostgreSQLSQL Injection
    2 votes