Browse / Ruby on Rails

Ruby on Rails

See its reports on the map

What gets reported to Ruby on Rails

• Cross-site Scripting22
• Code Execution10
• Denial of Service9
• Path Traversal5
• Other weaknesses5
• Information Disclosure5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. File writing by Directory traversal at actionpack-page_caching and RCE by itPath Traversal · high
   $1,00080 votes
2. ActiveStorage Disk Service Path Traversal via Custom Blob Key InjectionPath Traversal · medium
   57 votes
3. XSS when using `translate` in Action Controller (Rails 7.0, 7.1)Cross-site Scripting (XSS) - Generic · low
   50 votes
4. Rack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookiesReliance on Cookies without Validation and Integrity Checking in a Security Decision · low
   46 votes
5. XSS vulnerabilities due to missing checks in tag helpersCross-site Scripting (XSS) - Generic · medium
   41 votes
6. RCE which may occur due to `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor` (especially Active storage)Command Injection - Generic · high
   $1,50041 votes
7. Path Traversal on Default Installed Rails Application (Asset Pipeline)Path Traversal · medium
   $1,50038 votes
8. Action Text XSS (Rails 7.1.x)Cross-site Scripting (XSS) - Stored · medium
   33 votes
9. Regular expression denial of service in ActiveRecord's PostgreSQL Money typeUncontrolled Resource Consumption · medium
   33 votes
10. Action Text ReDoS (Ruby 3.1 or lower)Uncontrolled Resource Consumption · low
    28 votes
11. Argument/Code Injection via ActiveStorage's image transformation functionalityCode Injection · high
    27 votes
12. DoS with crafted "Range" headerUncontrolled Resource Consumption · high
    24 votes
13. ActionView sanitize helper bypass leading to XSS using SVG tag.Cross-site Scripting (XSS) - Generic · medium
    24 votes
14. Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary MarkdownCross-site Scripting (XSS) - Stored · medium
    23 votes
15. Rails::HTML::Sanitizer.allowed_uri? returns true for entity-encoded control-character-split javascript: URLslow
    23 votes
16. Validation bypass for queries generated for PostgreSQLImproper Access Control - Generic
    $1,50021 votes
17. Content Security Policy is only active for HTML responses but not for image/svg+xmlCross-site Scripting (XSS) - Stored
    20 votes
18. Open Redirect (6.0.0 < rails < 6.0.3.2)Open Redirect · high
    $1,00019 votes
19. Possible DoS in NumberHelpersUncontrolled Resource Consumption · medium
    18 votes
20. ReDoS in Rack::Multiparthigh
    18 votes
21. XSS vulnerability in sanitize-method when parsing link's hrefCross-site Scripting (XSS) - Generic · medium
    18 votes
22. Subdomain Takeover at https://new.rubyonrails.org/Privilege Escalation · high
    17 votes
23. Specially constructed multi-part requests cause multi-second response times; vulnerable to DoSUncontrolled Resource Consumption · medium
    17 votes
24. Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability.Cross-site Scripting (XSS) - Reflected · medium
    15 votes
25. URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tagCross-site Scripting (XSS) - Reflected · medium
    13 votes
26. Missing resource identifier encoding may lead to security vulnerabilitiesInformation Disclosure · medium
    13 votes
27. XSS due to incomplete JS escapingCross-site Scripting (XSS) - Generic · low
    13 votes
28. RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1Code Injection
    13 votes
29. ReDoS (Rails::Html::PermitScrubber.scrub_attribute)
    11 votes
30. redirect_to(["string"]) remote code executionInformation Exposure Through an Error Message · low
    9 votes
31. Nested attributes reject_if proc can be circumvented by providing "_destroy" parameterhigh
    9 votes
32. Explicit, dynamic render path: Dir. Trav + RCECode Injection · high
    $5009 votes
33. Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style)Cross-site Scripting (XSS) - Generic · medium
    8 votes
34. Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tagCross-site Scripting (XSS) - Generic · medium
    8 votes
35. ActiveStorage service's signed URLs can be hijacked via AppCache+Cookie stuffing trick when using GCS or DiskServiceInformation Disclosure · high
    8 votes
36. JSON keys are not properly escapedCross-site Scripting (XSS) - Generic · high
    8 votes
37. Denial of Service in Action Pack Exception HandlingUncontrolled Resource Consumption
    8 votes
38. Directory traversal attack in view resolverInformation Disclosure
    8 votes
39. Incomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations)Cross-site Scripting (XSS) - Generic · medium
    7 votes
40. HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection.Open Redirect · low
    7 votes
41. The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routesCross-Site Request Forgery (CSRF) · medium
    7 votes
42. Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypassImproper Access Control - Generic
    7 votes
43. Remote code execution using render :inlineCode Injection
    $1,5007 votes
44. http_basic_authenticate_with is suseptible to timing attacks.Improper Authentication - Generic
    7 votes
45. Regarding [CVE-2016-0752] Possible Information Leak Vulnerability in Action ViewCode Injection
    6 votes
46. Data-Tags and the New HTML Sanitizer Subverts CSRF protectionCross-site Scripting (XSS) - Generic
    6 votes
47. Server-side template injection at ujs test serverCommand Injection - Generic
    5 votes
48. ActiveStorage direct upload fails to sign content-length header for S3 serviceClient-Side Enforcement of Server-Side Security · medium
    5 votes
49. Validation bypass for Active Record and Active ModelViolation of Secure Design Principles · medium
    5 votes
50. Potential XSS on sanitize/Rails::Html::WhiteListSanitizerCross-site Scripting (XSS) - Generic
    5 votes
51. Arbitrary file existence disclosure in Action PackInformation Disclosure
    5 votes
52. ActionController::Parameters .each returns an unsafe hashmedium
    4 votes
53. Possible DOS in app with crashing `exceptions_app`Uncontrolled Resource Consumption · medium
    3 votes
54. XSS by file (Active Storage `Proxying`)Cross-site Scripting (XSS) - Stored · medium
    $5003 votes
55. Untrusted users able to run pending migrations in productionUncontrolled Resource Consumption · medium
    3 votes
56. DoS Attack in Controller Lookup CodeUncontrolled Resource Consumption
    3 votes
57. [Rails42] We can inject HTML tags when server is using strip_tags methodCross-site Scripting (XSS) - Generic
    3 votes
58. rails-ujs will send CSRF tokens to other originsCross-Site Request Forgery (CSRF)
    3 votes
59. Escape Sequence Injection vulnerability in RackCode Injection · medium
    2 votes
60. Untrusted strings that are cache fetched with raw option are automatically marshal loadedDeserialization of Untrusted Data · high
    2 votes
61. CSRF header is sent to external websites when using data-remote formsCross-Site Request Forgery (CSRF) · low
    2 votes
62. Active Record SQL Injection Vulnerability Affecting PostgreSQLSQL Injection
    2 votes
63. Active Record SQL Injection Vulnerability Affecting PostgreSQLSQL Injection
    2 votes