.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

actionpack 5.2.6 vulnerabilities

62 advisories known · actionpack@5.2.6 · 8 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 5.2.6

SEVERITYADVISORYPUBLISHED

HighExposure of information in Action PackGHSA-wh98-p28r-vrc9CVE-2022-23633Affected >=5.0.0.0 <5.2.6.2, >=6.0.0.0 <6.0.4.6, >=6.1.0.0 <6.1.4.6, >=7.0.0.0 <7.0.2.2Fixed in 5.2.6.2 Fixed in 6.0.4.6 Fixed in 6.1.4.6 Fixed in 7.0.2.2OSV source ↗5 years ago

MediumCross-site Scripting Vulnerability in Action PackGHSA-mm33-5vfq-3mm3CVE-2022-22577Affected >=5.2.0 <5.2.7.1, >=6.0.0 <6.0.4.8, >=6.1.0 <6.1.5.1, >=7.0.0 <7.0.2.4Fixed in 5.2.7.1 Fixed in 6.0.4.8 Fixed in 6.1.5.1 Fixed in 7.0.2.4OSV source ↗5 years ago

MediumPossible ReDoS vulnerability in HTTP Token authentication in Action ControllerGHSA-vfg9-r3fq-jvx4BIT-rails-2024-47887CVE-2024-47887Affected >=4.0.0 <6.1.7.9, >=7.0.0 <7.0.8.5, >=7.1.0 <7.1.4.1, >=7.2.0 <7.2.1.1Fixed in 6.1.7.9 Fixed in 7.0.8.5 Fixed in 7.1.4.1 Fixed in 7.2.1.1OSV source ↗2 years ago

MediumPossible ReDoS vulnerability in query parameter filtering in Action DispatchGHSA-x76w-6vjr-8xgjBIT-rails-2024-41128CVE-2024-41128Affected >=3.1.0 <6.1.7.9, >=7.0.0 <7.0.8.5, >=7.1.0 <7.1.4.1, >=7.2.0 <7.2.1.1Fixed in 6.1.7.9 Fixed in 7.0.8.5 Fixed in 7.1.4.1 Fixed in 7.2.1.1OSV source ↗2 years ago

MediumActionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_toGHSA-4g8v-vg43-wpgfCVE-2023-28362Affected <6.1.7.4, >=7.0.0 <7.0.5.1Fixed in 6.1.7.4 Fixed in 7.0.5.1OSV source ↗3 years ago

LowPossible Content Security Policy bypass in Action DispatchGHSA-vfm5-rmrh-j26vBIT-rails-2024-54133CVE-2024-54133Affected >=5.2.0 <7.0.8.7, >=7.1.0 <7.1.5.1, >=7.2.0 <7.2.2.1, >=8.0.0 <8.0.0.1Fixed in 7.0.8.7 Fixed in 7.1.5.1 Fixed in 7.2.2.1 Fixed in 8.0.0.1OSV source ↗2 years ago

LowReDoS based DoS vulnerability in Action DispatchGHSA-p84v-45xj-wwqjCVE-2023-22792Affected >=3.0.0 <5.2.8.15, >=6.0.0 <6.1.7.1, >=7.0.0 <7.0.4.1Fixed in 5.2.8.15 Fixed in 6.1.7.1 Fixed in 7.0.4.1OSV source ↗4 years ago

LowReDoS based DoS vulnerability in Action DispatchGHSA-8xww-x3g3-6jcvCVE-2023-22795Affected >=4.0.0.beta1 <6.1.7.1, >=7.0.0 <7.0.4.1Fixed in 6.1.7.1 Fixed in 7.0.4.1OSV source ↗4 years ago

Does not affect 5.2.6

SEVERITYADVISORYPUBLISHED

Highactionpack allows remote attackers to bypass intended access restrictionsGHSA-4ww3-3rxj-8v6qCVE-2011-0449Affected >=3.0.0 <3.0.4Fixed in 3.0.4OSV source ↗9 years ago

Highactionpack Improper Input Validation vulnerabilityGHSA-jmgw-6vjg-jjwgCVE-2013-0156Affected <2.3.15, >=3.0.0 <3.0.19, >=3.1.0 <3.1.10, >=3.2.0 <3.2.11Fixed in 2.3.15 Fixed in 3.0.19 Fixed in 3.1.10 Fixed in 3.2.11OSV source ↗9 years ago

HighPossible DoS Vulnerability in Action Controller Token AuthenticationGHSA-7wjx-3g7j-8584CVE-2021-22904Affected >=4.0.0 <5.2.4.6, >=5.2.5 <5.2.6, >=6.0.0 <6.0.3.7, >=6.1.0 <6.1.3.2Fixed in 5.2.4.6 Fixed in 5.2.6 Fixed in 6.0.3.7 Fixed in 6.1.3.2OSV source ↗6 years ago

HighAction Pack contains Information Disclosure / Unintended Method Execution vulnerabilityGHSA-hjg4-8q5f-x6fmCVE-2021-22885Affected >=2.0.0 <5.2.4.6, >=5.2.5 <5.2.6, >=6.0.0 <6.0.3.7, >=6.1.0 <6.1.3.2Fixed in 5.2.4.6 Fixed in 5.2.6 Fixed in 6.0.3.7 Fixed in 6.1.3.2OSV source ↗6 years ago

HighDenial of Service in Action DispatchGHSA-g8ww-46x2-2p65CVE-2021-22902Affected >=6.0.0 <6.0.3.7, >=6.1.0 <6.1.3.2Fixed in 6.0.3.7 Fixed in 6.1.3.2OSV source ↗6 years ago

HighPossible Strong Parameters Bypass in ActionPackGHSA-8727-m6gj-mc37CVE-2020-8164Affected >=5.0.0 <5.2.4.3, >=6.0.0 <6.0.3.1Fixed in 5.2.4.3 Fixed in 6.0.3.1OSV source ↗6 years ago

Highactionpack Path Traversal vulnerabilityGHSA-6x85-j5j2-27jxCVE-2014-0130Affected >=3.0.0 <3.2.18, >=4.0.0 <4.0.5, >=4.1.0 <4.1.1Fixed in 3.2.18 Fixed in 4.0.5 Fixed in 4.1.1OSV source ↗9 years ago

Highactionpack is vulnerable to denial of service because of a wildcard controller routeGHSA-9h6g-gp95-x3q5CVE-2015-7581Affected >=4.0.0 <4.2.5.1Fixed in 4.2.5.1OSV source ↗9 years ago

Highactionpack is vulnerable to denial of service via a crafted HTTP Accept headerGHSA-ffpv-c4hm-3x6vCVE-2016-0751Affected <3.2.22.1, >=4.0.0 <4.1.14.1, >=4.2.0 <4.2.5.1Fixed in 3.2.22.1 Fixed in 4.1.14.1 Fixed in 4.2.5.1OSV source ↗9 years ago

HighDirectory traversal vulnerability in Action View in Ruby on RailsGHSA-xrr4-p6fq-hjg7CVE-2016-0752Affected <3.2.22.1, >=4.0.0 <4.1.14.1, >=4.2.0 <4.2.5.1Fixed in 3.2.22.1 Fixed in 4.1.14.1 Fixed in 4.2.5.1OSV source ↗9 years ago

Highactionpack allows remote code execution via application's unrestricted use of render methodGHSA-78rc-8c29-p45gCVE-2016-2098Affected >=3.0.0 <3.2.22.2, >=4.0.0 <4.1.14.2, >=4.2.0 <4.2.5.2Fixed in 3.2.22.2 Fixed in 4.1.14.2 Fixed in 4.2.5.2OSV source ↗9 years ago

MediumUntrusted users can run pending migrations in production in RailsGHSA-c6qr-h5vq-59jcCVE-2020-8185Affected >=6.0.0 <6.0.3.2Fixed in 6.0.3.2OSV source ↗6 years ago

MediumRails has possible XSS Vulnerability in Action ControllerGHSA-9822-6m93-xqf4BIT-rails-2024-26143CVE-2024-26143Affected >=7.0.0 <7.0.8.1, >=7.1.0 <7.1.3.1Fixed in 7.0.8.1 Fixed in 7.1.3.1OSV source ↗3 years ago

MediumOpen Redirect Vulnerability in Action PackGHSA-9445-4cr6-336rCVE-2023-22797Affected >=7.0.0 <7.0.4.1Fixed in 7.0.4.1OSV source ↗4 years ago

MediumCross site scripting in actionpack RubygemGHSA-q58j-fmvf-9rq6CVE-2011-1497Affected >=3.0.0.rc <3.0.6Fixed in 3.0.6OSV source ↗5 years ago

Mediumactionpack Open Redirect in Host Authorization MiddlewareGHSA-qphc-hf5q-v8fcBIT-rails-2021-44528CVE-2021-44528Affected >=6.0.0 <6.0.4.2, >=6.1.0 <6.1.4.2Fixed in 6.0.4.2 Fixed in 6.1.4.2OSV source ↗5 years ago

MediumOpen Redirect in ActionPackGHSA-2rqw-v265-jf8cCVE-2021-22942Affected >=6.0.0 <6.0.4.1, >=6.1.0 <6.1.4.1Fixed in 6.0.4.1 Fixed in 6.1.4.1OSV source ↗5 years ago

MediumPossible Open Redirect Vulnerability in Action PackGHSA-5hq2-xf89-9jxqCVE-2021-22903Affected >=6.1.0.rc2 <6.1.3.2Fixed in 6.1.3.2OSV source ↗6 years ago

MediumCross-site scripting in actionpackGHSA-35mm-cc6r-8fjpCVE-2020-8264Affected >=6.0.0 <6.0.3.4Fixed in 6.0.3.4OSV source ↗6 years ago

MediumActionpack Open Redirect Vulnerability GHSA-8877-prq4-9xfwCVE-2021-22881Affected >=6.0.0 <6.0.3.5, >=6.1.0 <6.1.2.1Fixed in 6.0.3.5 Fixed in 6.1.2.1OSV source ↗6 years ago

Mediumactionpack Cross-Site Request Forgery vulnerabilityGHSA-24fg-p96v-hxh8CVE-2011-0447Affected >=2.1.0 <2.3.11, >=3.0.0 <3.0.4Fixed in 2.3.11 Fixed in 3.0.4OSV source ↗9 years ago

MediumCross-site Scripting in actionpackGHSA-2xjj-5x6h-8vmfCVE-2012-1099Affected >=3.0.0 <3.0.12, >=3.1.0 <3.1.4, >=3.2.0 <3.2.2Fixed in 3.0.12 Fixed in 3.1.4 Fixed in 3.2.2OSV source ↗9 years ago

Mediumactionpack Improper Input Validation vulnerabilityGHSA-3vfw-7rcp-3xgmCVE-2011-3187Affected >=2.3.0 <2.3.13Fixed in 2.3.13OSV source ↗9 years ago

MediumRails actionpack gem vulnerable to Cross-site ScriptingGHSA-75w6-p6mg-vh8jCVE-2011-0446Affected <2.3.11, >=3.0.0 <3.0.4Fixed in 2.3.11 Fixed in 3.0.4OSV source ↗9 years ago

MediumImproper Input Validation in actionpackGHSA-8fqx-7pv4-3jwmCVE-2008-7248Affected >=2.1.0 <2.1.3, >=2.2.0 <2.2.2Fixed in 2.1.3 Fixed in 2.2.2OSV source ↗9 years ago

MediumCross site scripting that affects railsGHSA-8qrh-h9m2-5fvfCVE-2009-3009Affected >=2.0.0 <2.2.3, >=2.3.0 <2.3.4Fixed in 2.2.3 Fixed in 2.3.4OSV source ↗9 years ago

Mediumactionpack Improper Authentication vulnerabilityGHSA-92w9-2pqw-rhjjCVE-2012-3424Affected <2.3.5, >=3.0.0.beta <3.0.16, >=3.1.0 <3.1.7, >=3.2.0 <3.2.7Fixed in 2.3.5 Fixed in 3.0.16 Fixed in 3.1.7 Fixed in 3.2.7OSV source ↗9 years ago

Mediumactionpack CRLF injection vulnerabilityGHSA-fcqf-h4h4-695mCVE-2011-3186Affected >=2.3.0 <2.3.13Fixed in 2.3.13OSV source ↗9 years ago

Mediumactionpack and activesupport vulnerable to information leaksGHSA-fg9w-g6m4-557jCVE-2009-3086Affected >=2.1.0 <2.2.3, >=2.3.0 <2.3.4Fixed in 2.2.3 Fixed in 2.3.4OSV source ↗9 years ago

MediumAction Pack contains database-query restrictions bypassGHSA-hgpp-pp89-4fgfCVE-2012-2660Affected <2.3.16, >=3.0.0.beta <3.0.13, >=3.1.0 <3.1.5, >=3.2.0 <3.2.4Fixed in 2.3.16 Fixed in 3.0.13 Fixed in 3.1.5 Fixed in 3.2.4OSV source ↗9 years ago

Mediumactionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted requestGHSA-q34c-48gc-m9g8CVE-2012-2694Affected >=3.0.13 <3.0.14, >=3.1.0 <3.1.6, >=3.2.0 <3.2.6Fixed in 3.0.14 Fixed in 3.1.6 Fixed in 3.2.6OSV source ↗9 years ago

Mediumactionpack Improper Input Validation vulnerabilityGHSA-r7q2-5gqg-6c7qCVE-2011-2929Affected >=3.0.0 <3.0.10Fixed in 3.0.10OSV source ↗9 years ago

Mediumactionpack Cross-site Scripting vulnerabilityGHSA-v5jg-558j-q67cCVE-2011-2931Affected >=2.0.0 <2.3.13, >=3.0.0 <3.0.10Fixed in 2.3.13 Fixed in 3.0.10OSV source ↗9 years ago

Mediumrails Cross-site Scripting vulnerabilityGHSA-v9v4-7jp6-8c73CVE-2011-2197Affected >=2.0.0 <2.3.12, >=3.0.0 <3.0.8Fixed in 2.3.12 Fixed in 3.0.8OSV source ↗9 years ago

MediumCross-site Scripting vulnerability in i18n translations helper methodGHSA-xxr8-833v-c7wcCVE-2011-4319Affected >=3.0.0 <3.0.11, >=3.1.0 <3.1.2Fixed in 3.0.11 Fixed in 3.1.2OSV source ↗9 years ago

Mediumactionpack vulnerable to Cross-site ScriptingGHSA-699m-mcjm-9cw8CVE-2013-4491Affected >=3.0.0 <3.2.16, >=4.0.0 <4.0.2Fixed in 3.2.16 Fixed in 4.0.2OSV source ↗9 years ago

Mediumactionpack Cross-site Scripting vulnerabilityGHSA-7g65-ghrg-hpf5CVE-2012-3465Affected <2.3.16, >=3.0.0.beta <3.0.17, >=3.1.0 <3.1.8, >=3.2.0 <3.2.8Fixed in 2.3.16 Fixed in 3.0.17 Fixed in 3.1.8 Fixed in 3.2.8OSV source ↗9 years ago

Mediumactionpack Cross-site Scripting vulnerabilityGHSA-98mf-8f57-64qfCVE-2012-3463Affected >=3.0 <3.0.17, >=3.1.0 <3.1.8, >=3.2.0 <3.2.8Fixed in 3.0.17 Fixed in 3.1.8 Fixed in 3.2.8OSV source ↗9 years ago

Mediumactionpack Cross-site Scripting vulnerabilityGHSA-j838-vfpq-fmf2CVE-2013-1857Affected <2.3.18, >=3.0.0 <3.1.12, >=3.2.0 <3.2.13Fixed in 2.3.18 Fixed in 3.1.12 Fixed in 3.2.13OSV source ↗9 years ago

Mediumactionpack Improper Input Validation vulnerabilityGHSA-mpxf-gcw2-pw5qCVE-2013-6414Affected >=3.0.0 <3.2.16, >=4.0.0 <4.0.2Fixed in 3.2.16 Fixed in 4.0.2OSV source ↗9 years ago

Mediumactionpack Cross-site Scripting vulnerabilityGHSA-q759-hwvc-m3jgCVE-2013-1855Affected <2.3.18, >=3.0.0 <3.1.12, >=3.2.0 <3.2.13Fixed in 2.3.18 Fixed in 3.1.12 Fixed in 3.2.13OSV source ↗9 years ago

Mediumactionpack vulnerable to Path TraversalGHSA-29gr-w57f-rpfwCVE-2014-7818Affected >=3.0.0 <3.2.20, >=4.0.0 <4.0.11, >=4.1.0 <4.1.7, >=4.2.0.beta1 <4.2.0.beta3Fixed in 3.2.20 Fixed in 4.0.11 Fixed in 4.1.7 Fixed in 4.2.0.beta3OSV source ↗9 years ago

Mediumactionpack vulnerable to Cross-site ScriptingGHSA-6h5q-96hp-9jgmCVE-2013-6415Affected >=3.0.0 <3.2.16, >=4.0.0 <4.0.2Fixed in 3.2.16 Fixed in 4.0.2OSV source ↗9 years ago

Mediumactionpack Improper Input Validation vulnerabilityGHSA-7cgp-c3g7-qvrwCVE-2014-0082Affected >=3.0.0 <3.2.17Fixed in 3.2.17OSV source ↗9 years ago

MediumDirectory traversal vulnerability in actionpackGHSA-h56m-vwxc-3qpwCVE-2014-7829Affected >=3.0.0 <3.2.21, >=4.0.0 <4.0.12, >=4.1.0 <4.1.8, >=4.2.0.beta1 <4.2.0.beta4Fixed in 3.2.21 Fixed in 4.0.12 Fixed in 4.1.8 Fixed in 4.2.0.beta4OSV source ↗9 years ago

MediumRails vulnerable to Cross-site ScriptingGHSA-m46p-ggm5-5j83CVE-2014-0081Affected >=3.0.0 <3.2.17, >=4.0.0 <4.0.3Fixed in 3.2.17 Fixed in 4.0.3OSV source ↗9 years ago

Mediumactionpack Cross-site Scripting vulnerabilityGHSA-w37c-q653-qg95CVE-2013-6416Affected >=4.0.0 <4.0.2Fixed in 4.0.2OSV source ↗9 years ago

Mediumactionpack allows bypass of database-query restrictionsGHSA-wpw7-wxjm-cw8rCVE-2013-6417Affected >=3.0.0 <3.2.16, >=4.0.0 <4.0.2Fixed in 3.2.16 Fixed in 4.0.2OSV source ↗9 years ago

MediumMissing security headers in Action Pack on non-HTML responsesGHSA-fwhr-88qx-h9g7BIT-rails-2024-28103CVE-2024-28103Affected >=6.1.0 <6.1.7.8, >=7.0.0 <7.0.8.4, >=7.1.0 <7.1.3.4, >=7.2.0.beta1 <7.2.0.beta2Fixed in 6.1.7.8 Fixed in 7.0.8.4 Fixed in 7.1.3.4 Fixed in 7.2.0.beta2OSV source ↗2 years ago

Mediumactionview contains Path Traversal vulnerabilityGHSA-vx9j-46rh-fqr8CVE-2016-2097Affected >=3.0.0 <3.2.22.2, >=4.0.0 <4.1.14.2Fixed in 3.2.22.2 Fixed in 4.1.14.2OSV source ↗9 years ago

MediumAbility to forge per-form CSRF tokens in RailsGHSA-jp5v-5gx4-jmj9CVE-2020-8166Affected >=5.0.0 <5.2.4.3, >=6.0.0 <6.0.3.1Fixed in 5.2.4.3 Fixed in 6.0.3.1OSV source ↗6 years ago

Lowactionpack is vulnerable to remote bypass authenticationGHSA-p692-7mm3-3fxgCVE-2015-7576Affected >=3.1.0 <3.2.22.1, >=4.0.0 <4.1.14.1Fixed in 3.2.22.1 Fixed in 4.1.14.1OSV source ↗9 years ago

LowRails has a possible XSS vulnerability in its Action Pack debug exceptionsGHSA-pgm4-439c-5jp6CVE-2026-33167Affected >=8.1.0 <8.1.2.1Fixed in 8.1.2.1OSV source ↗8 months ago

LowRails has possible ReDoS vulnerability in Accept header parsing in Action DispatchGHSA-jjhx-jhvp-74wqBIT-rails-2024-26142CVE-2024-26142Affected >=7.1.0 <7.1.3.1Fixed in 7.1.3.1OSV source ↗3 years ago