You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activerecord-5.2.8.1.gem
Dependency Hierarchy:
rails-5.2.8.1.gem (Root Library)
❌ activerecord-5.2.8.1.gem (Vulnerable Library)
Found in base branch: main
Vulnerability Details
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the annotate query method, the optimizer_hints query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/globalid-1.0.0.gem
Dependency Hierarchy:
rails-5.2.8.1.gem (Root Library)
activejob-5.2.8.1.gem
❌ globalid-1.0.0.gem (Vulnerable Library)
Found in base branch: main
Vulnerability Details
A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.
Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activerecord-5.2.8.1.gem
Dependency Hierarchy:
rails-5.2.8.1.gem (Root Library)
❌ activerecord-5.2.8.1.gem (Vulnerable Library)
Found in base branch: main
Vulnerability Details
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.
Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
Path to vulnerable library: /cache/rails-5.2.8.1.gem
Dependency Hierarchy:
❌ rails-5.2.8.1.gem (Vulnerable Library)
Found in base branch: main
Vulnerability Details
A Possible XSS Security Vulnerability was discovered in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. All versions before 6.1.7.3 and 7.x before 7.0.4.3 are affected.
Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
Path to vulnerable library: /cache/rails-5.2.8.1.gem
Dependency Hierarchy:
❌ rails-5.2.8.1.gem (Vulnerable Library)
Found in base branch: main
Vulnerability Details
There is a potential DOM based cross-site scripting issue in rails-ujs from 5.1.0 before 6.1.7.3 and 7.0.0 before 7.0.4.3, which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.
Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
Path to vulnerable library: /cache/rails-5.2.8.1.gem
Dependency Hierarchy:
❌ rails-5.2.8.1.gem (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.
mend-for-github-combot
changed the title
rails-5.2.8.1.gem: 1 vulnerabilities (highest severity is: 5.5)
rails-5.2.8.1.gem: 3 vulnerabilities (highest severity is: 5.5)
Jan 23, 2023
mend-for-github-combot
changed the title
rails-5.2.8.1.gem: 3 vulnerabilities (highest severity is: 5.5)
rails-5.2.8.1.gem: 3 vulnerabilities (highest severity is: 9.8)
Jan 24, 2023
mend-for-github-combot
changed the title
rails-5.2.8.1.gem: 3 vulnerabilities (highest severity is: 9.8)
rails-5.2.8.1.gem: 3 vulnerabilities (highest severity is: 8.8)
Mar 8, 2023
mend-for-github-combot
changed the title
rails-5.2.8.1.gem: 3 vulnerabilities (highest severity is: 8.8)
rails-5.2.8.1.gem: 4 vulnerabilities (highest severity is: 8.8)
Mar 16, 2023
mend-for-github-combot
changed the title
rails-5.2.8.1.gem: 4 vulnerabilities (highest severity is: 8.8)
rails-5.2.8.1.gem: 5 vulnerabilities (highest severity is: 8.8)
Mar 22, 2023
mend-for-github-combot
changed the title
rails-5.2.8.1.gem: 5 vulnerabilities (highest severity is: 8.8)
rails-5.2.8.1.gem: 6 vulnerabilities (highest severity is: 8.8)
Mar 3, 2024
mend-for-github-combot
changed the title
rails-5.2.8.1.gem: 6 vulnerabilities (highest severity is: 8.8)
rails-5.2.8.1.gem: 5 vulnerabilities (highest severity is: 8.8)
Mar 25, 2024
mend-for-github-combot
changed the title
rails-5.2.8.1.gem: 5 vulnerabilities (highest severity is: 8.8)
rails-5.2.8.1.gem: 6 vulnerabilities (highest severity is: 8.8)
Apr 8, 2024
Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
Library home page: https://rubygems.org/gems/rails-5.2.8.1.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /cache/rails-5.2.8.1.gem
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - activerecord-5.2.8.1.gem
Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.
Library home page: https://rubygems.org/gems/activerecord-5.2.8.1.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activerecord-5.2.8.1.gem
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the
annotate
query method, theoptimizer_hints
query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.Publish Date: 2023-02-09
URL: CVE-2023-22794
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.2%
CVSS 3 Score Details (8.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-hq7p-j377-6v63
Release Date: 2023-02-09
Fix Resolution: activerecord - 6.0.6.1,6.1.7.1,7.0.4.1
Vulnerable Library - globalid-1.0.0.gem
URIs for your models makes it easy to pass references around.
Library home page: https://rubygems.org/gems/globalid-1.0.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/globalid-1.0.0.gem
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.
Publish Date: 2023-02-09
URL: CVE-2023-22799
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-23c2-gwp5-pxw9
Release Date: 2023-02-09
Fix Resolution: globalid - 1.0.1
Vulnerable Library - activerecord-5.2.8.1.gem
Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.
Library home page: https://rubygems.org/gems/activerecord-5.2.8.1.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activerecord-5.2.8.1.gem
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.
Publish Date: 2023-02-09
URL: CVE-2022-44566
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-579w-22j4-4749
Release Date: 2023-02-09
Fix Resolution: activerecord - 6.1.7.1,7.0.4.1
Vulnerable Library - rails-5.2.8.1.gem
Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
Library home page: https://rubygems.org/gems/rails-5.2.8.1.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /cache/rails-5.2.8.1.gem
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
A Possible XSS Security Vulnerability was discovered in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. All versions before 6.1.7.3 and 7.x before 7.0.4.3 are affected.
Publish Date: 2023-03-11
URL: CVE-2023-28120
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469
Release Date: 2023-03-11
Fix Resolution: rails - 6.1.7.3,7.0.4.3
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - rails-5.2.8.1.gem
Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
Library home page: https://rubygems.org/gems/rails-5.2.8.1.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /cache/rails-5.2.8.1.gem
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
There is a potential DOM based cross-site scripting issue in rails-ujs from 5.1.0 before 6.1.7.3 and 7.0.0 before 7.0.4.3, which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.
Publish Date: 2023-01-20
URL: CVE-2023-23913
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468
Release Date: 2023-01-20
Fix Resolution: rails - 6.1.7.3,7.0.4.3
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - rails-5.2.8.1.gem
Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
Library home page: https://rubygems.org/gems/rails-5.2.8.1.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /cache/rails-5.2.8.1.gem
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.
Publish Date: 2024-02-27
URL: CVE-2024-26144
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.0%
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-8h22-8cf7-hq6g
Release Date: 2024-02-27
Fix Resolution: rails - 6.1.7.7,7.0.8.1
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: