Most recent entries from all

bdu:2019-01506

certfr-2019-avi-111 — De multiples vulnérabilités ont été découvertes dans Ruby On Rails. Elles permettent à un attaquant de provoquer une ex…

certfr-2019-avi-111

cnvd-2019-07446

EUVD-2026-256239

fkie_cve-2019-5418

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

GHSA-86g5-2wh3-gc9j — Path Traversal in Action View

Affected: RubyGems: actionview

# File Content Disclosure in Action View

Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.

The impact is limited to calls to `render` which render file contents without a specified accept format. Impacted code in a controller looks something like this:

``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end ```

Rendering templates as opposed to files is not impacted by this vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this:

``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end ```

In summary, impacted calls to `render` look like this:

``` render file: "#{Rails.root}/some/file" ```

The vulnerability can be mitigated by changing to this:

``` render file: "#{Rails.root}/some/file", formats: [:html] ```

Other calls to `render` are not impacted.

Alternatively, the following monkey pa…

gsd-2019-5418

openSUSE-SU-2019:1344-1 — Security update for rubygem-actionpack-5_1

Security update for rubygem-actionpack-5_1

RHSA-2019:0796 — Red Hat Security Advisory: CloudForms 4.7.3 security, bug fix and enhancement update

Tower: credentials leaked through environment variables rubygem-actionpack: render file directory traversal in Action View rubygem-actionpack: denial of service vulnerability in Action View

SUSE-SU-2019:0915-1 — Security update for rubygem-actionpack-4_2

Security update for rubygem-actionpack-4_2

UBUNTU-CVE-2019-5418

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails

WID-SEC-W-2025-1467 — Ruby on Rails: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Informationen offenzulegen, einen Denial of Service Zustand hervorzurufen oder beliebigen Programmcode auszuführen.