Most recent entries from all

bdu:2021-03552

certfr-2020-avi-567 — Une vulnérabilité a été découverte dans Ruby on Rails. Elle permet à un attaquant de provoquer une injection de code in…

certfr-2020-avi-567

EUVD-2026-42712

fkie_cve-2020-15169

In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

GHSA-cfjv-5498-mph5 — XSS in Action View

Affected: RubyGems: actionview

There is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks.

### Impact

When an HTML-unsafe string is passed as the default for a missing translation key [named `html` or ending in `_html`](https://guides.rubyonrails.org/i18n.html#using-safe-html-translations), the default string is incorrectly marked as HTML-safe and not escaped. Vulnerable code may look like the following examples:

```erb <%# The welcome_html translation is not defined for the current locale: %> <%= t("welcome_html", default: untrusted_user_controlled_string) %>

<%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %> <%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %> ```

### Patches

Patched Rails versions, 6.0.3.3 and 5.2.4.4, are available from the normal locations.

The patches have also been applied to the `master`, `6-0-stable`, and `5-2-stable` branches on GitHub. If you track any of these branches, you should update to the latest.

To aid users who aren’t able to upgrade immediately, we’ve provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* [5-2-translate-helper-xss.patch](https://gist.github.com/georgeclaghorn/a466e103922ee81f24c32c9034089442#file-5-2-translate-helpe…

gsd-2020-15169

OESA-2021-1180 — rubygem-actionview security update

Affected: openEuler:20.03-LTS-SP1: rubygem-actionview

Simple, battle-tested conventions and helpers for building web pages. Security Fix(es): In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View s translation helpers. Views that allow the user to control the default (not found) value of the t and translate helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.(CVE-2020-15169)

openSUSE-SU-2020:1993-1 — Security update for rmt-server

Security update for rmt-server

RHSA-2021:1313 — Red Hat Security Advisory: Satellite 6.9 Release

rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses rubygem-rest-client: unsanitized application logging foreman: Managing repositories with their id via hammer does not respect the role filters rack-protection: Timing attack in authenticity_token.rb rubygem-rack: hijack sessions by using timing attacks targeting the session id python-psutil: Double free because of refcount mishandling rubygem-activestorage: circumvention of file size limits in ActiveStorage rubygem-actionpack: possible strong parameters bypass rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore rubygem-actionpack: ability to forge per-form CSRF tokens given a global CSRF token rubygem-actionview: CSRF vulnerability in rails-ujs rubygem-rails: untrusted users able to run pending migrations in production django: potential SQL injection via "tolerance" parameter in GIS functions and aggregates on Oracle netty: compression/decompression codecs don't enforce limits on buffer allocation sizes foreman: world-readable OMAPI secret through the ISC DHCP server rubygem-activeview: Cross-site scripting in translation helpers resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling

SUSE-SU-2020:2686-1 — Security update for rubygem-actionview-4_2

Security update for rubygem-actionview-4_2

UBUNTU-CVE-2020-15169

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

WID-SEC-W-2023-1092 — Ruby on Rails: Schwachstelle ermöglicht Cross-Site Scripting

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby on Rails ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.