Most recent entries from all

bdu:2022-04353

certfr-2022-avi-389 — De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer une in…

certfr-2022-avi-389

EUVD-2026-15392

fkie_cve-2022-27777

A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

GHSA-ch3h-j2vf-95pv — XSS Vulnerability in Action View tag helpers

Affected: RubyGems: actionview

There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.

Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.

Impacted code will look something like this:

``` check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' }) ```

Where the "malicious_input" variable contains untrusted data.

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Escape the untrusted data before using it as a key for tag helper methods.

gsd-2022-27777

RHSA-2023:2097 — Red Hat Security Advisory: Satellite 6.13 Release

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode SnakeYaml: Constructor Deserialization Remote Code Execution rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack rubygem-loofah: inefficient regular expression leading to denial of service rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting rubygem-loofah: Uncontrolled Recursion leading to denial of service rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations snakeyaml: Denial of Service due to missing nested depth limitation for collections tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers rubygem-tzinfo: arbitrary code execution activerecord: Possible RCE escalation bug with Serialized Columns in Active Record apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaug…

SUSE-SU-2022:3621-1 — Security update for rubygem-activesupport-5_1

Security update for rubygem-activesupport-5_1

UBUNTU-CVE-2022-27777

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:16.04:LTS: redmine, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:18.04:LTS: redmine, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:20.04:LTS: redmine, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

WID-SEC-W-2022-1281 — Ruby on Rails: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.