https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 10:28:23 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-00917 bdu:2025-00917 https://cve.radiocsirt.org/vuln/bdu:2025-00917 https://cve.radiocsirt.org/vuln/certfr-2024-avi-1060 certfr-2024-avi-1060 https://cve.radiocsirt.org/vuln/certfr-2024-avi-1060 https://cve.radiocsirt.org/vuln/euvd-2026-221218 EUVD-2026-221218 https://cve.radiocsirt.org/vuln/euvd-2026-221218 https://cve.radiocsirt.org/vuln/fkie_cve-2024-54133 <p>Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.</p> <p>Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-54133 https://cve.radiocsirt.org/vuln/ghsa-vfm5-rmrh-j26v <p><strong>Affected:</strong> RubyGems: actionpack</p> <p>There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack.</p> <p>Impact ------ Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.</p> <p>Releases -------- The fixed releases are available at the normal locations.</p> <p>Workarounds ----------- Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.</p> <p>Credits ------- Thanks to [ryotak](https://hackerone.com/ryotak) for the report!</p> <p><strong>Affected:</strong> RubyGems: actionpack</p> <p>There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack.</p> <p>Impact ------ Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.</p> <p>Releases -------- The fixed releases are available at the normal locations.</p> <p>Workarounds ----------- Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.</p> <p>Credits ------- Thanks to [ryotak](https://hackerone.com/ryotak) for the report!</p> https://cve.radiocsirt.org/vuln/ghsa-vfm5-rmrh-j26v https://cve.radiocsirt.org/vuln/opensuse-su-2025:14668-1 <p>ruby3.4-rubygem-actioncable-8.0-8.0.1-1.1 on GA media</p> <p>ruby3.4-rubygem-actioncable-8.0-8.0.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14668-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-54133 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails</p> <p>Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails</p> <p>Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-54133 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3665 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3665