DeutschShown in its original language — a full translation is planned for a future version.
Ruby on Rails: Mehrere Schwachstellen
view advisory published 2016-01-25
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Sicherheitsfunktionen zu umgehen, um Dateien zu manipulieren oder um einen Denial of Service Zustand herbeizuführen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-0753US | medium5.3 | — | ||
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows… | ||||
| CVE-2016-0752US | high7.5OT critical | KEV | ||
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote… | ||||
| CVE-2016-0751US | high7.5 | — | ||
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.… | ||||
| CVE-2015-7581US | high7.5 | — | ||
actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of ser… | ||||
| CVE-2015-7580US | medium6.1 | — | ||
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inje… | ||||
| CVE-2015-7579US | medium6.1 | — | ||
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an… | ||||
| CVE-2015-7578US | medium6.1 | — | ||
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML… | ||||
| CVE-2015-7577US | medium5.3 | — | ||
activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.… | ||||
| CVE-2015-7576US | low3.7 | — | ||
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on… | ||||
02
references
External citations — patches, advisories, analysis.
- Weblog Rubyonrails vom 2016-01-25external
- Debian Security Advisory DSA-3464 vom 2016-02-01external
- CXSecurity #WLB-2016100137 vom 2016-10-23external
- openSUSE Security Update OPENSUSE-SU-2025:15125-1 vom 2025-05-18external
- openSUSE Security Update OPENSUSE-SU-2026:10361-1 vom 2026-03-17external
- SUSE Security Update SUSE-SU-2016:1146-1 vom 2016-04-25external
- Red Hat Security Advisory RHSA-2016:0296 vom 2016-02-25external
- Red Hat Security Advisory RHSA-2016:0454 vom 2016-03-16external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan