DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Ruby on Rails: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-03-23
Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.
01
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-33658US | medium6.5 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1
Active Storage's proxy controller does not limit… | ||||
| CVE-2026-33202US | critical9.1 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` p… | ||||
| CVE-2026-33195US | critical9.8 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not… | ||||
| CVE-2026-33176US | high7.5 | — | ||
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number… | ||||
| CVE-2026-33174US | high7.5 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's prox… | ||||
| CVE-2026-33173US | medium5.3 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary meta… | ||||
| CVE-2026-33170US | medium6.1 | — | ||
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does n… | ||||
| CVE-2026-33169US | medium5.3 | — | ||
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression… | ||||
| CVE-2026-33168US | — | — | ||
Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTM… | ||||
| CVE-2026-33167US | medium6.1 | — | ||
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape ex… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2026:14835 vom 2026-05-07external
- Red Hat Security Advisory RHSA-2026:14873 vom 2026-05-07external
- Red Hat Security Advisory RHSA-2026:14874 vom 2026-05-07external
- Rails Security Advisory vom 2026-03-23external
- Rails Security Advisory vom 2026-03-23external
- Rails Security Advisory vom 2026-03-23external
- Rails Security Advisory vom 2026-03-23external
- Rails Security Advisory vom 2026-03-23external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan