Ruby on Rails Rails 7.1.0 Release Candidate 1

CPE Details

Ruby on Rails Rails 7.1.0 Release Candidate 1
rubyonrails
rails
7.1.0
2024-06-06
10h10 +00:00
2024-06-06
10h10 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:rubyonrails:rails:7.1.0:rc1:*:*:*:*:*:*

Informations

Vendor

rubyonrails

Product

rails

Version

7.1.0

Update

rc1

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2024-32464 2024-06-04 19h53 +00:00 Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
6.1
Medium
CVE-2024-28103 2024-06-04 19h47 +00:00 Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
9.8
Critical
CVE-2024-26143 2024-02-27 15h33 +00:00 Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.
6.1
Medium
CVE-2024-26142 2024-02-27 15h25 +00:00 Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.
7.5
High