CPE Details
Ruby on Rails Rails 7.1.0 Release Candidate 1
7.1.0
2024-06-06
10h10 +00:00
10h10 +00:00
2024-06-06
10h10 +00:00
10h10 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:rubyonrails:rails:7.1.0:rc1:*:*:*:*:*:*
Informations
Vendor
rubyonrailsProduct
railsVersion
7.1.0Update
rc1Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
| Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2. | 6.1 |
Medium |
||
| Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3. | 9.8 |
Critical |
||
| Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1. | 6.1 |
Medium |
||
| Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. | 7.5 |
High |
