Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.034·Published 2019-09-30·Fixed in 5.0.0CWE-20
Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.01556·Published 2019-04-03·Fixed in 4.6.0CWE-367
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which migh…
THREATIST.IORead the docs