Read the docs

thoughtbot

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

thoughtbot records in CISA KEV

No thoughtbot vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Administrate 2 records LOW Paperclip 2 records MEDIUM Clearance 1 record LOW Cocaine 1 record LOW

Records

6 records

TI-2017-00837 CVE-2017-0889 · GHSA-5jcf-c5rg-rmm8

Server-side request forgery in thoughtbot paperclip ruby gem

Priority MEDIUM 48

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03053 Published 2017-11-13 Partial fix · 5.2.0 CWE-918
TI-2020-04313 CVE-2020-5257 · GHSA-2p5p-m353-833w

Sort order SQL injection in Administrate

Priority LOW 37

In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.009 Published 2020-03-13 Fixed in 0.13.0 CWE-943
TI-2021-06127 CVE-2021-23435 · GHSA-4hpq-rjcx-7vj9

Open redirect in clearance

Priority LOW 34

This affects the package clearance before 2.5.0.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00703 Published 2021-09-12 Fixed in 2.5.0 CWE-601
TI-2016-02597 CVE-2016-3098 · GHSA-cc8c-26rj-v2vx

Cross-site request forgery in administrate

Priority LOW 25

Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00369 Published 2022-08-05 Fixed in 0.1.5 CWE-352
Open these records in search →