thoughtbot

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

thoughtbot records in CISA KEV

No thoughtbot vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Administrate 2 records LOW Paperclip 2 records MEDIUM Clearance 1 record LOW Cocaine 1 record LOW

Records

2 records in Paperclip · all components

TI-2017-00837 CVE-2017-0889 · GHSA-5jcf-c5rg-rmm8

Server-side request forgery in thoughtbot paperclip ruby gem

MEDIUM 48

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03053 Published 2017-11-13 Partial fix · 5.2.0 CWE-918

TI-2015-02617 CVE-2015-2963 · GHSA-6jvm-3j5h-79f6

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type…

LOW 24

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) atta…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02106 Published 2015-07-10 Fixed in 4.2.2 CWE-79

Open these records in search →

Critical	1
High	2
Medium	3
Low	0
No CVSS	0