Vulnerabilities

TI-2023-08966 CVE-2023-22794 · GHSA-hq7p-j377-6v63

SQL injection in https://github.com/rails/rails

MEDIUM 42

A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02153 Published 2023-02-09 Fixed in 6.0.6.1, 6.1.7.1 +1 CWE-89

TI-2022-21907 CVE-2022-44566 · GHSA-579w-22j4-4749

Uncontrolled resource consumption in https://github.com/rails/rails

HIGH 72

A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01265 Published 2023-02-09 Fixed in 6.1.7.1, 7.0.4.1 CWE-400

TI-2022-13933 CVE-2022-32224 · GHSA-3hhc-qp5v-9p2j

Deserialization of untrusted data in https://github.com/rails/rails

HIGH 82

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (vi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02601 Published 2022-12-05 Fixed in 7.0.3.1, 6.1.6.1 +2 CWE-502

Vulnerabilities

Filters

SQL injection in https://github.com/rails/rails

Uncontrolled resource consumption in https://github.com/rails/rails

Deserialization of untrusted data in https://github.com/rails/rails