Vulnerabilities

TI-2019-12472 CVE-2019-16676 · GHSA-r74q-gxcg-73hx

Plataformatec Simple Form has Incorrect Access Control in file_method? in…

MEDIUM 48

Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.034 Published 2019-09-30 Fixed in 5.0.0 CWE-20

TI-2019-12102 CVE-2019-16109 · GHSA-fcjw-8rhj-gwwc

An issue was discovered in Plataformatec Devise before 4.7.1.

LOW 28

An issue was discovered in Plataformatec Devise before 4.7.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01832 Published 2019-09-08 Fixed in 4.7.1 CWE-284

TI-2019-03831 CVE-2019-5421 · GHSA-73rf-6mrf-759q

Time-of-check time-of-use race condition in Plataformatec Devise ruby gem

MEDIUM 45

Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01556 Published 2019-04-03 Fixed in 4.6.0 CWE-367

TI-2013-00167 CVE-2013-0233 · GHSA-jxhw-mg8m-2pj8

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before…

MEDIUM 45

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which migh…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.14126 Published 2013-04-25 Fixed in 2.2.3, 2.1.3 +2 CWE-399

Vulnerabilities

Filters

Plataformatec Simple Form has Incorrect Access Control in file_method? in…

An issue was discovered in Plataformatec Devise before 4.7.1.

Time-of-check time-of-use race condition in Plataformatec Devise ruby gem

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before…