Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: thoughtbot Clear all filters
TI-2016-02597 CVE-2016-3098 · GHSA-cc8c-26rj-v2vx

Cross-site request forgery in administrate

Priority LOW 25

Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00369 Published 2022-08-05 Fixed in 0.1.5 CWE-352
TI-2021-06127 CVE-2021-23435 · GHSA-4hpq-rjcx-7vj9

Open redirect in clearance

Priority LOW 34

This affects the package clearance before 2.5.0.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00703 Published 2021-09-12 Fixed in 2.5.0 CWE-601
TI-2020-04313 CVE-2020-5257 · GHSA-2p5p-m353-833w

Sort order SQL injection in Administrate

Priority LOW 37

In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.009 Published 2020-03-13 Fixed in 0.13.0 CWE-943
TI-2017-00837 CVE-2017-0889 · GHSA-5jcf-c5rg-rmm8

Server-side request forgery in thoughtbot paperclip ruby gem

Priority MEDIUM 48

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03053 Published 2017-11-13 Partial fix · 5.2.0 CWE-918