GHSA-RF8X-9MHR-49WG vulnerabilities

Vulnerabilities for packages: reflex...

Access Control Bypass

Overview reflex is a Web apps in pure Python. Affected versions of this package are vulnerable to Access Control Bypass through the event handling mechanism. An attacker can impersonate other users or gain unauthorized administrative access by manipulating state fields that are not intended to be...

CVE-2025-43859 vulnerabilities

Vulnerabilities for packages: checkov, airflow, mitmproxy, kubeflow-pipelines-visualization-server, kserve, reflex, jupyter-base-notebook...

GHSA-59G5-XGCQ-4QW3 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-59G5-XGCQ-4QW3 vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2024-53981 vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2024-53981 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-F96H-PMFR-66VW vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2024-47874 vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2024-47874 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-CX63-2MW6-8HW5 vulnerabilities

Vulnerabilities for packages: checkov, airflow, superset, az, py3-cassandra-medusa, py3-pipenv, kubeflow-katib, reflex...

CVE-2024-6345 vulnerabilities

Vulnerabilities for packages: checkov, airflow, superset, az, py3-cassandra-medusa, py3-pipenv, kubeflow-katib, reflex...

StimulusReflex 3.5.0 Arbitrary Code Execution

StimulusReflex CVE-2024-28121 Arbitrary code execution in StimulusReflex. This affects version 3.5.0 up to and including 3.5.0.rc2 and v3.5.0.pre10. Vulnerable code excerpt stimulusreflex/lib/stimulusreflex/reflex.rb Invoke the reflex action specified by name and run all callbacks def processname...

Design/Logic Flaw

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

Unsafe Reflection

Overview stimulusreflex is an exciting new way to build modern, reactive, real-time apps with Ruby on Rails. Affected versions of this package are vulnerable to Unsafe Reflection due to the handling of websocket messages that allow specifying a classname and methodname. An attacker can manipulate...

GHSA-F78J-4W3G-4Q65 StimulusReflex arbitrary method call

Summary More methods than expected can be called on reflex instances. Being able to call some of them has security implications. Details To invoke a reflex a websocket message of the following shape is sent: json "target": "classnamemethodname", "args": The server will proceed to instantiate refl...

StimulusReflex arbitrary method call

Summary More methods than expected can be called on reflex instances. Being able to call some of them has security implications. Details To invoke a reflex a websocket message of the following shape is sent: json "target": "classnamemethodname", "args": The server will proceed to instantiate refl...