Unsafe Reflection

Overview stimulusreflex is an exciting new way to build modern, reactive, real-time apps with Ruby on Rails. Affected versions of this package are vulnerable to Unsafe Reflection due to the handling of websocket messages that allow specifying a classname and methodname. An attacker can manipulate...

GHSA-F78J-4W3G-4Q65 StimulusReflex arbitrary method call

Summary More methods than expected can be called on reflex instances. Being able to call some of them has security implications. Details To invoke a reflex a websocket message of the following shape is sent: json "target": "classnamemethodname", "args": The server will proceed to instantiate refl...

StimulusReflex arbitrary method call

Summary More methods than expected can be called on reflex instances. Being able to call some of them has security implications. Details To invoke a reflex a websocket message of the following shape is sent: json "target": "classnamemethodname", "args": The server will proceed to instantiate refl...

StimulusReflex Security Vulnerability

StimulusReflex is a system that extends the functionality of Rails and Stimulus by intercepting user interactions and passing them to Rails via a live websocket. A security vulnerability exists in StimulusReflex 3.4.1 and earlier, 3.5.0.rc3 and earlier, which stems from a vulnerability that allow...

PT-2024-22275

Name of the Vulnerable Software and Affected Versions stimulus reflex versions prior to 3.4.2 stimulus reflex versions prior to 3.5.0.rc4 Description The issue allows more methods than expected to be called on reflex instances, which has security implications. To invoke a reflex, a websocket...

StimulusReflex arbitrary method call

Summary More methods than expected can be called on reflex instances. Being able to call some of them has security implications. Details To invoke a reflex a websocket message of the following shape is sent: json "target": "classnamemethodname", "args": The server will proceed to instantiate refl...

GHSA-2JV5-9R88-3W3P vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-2JV5-9R88-3W3P vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-QF9M-VFGH-M389 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-QF9M-VFGH-M389 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-93GM-QMQ6-W238 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-93GM-QMQ6-W238 vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2024-24762 vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2024-24762 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-H5C8-RQWP-CP95 vulnerabilities

Vulnerabilities for packages: py3-jinja2, kubeflow-pipelines-visualization-server, reflex, checkov...

CVE-2024-22195 vulnerabilities

Vulnerabilities for packages: checkov, py3-jinja2, reflex, kubeflow-pipelines-visualization-server...

CVE-2024-22195 vulnerabilities

Vulnerabilities for packages: py3-jinja2, kubeflow-pipelines-visualization-server, reflex, checkov...

reflex.cnrs.fr Cross Site Scripting vulnerability OBB-3436343

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-35954

fastrack Reflex 2.0 W307SREFLEXv90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick the device via the Serial Wire Debug SWD feature...

CVE-2021-35953

fastrack Reflex 2.0 W307SREFLEXv90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service device outage via crafted choices of the last three bytes of a characteristic value...