CVE-2020-8164

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

CVE-2020-8164

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

CVE-2020-8164

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

Deserialization of untrusted data

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

UBUNTU-CVE-2020-8164

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

[SECURITY] [DLA 2251-1] rails security update

Package : rails Version : 2:4.1.8-1+deb8u7 CVE ID : CVE-2020-8164 CVE-2020-8165 Two vulnerabilities were found in Ruby on Rails, a MVC ruby-based framework geared for web application development, which could lead to remote code execution and untrusted user input usage, depending on the applicatio...

CVE-2020-8164

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

CVE-2020-8164

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

CVE-2020-8164

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

CVE-2020-8164: Deserialization of Untrusted Data

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

CVE-2020-8164

A flaw was found in rubygem-actionpack. Untrusted hashes of data is possible for values of each, eachvalue, and eachpair which can lead to cases of user supplied information being leaked from Strong Parameters. Applications that use these hashes may inadvertently use untrusted user input. The...

Possible Strong Parameters Bypass in ActionPack

There is a strong parameters bypass vector in ActionPack. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ In some cases user supplied information can be inadvertently leaked from Strong Parameters. Specifically the return value of each, or eachvalue, or eachpair will return the...

GHSA-8727-M6GJ-MC37 Possible Strong Parameters Bypass in ActionPack

There is a strong parameters bypass vector in ActionPack. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ In some cases user supplied information can be inadvertently leaked from Strong Parameters. Specifically the return value of each, or eachvalue, or eachpair will return the...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure by Bypassing Strong Parameters. Specifically the return value of each, or eachvalue, or eachpair will return the underlying "untrusted" hash of data that was read from the parameters. Remediation Upgrade actionpack ...

Possible Strong Parameters Bypass in ActionPack

There is a strong parameters bypass vector in ActionPack. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ In some cases user supplied information can be inadvertently leaked from Strong Parameters. Specifically the return value of each, or eachvalue, or eachpair will return the...

SQL Injection In Query_methods

activerecord/lib/activerecord/relation/querymethods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes createwith calls...

High severity vulnerability that affects activerecord

Withdrawn, accidental duplicate publish. activerecord/lib/activerecord/relation/querymethods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes...

GHSA-HM48-76WH-Q86V High severity vulnerability that affects activerecord

Withdrawn, accidental duplicate publish. activerecord/lib/activerecord/relation/querymethods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes...

Ruby on Rails: ActionController::Parameters .each returns an unsafe hash

Rails 5.1.4 The goal of ActionController::Parameters's permit method strong parameters is to prevent accidental trust in the parameters sent by the client. We can therefore not simply create a hash of all the parameters in the params without permitting them first. When we really want to do this...

Active Record subject to strong parameters protection bypass

activerecord/lib/activerecord/relation/querymethods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes createwith calls...