CVE-2024-28121

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

CVE-2024-28121

CVE-2024-28121 affects StimulusReflex. A websocket payload targeting a reflex can trigger arbitrary method calls on the reflex instance, because the server locates the method and uses it (via public_send) without strict validation, risking unsafe methods (e.g., instance_variable_set, system). Thi...

CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

CVE-2024-28121: Use of Externally-Controlled Input to Select Classes or Code

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

io.apiman:apiman-gateway-platforms-undertow (>=1.1.0.rc3, <=1.2.1.final), io.undertow.jastow:jastow (>=1.0.1.final, <=1.0.3.final) +3 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.1.final)

io.undertow:undertow-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.apiman:apiman-gateway-platforms-undertow =1.1.0.rc3, =1.0.1.final, =3.0.7.final, =3.0.12.final Sourc...

io.undertow:undertow-servlet (1.0.0.alpha21), io.undertow:undertow-websockets-jsr (1.0.0.alpha21) +26 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.alpha21)

io.undertow:undertow-core MAVEN version 1.0.0.alpha21 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha21 - io.undertow:undertow-websockets-jsr 1.0.0.alpha21 -...

io.undertow:undertow-http2-test-suite (1.3.0.beta7), io.undertow:undertow-servlet (1.3.0.beta7) +1 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.3.0.beta7)

io.undertow:undertow-core MAVEN version 1.3.0.beta7 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta7 - io.undertow:undertow-servlet 1.3.0.beta7 -...

io.undertow:undertow-servlet (1.1.0.beta4), io.undertow:undertow-websockets-jsr (1.1.0.beta4) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.1.0.beta4)

io.undertow:undertow-core MAVEN version 1.1.0.beta4 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.beta4 - io.undertow:undertow-websockets-jsr 1.1.0.beta4 Source cves:...

io.undertow:undertow-servlet (1.1.9.final), io.undertow:undertow-websockets-jsr (1.1.9.final) +1 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.1.9.final)

io.undertow:undertow-core MAVEN version 1.1.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.9.final - io.undertow:undertow-websockets-jsr 1.1.9.final -...

io.undertow:undertow-servlet (1.0.0.alpha3), io.undertow:undertow-websockets-jsr (1.0.0.alpha3) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.alpha3)

io.undertow:undertow-core MAVEN version 1.0.0.alpha3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha3 - io.undertow:undertow-websockets-jsr 1.0.0.alpha3 Source...

io.undertow:undertow-http2-test-suite (1.1.0.beta7), io.undertow:undertow-servlet (1.1.0.beta7) +3 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.1.0.beta7)

io.undertow:undertow-core MAVEN version 1.1.0.beta7 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.1.0.beta7 - io.undertow:undertow-servlet 1.1.0.beta7 -...

io.undertow:undertow-servlet (1.0.0.beta6), io.undertow:undertow-websockets-jsr (1.0.0.beta6) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.beta6)

io.undertow:undertow-core MAVEN version 1.0.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta6 - io.undertow:undertow-websockets-jsr 1.0.0.beta6 Source cves:...

io.undertow:undertow-servlet (1.0.18.final), io.undertow:undertow-websockets-jsr (1.0.18.final) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.18.final)

io.undertow:undertow-core MAVEN version 1.0.18.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.18.final - io.undertow:undertow-websockets-jsr 1.0.18.final Source...

io.undertow:undertow-http2-test-suite (1.3.0.beta1), io.undertow:undertow-servlet (1.3.0.beta1) +2 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.3.0.beta1)

io.undertow:undertow-core MAVEN version 1.3.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta1 - io.undertow:undertow-servlet 1.3.0.beta1 -...

io.undertow:undertow-servlet (1.0.0.beta12), io.undertow:undertow-websockets-jsr (1.0.0.beta12) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.beta12)

io.undertow:undertow-core MAVEN version 1.0.0.beta12 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta12 - io.undertow:undertow-websockets-jsr 1.0.0.beta12 Source...

io.undertow:undertow-servlet (1.0.0.beta11), io.undertow:undertow-websockets-jsr (1.0.0.beta11) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.beta11)

io.undertow:undertow-core MAVEN version 1.0.0.beta11 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta11 - io.undertow:undertow-websockets-jsr 1.0.0.beta11 Source...

io.undertow:undertow-servlet (1.0.0.beta32), io.undertow:undertow-websockets-jsr (1.0.0.beta32) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.beta32)

io.undertow:undertow-core MAVEN version 1.0.0.beta32 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta32 - io.undertow:undertow-websockets-jsr 1.0.0.beta32 Source...

io.undertow.js:undertow-js (>=1.0.0.alpha3, <=1.1.0.beta1), io.undertow.js:undertow-js-freemarker (1.1.0.beta1) +69 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.3.0.beta6)

io.undertow:undertow-core MAVEN version 1.3.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow.js:undertow-js =1.0.0.alpha3, =2.0.0.alpha13, =2.0.0.alpha13, =2.0.0.alpha13, =2.0.0.beta1 ...

io.undertow:undertow-servlet (1.4.1.final), io.undertow:undertow-websockets-jsr (1.4.1.final) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.4.1.final)

io.undertow:undertow-core MAVEN version 1.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.4.1.final - io.undertow:undertow-websockets-jsr 1.4.1.final Source cves:...

io.undertow:undertow-servlet (1.0.0.alpha16), io.undertow:undertow-websockets-jsr (1.0.0.alpha16) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.alpha16)

io.undertow:undertow-core MAVEN version 1.0.0.alpha16 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha16 - io.undertow:undertow-websockets-jsr 1.0.0.alpha16 Source...