432 matches found
cve-2022-32224-rails
CVE-2022-3222 ActiveRecord Serialization Behavior Verification https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017 https://api.rubyonrails.org/classes/ActiveRecord/AttributeMethods/Serialization/ClassMethods.html...
-CVE-2012-2661-ActiveRecord-SQL-injection-
-CVE-2012-2661-ActiveRecord-SQL-injection- Write upMalay...
CVE-2026-126085
The Active Storage component in Rails (prior to versions 8.1.4.1 and 8.0.5.2 ) is vulnerable to a circumvention of file size limits during direct uploads to Google Cloud Storage . The root cause is that ActiveStorage::Service::GCSService#url_for_direct_upload fails to bind the declared content le...
CVE-2026-126085 Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
CVE-2026-126085 Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
Malicious code in activerecord-pedantmysql2-adapter (npm)
The package activerecord-pedantmysql2-adapter was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in activerecord-rescue_from_duplicate (npm)
The package activerecord-rescuefromduplicate was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in activerecord-databasevalidations (npm)
The package activerecord-databasevalidations was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in activerecord-firewall (npm)
The package activerecord-firewall was found to contain malicious code. --- Credit: OpenSSF source...
GHSA-PMWX-RM49-XV39 ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal
Summary Active Record Tenanted's override of Active Storage's DiskServicepathfor does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences e.g. ../ is used, it could allow reading, writing, or deleting arbitrar...
Malicious code in activerecord-strict_validations (RubyGems)
--- Credit: OpenSSF source...
Malicious code in activerecord-database-validations (RubyGems)
--- Credit: OpenSSF source...
Malicious code in activerecord-forbid-implicit_connection_checkout (RubyGems)
--- Credit: OpenSSF source...
Malicious code in activerecord-suppress-range_error (RubyGems)
--- Credit: OpenSSF source...
Malicious code in activerecord-rescue-from_duplicate (RubyGems)
--- Credit: OpenSSF source...
Malicious code in activerecord-json_validator (RubyGems)
--- Credit: OpenSSF source...
Malicious code in activerecord-pluck-in_batches (RubyGems)
--- Credit: OpenSSF source...
Malicious code in activerecord-globalize (RubyGems)
--- Credit: OpenSSF source...