EUVD-2021-2418

Malware in sbrugna...

Authentication Bypass

Overview Affected versions of this package are vulnerable to Authentication Bypass when a password's salt is unknown. If the secret key base variable is somehow leaked, an attacker can become any user by misusing the masquerade back functionality of this Devise extension, something that is not...

Alexandr Korsak Devise Masquerade has an unspecified vulnerability

Alexandr Korsak Devise Masquerade is a library of utilities from the Spanish company Alexandr Korsak. Alexandr Korsak Devise Masquerade is a security vulnerability that could be exploited by attackers to emulate any user on the site...

CVE-2021-28680

The devisemasquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise without this extension is used. If the...

PT-2021-17900

Name of the Vulnerable Software and Affected Versions: devise masquerade gem versions prior to 1.3 Description: The devise masquerade gem loses one layer of security protection compared to using Devise without this extension, allowing certain attacks when a password's salt is unknown. If the...

Devise Masquerade安全漏洞

Alexandr Korsak Devise Masquerade is a library of utilities from the Spanish company Alexandr Korsak. Alexandr Korsak Devise Masquerade is a security vulnerability that could be exploited by attackers to emulate any user on the site...