CVE-2025-43859 vulnerabilities

Vulnerabilities for packages: airflow, kubeflow-pipelines-visualization-server, kserve, mitmproxy, jupyter-base-notebook, reflex, checkov...

GHSA-59G5-XGCQ-4QW3 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-59G5-XGCQ-4QW3 vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2024-53981 vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2024-53981 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-F96H-PMFR-66VW vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2024-47874 vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2024-47874 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-CX63-2MW6-8HW5 vulnerabilities

Vulnerabilities for packages: airflow, az, kubeflow-katib, superset, reflex, py3-cassandra-medusa, checkov, py3-pipenv...

CVE-2024-6345 vulnerabilities

Vulnerabilities for packages: airflow, az, kubeflow-katib, superset, reflex, py3-cassandra-medusa, checkov, py3-pipenv...

StimulusReflex 3.5.0 Arbitrary Code Execution

StimulusReflex CVE-2024-28121 Arbitrary code execution in StimulusReflex. This affects version 3.5.0 up to and including 3.5.0.rc2 and v3.5.0.pre10. Vulnerable code excerpt stimulusreflex/lib/stimulusreflex/reflex.rb Invoke the reflex action specified by name and run all callbacks def processname...

Design/Logic Flaw

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex

stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...

GHSA-F78J-4W3G-4Q65 StimulusReflex arbitrary method call

Summary More methods than expected can be called on reflex instances. Being able to call some of them has security implications. Details To invoke a reflex a websocket message of the following shape is sent: json "target": "classnamemethodname", "args": The server will proceed to instantiate refl...

Unsafe Reflection

Overview stimulusreflex is an exciting new way to build modern, reactive, real-time apps with Ruby on Rails. Affected versions of this package are vulnerable to Unsafe Reflection due to the handling of websocket messages that allow specifying a classname and methodname. An attacker can manipulate...

StimulusReflex arbitrary method call

Summary More methods than expected can be called on reflex instances. Being able to call some of them has security implications. Details To invoke a reflex a websocket message of the following shape is sent: json "target": "classnamemethodname", "args": The server will proceed to instantiate refl...

StimulusReflex Security Vulnerability

StimulusReflex is a system that extends the functionality of Rails and Stimulus by intercepting user interactions and passing them to Rails via a live websocket. A security vulnerability exists in StimulusReflex 3.4.1 and earlier, 3.5.0.rc3 and earlier, which stems from a vulnerability that allow...

PT-2024-22275

Name of the Vulnerable Software and Affected Versions stimulus reflex versions prior to 3.4.2 stimulus reflex versions prior to 3.5.0.rc4 Description The issue allows more methods than expected to be called on reflex instances, which has security implications. To invoke a reflex, a websocket...