Ruby on Rails: ActionController::Parameters .each returns an unsafe hash

Rails 5.1.4 The goal of ActionController::Parameters's permit method strong parameters is to prevent accidental trust in the parameters sent by the client. We can therefore not simply create a hash of all the parameters in the params without permitting them first. When we really want to do this...

shopify-scripts: Use after free vulnerability in mruby Array#to_h causing DOS possible RCE

This bug was found with jmlb337. Vulnerability The function toh will call the C function mrbarytoh. This will iterate through the elements of the array. If an element is not of type Array it will call attempt to call toary method of that object. If toary does not return an array, the function wil...