Lucene search
+L

2 matches found

OSV
OSV
added 2022/08/11 9:18 p.m.46 views

GHSA-33WH-W4M7-C6R8 update_by_case before 0.1.3 can be vulnerable to sql injection

Before version 0.1.3 updatebycase gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgrade to version = 0.1.3 that uses Arel instead to construct the resulting sql statement, with sanitized sql...

5.8CVSS7.5AI score0.00617EPSS
SaveExploits0References5
RubySec
RubySec
added 2022/08/11 12:0 a.m.19 views

update_by_case before 0.1.3 can be vulnerable to sql injection

Before version 0.1.3 updatebycase gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgrade to version = 0.1.3 that uses Arel instead to construct the resulting sql statement, with sanitized sql...

9.8CVSS3AI score0.00617EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder