CVE-2019-13146

CVE-2019-13146 concerns the field_test gem (Ruby) 0.3.0, where unvalidated input allows a method to return arbitrary inputs. The root cause is acceptance of arbitrary variants from user-supplied input, enabling potential SQL injection or XSS when trusted values are used. Multiple connected source...

CVE-2020-16252

The CVE-2020-16252 entry concerns the Field Test gem (Ruby) versions 0.2.0–0.3.2, vulnerable to Cross-Site Request Forgery (CSRF). The issue stems from Rails CSRF protection behavior: protect_from_forgery defaults were effectively unhelpful for non-session authentication, later adjusted to with: ...