plataformatec vulnerabilities

Products

• devise 3
• Devise ruby gem 1
• simple form 1

Latest plataformatec CVEs

Newest publication first

1. CVE-2019-16676 Improper Input Validation in simple_form

   Published 2019-09-30

   Critical·CVSS 9.8 EPSS 3.4% PoC

   Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.

2. CVE-2019-16109 Authentication Bypass in Devise

   Published 2019-09-08

   Medium·CVSS 5.3 EPSS 1.8%

   An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such...

3. CVE-2019-5421 devise Time-of-check Time-of-use Race Condition vulnerability

   Published 2019-04-03

   Critical·CVSS 9.8 EPSS 1.6%

   Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The Devise::Models::Lockable class, more specifically at the #increment_failed_attempts method. File location: lib/devise/models/lockable.rb that can result in Multiple c...

4. CVE-2013-0233 Devise does not properly perform type conversion when performing database queries

   Published 2013-04-25

   Medium·CVSS 6.8 EPSS 14.6% Framework module

   Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be re...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.