Ruby on Rails vulnerabilities
5 known CVE vulnerabilities in Ruby on Rails, translated and rated.
- CVE-2017-17920High
SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter.
- CVE-2017-17919High
SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter.
- CVE-2017-17917High
SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter.
- CVE-2017-17916High
SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter.
- CVE-2016-6317High
Ruby on Rails 4.2.x versions before 4.2.7.1 improperly handle parameter differences between the Active Record component and the JSON implementation, allowing remote attackers to bypass intended database-query restrictions.