Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
MAL-2026-3632
  • RubyGems/knot-devise-jwt-helper
 Malicious code in knot-devise-jwt-helper (RubyGems) 13 May
  • No fix available
GHSA-jp94-3292-c3xv
  • RubyGems/devise
 Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler 08 May
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-57hq-95w6-v4fc
  • RubyGems/devise
 Devise has a confirmable "change email" race condition permits user to confirm email they have no access to 17 Mar
  • Fix available
  • Severity - 6.0 (Medium)
GHSA-qjxf-mc72-wjr2
  • RubyGems/devise-two-factor
 Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length 17 Sep 2024
  • Fix available
  • Severity - 6.0 (Medium)
GHSA-w3q8-m492-4pwp
  • RubyGems/decidim
  • RubyGems/decidim-admin
  • RubyGems/decidim-system
  • RubyGems/devise_invitable
 Possibility to circumvent the invitation token expiry period 20 Feb 2024
  • Fix available
  • Severity - 5.7 (Medium)
GHSA-746g-3gfp-hfhw
  • RubyGems/devise
 Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie 26 Jan 2023
  • Fix available
  • Severity - 7.5 (High)
GHSA-mvqr-r76c-wm5f
  • RubyGems/devise_token_auth
 Devise Token Auth vulnerable to Cross-site Scripting 24 May 2022
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-jp57-9j37-5476
  • RubyGems/spree_auth_devise
 spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles 17 May 2022
  • Fix available
GHSA-jm35-h8q2-73mp
  • RubyGems/devise-two-factor
 Improper one time password handling in devise-two-factor 07 Apr 2022
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-25f5-gc4h-hc22
  • RubyGems/devise_masquerade
 Improper Privilege Management in devise_masquerade 08 Dec 2021
  • Fix available
  • Severity - 8.1 (High)
GHSA-26xx-m4q2-xhq8
  • RubyGems/spree_auth_devise
 Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness 18 Nov 2021
  • Fix available
  • Severity - 9.3 (Critical)
GHSA-xm34-v85h-9pg2
  • RubyGems/solidus_auth_devise
 Authentication Bypass by CSRF Weakness 18 Nov 2021
  • Fix available
  • Severity - 9.3 (Critical)
GHSA-fcjw-8rhj-gwwc
  • RubyGems/devise
 Authentication Bypass in Devise 11 Sep 2019
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-73rf-6mrf-759q
  • RubyGems/devise
 devise Time-of-check Time-of-use Race Condition vulnerability 19 Mar 2019
  • Fix available
GHSA-x489-jjwm-52g7
  • RubyGems/devise-two-factor
 Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP) 28 Aug 2018
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-jxhw-mg8m-2pj8
  • RubyGems/devise
 Devise does not properly perform type conversion when performing database queries 24 Oct 2017
  • Fix available