Search for packages
| purl | pkg:gem/activemodel@4.1.14 |
| Next non-vulnerable version | 4.1.14.1 |
| Latest non-vulnerable version | 5.0.0.beta1.1 |
| Risk | 3.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3yvz-dmrg-bfcf
Aliases: GHSA-v543-gqhh-6gww |
Duplicate Advisory: Moderate severity vulnerability that affects activemodel ## Duplicate advisory This advisory has been withdrawn because it is a duplicate of [GHSA-543v-gj2c-r3ch](https://github.com/advisories/GHSA-543v-gj2c-r3ch). This link is maintained to preserve external references. ## Original Description Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-pb5f-g4uc-r7fp
Aliases: CVE-2016-0753 GHSA-543v-gj2c-r3ch |
Possible Input Validation Circumvention Code that uses Active Model based models (including Active Record models) and does not validate user input before passing it to the model can be subject to an attack where specially crafted input will cause the model to skip validations. Rails users using Strong Parameters are generally not impacted by this issue as they are encouraged to allow parameters and must specifically opt-out of input verification using the `permit!` method to allow mass assignment. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||