Skip to content
OpenAdvisories

Package · RubyGems

activerecord

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-32224 Public exploit

    Active Record RCE bug with Serialized Columns

    A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the abilit…

    rails rails activerecord Debian Ubuntu RubyGems
  • Critical —
    CVE-2013-3221

    Active Record component in Ruby on Rails has a data-type injection vulnerability

    The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers…

    rails activerecord Debian RubyGems
  • Critical —
    CVE-2013-0277

    Active Record contains deserialization of arbitrary YAML

    ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.

    rails activerecord Debian RubyGems