Rubyonrails: >> Rails >> 4.2.11.1 Security Vulnerabilities
SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
CVSS Score
8.1
EPSS Score
0.006
Published
2017-12-29
SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
CVSS Score
8.1
EPSS Score
0.018
Published
2017-12-29
Page 3