Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2015-8314 · ADVISORY
• heartcombo/devise commit c929966 · WEB
• GitHub Advisory GHSA-746g-3gfp-hfhw · ADVISORY
• heartcombo/devise · PACKAGE
• rubysec/ruby-advisory-db · WEB
• rubysec.com/advisories/CVE-2015-8314 · WEB
• blog.plataformatec.com.br/2016/01/improve-remember-me-cookie-expiration-in-devise · WEB
• rubysec.com/advisories/CVE-2015-8314 · Third Party Advisory

Lỗ hổng khác của devise

• CVE-2026-40295TRUNG BÌNH 6.1Devise is an authentication solution for Rails based on Warden. In versions 5.0.3 and below, when the Timeoutable module is enabled in Devis…
• CVE-2026-32700TRUNG BÌNH 5.3Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allo…
• CVE-2019-16109TRUNG BÌNH 5.3An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token,…
• CVE-2019-5421NGHIÊM TRỌNG 9.8Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable`…
• CVE-2013-0233TRUNG BÌNH 6.8Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does n…