Filtered by vendor Activerecord Project Subscriptions
Filtered by product Activerecord Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-22794 2 Activerecord Project, Redhat 2 Activerecord, Satellite 2024-11-21 8.8 High
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
CVE-2022-44566 2 Activerecord Project, Redhat 2 Activerecord, Satellite 2024-11-21 7.5 High
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.
CVE-2022-32224 2 Activerecord Project, Redhat 2 Activerecord, Satellite 2024-11-21 9.8 Critical
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.