Vulnerabilities > Thoughtbot > Paperclip > 3.2.0
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2017-11-13 | CVE-2017-0889 | Server-Side Request Forgery (SSRF) vulnerability in Thoughtbot Paperclip Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. | 7.5 |
2015-07-10 | CVE-2015-2963 | Cross-site Scripting vulnerability in Thoughtbot Paperclip The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg. | 4.3 |