https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:14:25 +0000 https://cve.radiocsirt.org/vuln/cve-2020-8162 <p><strong>Affected:</strong> https://github.com/rails/rails</p> <p>A client side enforcement of server side security vulnerability exists in rails &lt; 5.2.4.2 and rails &lt; 6.0.3.1 ActiveStorage&#39;s S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.</p> <p><strong>Affected:</strong> https://github.com/rails/rails</p> <p>A client side enforcement of server side security vulnerability exists in rails &lt; 5.2.4.2 and rails &lt; 6.0.3.1 ActiveStorage&#39;s S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.</p> https://cve.radiocsirt.org/vuln/cve-2020-8162 https://cve.radiocsirt.org/vuln/ghsa-m42x-37p3-fv5w <p><strong>Affected:</strong> RubyGems: activestorage</p> <p>There is a vulnerability in ActiveStorage&#39;s S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user.</p> <p>Versions Affected: rails &lt; 5.2.4.2, rails &lt; 6.0.3.1 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter. Fixed Versions: rails &gt;= 5.2.4.3, rails &gt;= 6.0.3.1</p> <p>Impact ------</p> <p>Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size.</p> <p>Workarounds -----------</p> <p>This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.</p> <p><strong>Affected:</strong> RubyGems: activestorage</p> <p>There is a vulnerability in ActiveStorage&#39;s S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user.</p> <p>Versions Affected: rails &lt; 5.2.4.2, rails &lt; 6.0.3.1 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter. Fixed Versions: rails &gt;= 5.2.4.3, rails &gt;= 6.0.3.1</p> <p>Impact ------</p> <p>Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size.</p> <p>Workarounds -----------</p> <p>This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.</p> https://cve.radiocsirt.org/vuln/ghsa-m42x-37p3-fv5w