Ankane

**Name of the Vulnerable Software and Affected Versions** Clockwork Web versions prior to 0.1.2 Rails versions prior to 5.2 **Description** The issue allows Cross-Site Request Forgery (CSRF) attacks, which work by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. **Recommendations** For Clockwork Web versions prior to 0.1.2, upgrade to version 0.1.2 or later. For Rails versions prior to 5.2, upgrade to version 5.2 or later.

**Name of the Vulnerable Software and Affected Versions** Field Test gem versions 0.2.0 through 0.3.2 **Description** The Field Test dashboard is vulnerable to cross-site request forgery (CSRF) with non-session based authentication methods. This issue allows an attacker to perform requests on behalf of an authorized user by getting them to visit a malicious website. A single endpoint is affected, which allows for changing the variant assigned to a user. Session-based authentication methods are not affected. **Recommendations** For versions 0.2.0 through 0.3.2, upgrade immediately to a newer version that includes the fix, which changes the `protect from forgery` method to `protect from forgery with: :exception` to prevent CSRF attacks. As a temporary workaround, consider restricting access to the affected endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Chartkick gem versions prior to 3.4 **Description** The issue allows for Cascading Style Sheets (CSS) Injection without attribute, which can potentially lead to malicious styling or other security issues. **Recommendations** For versions prior to 3.4, update to version 3.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Chartkick.js versions 3.1.0 through 3.1.3 @polymer/polymer versions prior to 3.2.0 **Description** The issue allows prototype pollution, which can be achieved through chart options containing a malicious payload, such as `{" proto ": {"polluted": true}}`. Additionally, loading data from a malicious server can also lead to the same results. **Recommendations** For Chartkick.js versions 3.1.0 through 3.1.3, upgrade to a version outside of this range to mitigate the issue. For @polymer/polymer versions prior to 3.2.0, upgrade to version 3.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** field test gem version 0.3.0 **Description** The issue concerns unvalidated input in a method call, which can return any input, potentially leading to various vulnerabilities such as SQL injection or cross-site scripting (XSS) if applications treat arbitrary variants as trusted. **Recommendations** For field test gem version 0.3.0, consider validating all inputs to the method call to prevent potential SQL injection or XSS attacks. As a temporary workaround, restrict the use of the method call until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Chartkick gem versions prior to 3.1.1 **Description** The issue allows for XSS. **Recommendations** For Chartkick gem versions prior to 3.1.1, update to version 3.1.1 or later to resolve the issue.