Reedloden

**Name of the Vulnerable Software and Affected Versions** ruby-saml gem versions prior to 1.0.0 **Description** The issue allows XPath injection and code execution in the ruby-saml gem because prepared statements are not used. This is related to the `xml security.rb` file. **Recommendations** For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `xml security.rb` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** restforce versions prior to 3.0.0 **Description** The issue is related to insufficient URI encoding, allowing an attacker to inject arbitrary parameters into Salesforce API requests. This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods. Attackers could manipulate the request to access different endpoints or modify data by overriding HTTP methods via request parameters, such as ` HttpMethod=PATCH`. **Recommendations** For versions prior to 3.0.0, consider updating to version 3.0.0 or later to resolve the issue. As a temporary workaround, applications should track Salesforce IDs internally rather than passing user-supplied IDs to Salesforce to mitigate this vulnerability.

**Name of the Vulnerable Software and Affected Versions** json-jwt versions 0.5.0 through 1.9.3 **Description** The issue is related to the decryption of AES-GCM encrypted JSON Web Tokens, where an improper verification of cryptographic signatures can occur, allowing an attacker to forge an authentication tag. This can be exploited via network connectivity. **Recommendations** For json-jwt versions 0.5.0 through 1.9.3, update to version 1.9.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Devise gem versions 1.5.x before 1.5.4 Devise gem versions 2.0.x before 2.0.5 Devise gem versions 2.1.x before 2.1.3 Devise gem versions 2.2.x before 2.2.3 **Description** The issue is related to improper type conversion when performing database queries. This might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors. For example, it could be used to reset passwords of arbitrary accounts. **Recommendations** For Devise gem version 1.5.x, update to version 1.5.4 or later. For Devise gem version 2.0.x, update to version 2.0.5 or later. For Devise gem version 2.1.x, update to version 2.1.3 or later. For Devise gem version 2.2.x, update to version 2.2.3 or later.