sinatra does not validate expanded path matches

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served. Mitigation Disable the static option which will disable the publicdir option. With th...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation by not validating that the expanded path matches publicdir when serving static files. Remediation Upgrade sinatra to version 2.2.0 or higher. References - GitHub Commit - GitHub PR...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

DEBIAN-CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

UBUNTU-CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970: Improper Limitation of a Pathname to a Restricted Directory

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

CVE-2022-29970 affects the Ruby web framework Sinatra (before 2.2.0). The issue is a path traversal vulnerability where expanded paths are not validated against the public_dir when serving static files, potentially allowing an attacker to view arbitrary files via crafted URLs containing dot-dot s...

Sinatra路径遍历漏洞

Sinatra is a DSL for easily creating web applications in Ruby. A path traversal vulnerability exists in Sinatra versions prior to 2.2.0, which stems from not verifying that the extension path matches publicdir when serving static files...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

Glewlwyd 路径遍历漏洞

Glewlwyd is a single sign-on SSO server for multi-factor authentication for OAuth2 and OpenID Connect authentication. A security vulnerability exists in Glewlwyd version 2.6.2 and earlier versions, which stems from staticcompressedinmemorywebsitecallback.c that allows directory traversal...

PT-2022-28177

Name of the Vulnerable Software and Affected Versions afire versions prior to 1.1.0 Description This issue affects the built-in serve static extension in afire, allowing paths containing //.... to bypass previous path sanitation and request files in higher directories that should not be accessibl...

The vulnerability of the authentication mechanism of Cisco Umbrella security cloud service allows a attacker to carry out a “man-in-the-middle” attack.

The vulnerability of the Cisco Umbrella security cloud service authentication mechanism is related to the use of a static host SSH key. Exploiting this vulnerability allows an attacker to carry out a “man-in-the-middle” attack...

CVE-2022-20773

A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance VA could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability by performing ...

CVE-2022-27237

There is a cross-site scripting XSS vulnerability in an NI Web Server component installed with several NI products. Depending on the products in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install ...

CVE-2022-27237

There is a cross-site scripting XSS vulnerability in an NI Web Server component installed with several NI products. Depending on the products in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install ...