CVE-2018-11627

CVE-2018-11627 affects the Sinatra Ruby gem (pre-2.0.2) with an XSS in the 400 Bad Request page triggered by a params parser exception. Fedora/RH advisories (e.g., RHSA-2019:0212, RHSA-2019:0315) document fixes and package updates for rubygem-sinatra across affected Fedora/RHEL releases; OpenVAS/...

CVE-2018-11627

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception...

Cross-site Scripting (XSS)

sinatra is vulnerable to cross-site scripting XSS attacks. The library fails to properly escape the e.message variable in a bad request page, allowing a malicious user to inject and execute arbitrary Javascript...

XSS via the 400 Bad Request page

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception...

rack-protection: Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

Sinatra rack-protection cross-site request forgery vulnerability

Sinatra rack-protection is a component used in Sinatra to defend against web tools. A security vulnerability exists in the detection of cross-site request forgery tokens in Sinatra rack-protection 1.5.4 and 2.0.0.rc3 and earlier versions. An attacker can exploit this vulnerability to obtain a...

GHSA-688C-3X49-6RQJ rack-protection gem timing attack vulnerability when validating CSRF token

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

CVE-2018-1000119

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

Cross site request forgery (csrf)

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

CVE-2018-1000119

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

UBUNTU-CVE-2018-1000119

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

CVE-2018-1000119

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

CVE-2018-1000119

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

CVE-2018-1000119

CVE-2018-1000119 affects Sinatra rack-protection, specifically the CSRF authenticity_token check. Versions 1.5.4 and 2.0.0.rc3 and earlier are vulnerable to a timing attack that can expose signatures and is exploitable over the network. The issue has been fixed in 1.5.5 and 2.0.0. Remediation: up...

CVE-2018-1000119

Removed by vendor...

rack-protection gem timing attack vulnerability when validating CSRF token

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application...

Sinatra Path Traversal vulnerability

An issue was discovered in rack-protection/lib/rack/protection/pathtraversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters...

Directory Traversal

sinatra and rack-protection are vulnerable to directory traversal attacks. The libraries did not take into account the \\ within Windows systems as a method of traversal, allowing attackers to walk the file system...

CVE-2018-7212

An issue was discovered in rack-protection/lib/rack/protection/pathtraversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters...

CVE-2018-7212

An issue was discovered in rack-protection/lib/rack/protection/pathtraversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters...