2293 matches found
rack-protection gem timing attack vulnerability when validating CSRF token
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...
CVE-2018-1000119
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...
CVE-2018-1000119
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...
Cross site request forgery (csrf)
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...
UBUNTU-CVE-2018-1000119
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...
CVE-2018-1000119
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...
CVE-2018-1000119
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...
CVE-2018-1000119
Removed by vendor...
CVE-2018-1000119
CVE-2018-1000119 affects Sinatra rack-protection, specifically the CSRF authenticity_token check. Versions 1.5.4 and 2.0.0.rc3 and earlier are vulnerable to a timing attack that can expose signatures and is exploitable over the network. The issue has been fixed in 1.5.5 and 2.0.0. Remediation: up...
rack-protection gem timing attack vulnerability when validating CSRF token
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application...
rubygem-rack: Potential Denial of Service Vulnerability in Rack normalize_params()
A flaw was found in a way Rack processed parameters of incoming requests. An attacker could use this flaw to send a crafted request that would cause an application using Rack to crash...
GHSA-H29F-7F56-J8WH Sinatra Path Traversal vulnerability
An issue was discovered in rack-protection/lib/rack/protection/pathtraversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters...
Directory Traversal
sinatra and rack-protection are vulnerable to directory traversal attacks. The libraries did not take into account the \\ within Windows systems as a method of traversal, allowing attackers to walk the file system...
CVE-2018-7212
An issue was discovered in rack-protection/lib/rack/protection/pathtraversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters...
Path traversal
An issue was discovered in rack-protection/lib/rack/protection/pathtraversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters...
CVE-2018-7212
CVE-2018-7212 (Sinatra/Rack-Protection) affects Sinatra 2.x on Windows prior to 2.0.1. The issue resides in rack-protection/lib/rack/protection/path_traversal.rb, enabling path traversal through backslash characters. Impact is directory/file access on the host system where Windows path separators...
Path traversal is possible via backslash characters on Windows.
An issue was discovered in rack-protection 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters...
Fedora Update for rubygem-rack-protection FEDORA-2018-306856c244
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora 26 : rubygem-rack-protection (2018-306856c244)
Fix timing attack in authenticitytoken.rb rhbz1534027. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...
