dawnscanner

Dawnscanner - 针对 Ruby Web 应用的安全扫描器 dawn 是一款源代码扫描器，旨在检查您的 Web 应用是否存在安全问题。 该工具能够扫描用 Ruby 编写的 Web 应用，并默认支持所有主流 MVC（模型 - 视图 - 控制器）框架： Ruby on Rails Sinatra Padrino dawn 2.0 版本的知识库中包含了 680 多项安全检查，这些检查每周会根据 NIST 的国家漏洞数据库进行更新。 简要工作原理 当您在代码上运行 dawn 时，它会解析您的项目 Gemfile.lock 文件，查找所使用的 gem，并尝试检测您正在使用的 Ruby...

Astra Linux – Vulnerability in ruby-sinatra

Sinatra is a domain-specific language for creating web applications in Ruby. A vulnerability was discovered in Sinatra 2.0 before versions 2.2.3 and 3.0 before version 3.0.4. The application is vulnerable to a reflected file download RFD attack, which causes the Content-Disposition header of a...

gitrob

Gitrob: Putting the Open Source in OSINT Gitrob is a tool to help find potentially sensitive files pushed to public repositories on Github. Gitrob will clone repositories belonging to a user or organization down to a configurable depth and iterate through the commit history and flag files that...

vulnreport

已废弃项目 本项目目前不再维护，已被废弃。 Vulnreport 渗透测试管理与自动化平台 Vulnreport 是一个用于管理渗透测试并生成格式良好、可操作的漏洞报告的平台，省去了通常占用安全工程师时间的额外工作。该平台旨在支持流程每个阶段的自动化，并允许针对你渗透测试流程中使用的其他系统进行自定义。 Vulnreport 由 Salesforce 产品安全团队构建，旨在消除我们花在编写、格式化和校订渗透测试报告上的时间。我们的目标（并将继续是）构建出色的安全工具，让渗透测试人员和安全工程师能够专注于发现和修复漏洞。 部署 Vulnreport 是一个 Ruby Web...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2023_0855)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230855 advisory. sinatra: Reflected File Download attack CVE-2022-45442 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Ness...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2022_4661)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20224661 advisory. sinatra: path traversal possible outside of publicdir when serving static files CVE-2022-29970 Tenable has extracted the preceding description block directly from t...

Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_8506)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228506 advisory. netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37136 netty-codec: SnappyFrameDecoder doesn't restrict chu...

CentOS Linux 8.4 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1790610952)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790610952 advisory. - A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon was allowing expired accounts, and accounts with expired...

CentOS Linux 8.5 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1790611274)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790611274 advisory. - A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon was allowing expired accounts, and accounts with expired...

Astra Linux – Vulnerability in ruby-sinatra

In versions of Sinatra before 2.2.0, it does not validate that the expanded path matches publicdir when serving static files...

USN-8624-1 ruby-sinatra vulnerability

It was discovered that Sinatra did not properly handle header parsing, causing ETag generation to hang when given specific input. A remote attacker could possibly use this issue to cause a denial of service...

USN-8624-1: Sinatra vulnerability

It was discovered that Sinatra did not properly handle header parsing, causing ETag generation to hang when given specific input. A remote attacker could possibly use this issue to cause a denial of service...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in sinatra-2.0.5.gem

Summary IBM Watson Discovery Cartridge affected by vulnerability in sinatra-2.0.5.gem Vulnerability Details CVEID:CVE-2022-36359 DESCRIPTION: An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file...

The vulnerability of the Ruby Sinatra web application development framework’s parser allows a attacker to trigger a denial-of-service attack.

The vulnerability of the Ruby Sinatra web application development framework’s parser is related to the use of a regular expression c with inefficient computational complexity. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: pcs (UTSA-2026-005306)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005306 advisory. Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a...

MiracleLinux 8 : pcs-0.10.14-5.el8.2.ML.1 (AXSA:2023-5163:05)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-5163:05 advisory. sinatra: Reflected File Download attack CVE-2022-45442 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory...

MiracleLinux 8 : pcs-0.10.18-2.el8_10.3.ML.1 (AXSA:2024-9389:07)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-9389:07 advisory. sinatra: Open Redirect Vulnerability in Sinatra via X-Forwarded-Host Header CVE-2024-21510 Tenable has extracted the preceding description block directly fro...

MiracleLinux 8 : pcs-0.10.12-6.el8.1.ML.1 (AXSA:2022-3740:04)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3740:04 advisory. sinatra: path traversal possible outside of publicdir when serving static files CVE-2022-29970 Tenable has extracted the preceding description block directly...

Astra Linux – Vulnerability in ruby-sinatra

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there was a denial-of-service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method was used when constructing the response. Carefully crafted...

Regular Expression Denial Of Service (ReDoS)

sinatra is vulnerable to Denial-Of-Service. The vulnerability is due to inefficient header parsing when the etag method is used, allowing attackers to send crafted headers that consume excessive CPU time and cause denial of service...