309 matches found
sinatra: path traversal possible outside of public_dir when serving static files
A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served...
Important: Red Hat Security Advisory: pcs security update
An update for pcs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
ALSA-2022:4587 Important: pcs security update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: sinatra: path traversal possible outside of publicdir when serving static files CVE-2022-29970 For more details about the security issues, including the impact, a CVSS score,...
sinatra: path traversal possible outside of public_dir when serving static files
A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served...
Important: Red Hat Security Advisory: pcs security update
An update for pcs is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...
sinatra: path traversal possible outside of public_dir when serving static files
A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served...
sinatra: path traversal possible outside of public_dir when serving static files
A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served...
RHEL 8 : pcs (RHSA-2022:2256)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:2256 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: sinatra: path traversal possib...
GHSA-6MGQ-VH7R-GCCC CSRF vulnerability in Jenkins sinatra-chef-builder Plugin
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
CSRF vulnerability in Jenkins sinatra-chef-builder Plugin
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
GHSA-4MVC-33V7-CQC3 Missing permission check in Jenkins sinatra-chef-builder Plugin
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
Missing permission check in Jenkins sinatra-chef-builder Plugin
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
Privilege Escalation
sinatra is vulnerable to Privilege Escalation. The vulnerability exists in static! function in base.rb because it doesn't validate expanded path matches publicdir when serving static files which allows an attacker to gain access to the system and perform unauthorized actions...
GHSA-QP49-3PVW-X4M5 sinatra does not validate expanded path matches
Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...
sinatra does not validate expanded path matches
Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...
sinatra does not validate expanded path matches
Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...
CVE-2022-29970
A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served. Mitigation Disable the static option which will disable the publicdir option. With th...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation by not validating that the expanded path matches publicdir when serving static files. Remediation Upgrade sinatra to version 2.2.0 or higher. References - GitHub Commit - GitHub PR...
