309 matches found
rack-protection: Timing attack in authenticity_token.rb
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...
PT-2021-7627 · Sinatra +7 · Sinatra +7
Name of the Vulnerable Software and Affected Versions: Sinatra versions prior to 2.2.0 Description: The issue is related to insufficient path name restrictions in the Ruby Sinatra web application framework, allowing a remote attacker to access confidential data. The vulnerability occurs because...
CVE-2018-7212
A flaw was discovered in rack-protection/lib/rack/protection/pathtraversal.rb in Sinatra version 2.x before 2.0.1 on Windows. This flaw allows for path traversal on the system that contains backslash characters in the path. This flaw only affects Sinatra on Windows, Linux platforms are not affect...
CloudBees Jenkins Chef Sinatra Plugin Authorization Issues Vulnerability
CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. company CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed execution of the task . Chef Sinatra Plugin is used in on...
NewStart CGSL CORE 5.04 / MAIN 5.04 : pcs Multiple Vulnerabilities (NS-SA-2019-0042)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pcs packages installed that are affected by multiple vulnerabilities: - Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in...
XSS Vulnerability in Chartkick Ruby Gem
Chartkick is vulnerable to a cross-site scripting XSS attack if both the following conditions are met: Condition 1: It's used with ActiveSupport.escapehtmlentitiesinjson = false this is not the default for Rails OR used with a non-Rails framework like Sinatra. Condition 2: Untrusted data or optio...
CloudBees Jenkins Chef Sinatra Plugin Cross-Site Request Forgery Vulnerability
CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. company CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks.Chef Sinatra Plugin is used in one of the plugin in...
CVE-2019-1003087
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
CVE-2019-1003086
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
CVE-2019-1003086
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
CVE-2019-1003087
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
Cross site request forgery (csrf)
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
Input validation
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
CVE-2019-1003086
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
CVE-2019-1003086
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
CVE-2019-1003087
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
CVE-2019-1003086
The CVE-2019-1003086 entry concerns a cross-site request forgery (CSRF) in the Jenkins Chef Sinatra Plugin. The vulnerability arises from the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation, which allows an attacker to coerce the application into initiating a connection t...
CVE-2019-1003087
CVE-2019-1003087 affects Jenkins Chef Sinatra Plugin. A missing permission check in ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Affected component: Jenkins Chef Sin...
PT-2019-11376 · Jenkins · Jenkins Chef Sinatra Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Chef Sinatra Plugin affected versions not specified Description: A cross-site request forgery issue exists in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method, allowing attackers to initiate a...