ALSA-2022:4587 Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: sinatra: path traversal possible outside of publicdir when serving static files CVE-2022-29970 For more details about the security issues, including the impact, a CVSS score,...

sinatra: path traversal possible outside of public_dir when serving static files

A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served...

sinatra: path traversal possible outside of public_dir when serving static files

A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served...

sinatra: path traversal possible outside of public_dir when serving static files

A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served...

GHSA-QP49-3PVW-X4M5 sinatra does not validate expanded path matches

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

sinatra does not validate expanded path matches

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

sinatra does not validate expanded path matches

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served. Mitigation Disable the static option which will disable the publicdir option. With th...

DEBIAN-CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

UBUNTU-CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970: Improper Limitation of a Pathname to a Restricted Directory

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

CVE-2022-29970

CVE-2022-29970 affects the Ruby web framework Sinatra (before 2.2.0). The issue is a path traversal vulnerability where expanded paths are not validated against the public_dir when serving static files, potentially allowing an attacker to view arbitrary files via crafted URLs containing dot-dot s...

CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

Path Traversal

Overview Affected versions of this package are vulnerable to Path Traversal. It is possible to traverse directories to fetch arbitrary files from the server. PoC curl --path-as-is "http://localhost:8888/static/../secret.json" Details A Directory Traversal attack also known as path traversal aims ...

Mail.ru: Unauthorized Access To Admin panel

Access to static files of playerone.ru admin web interface was not sufficiently restricted. There was no possibility to access admin functions. Simple Bypass: Try access playerone.ru/admin/users/ 403 : host playerone.ru 127.0.0.1 Try again 127.0.0.1/admin/users 200 OK :...