Filtered by vendor Sinatrarb Subscriptions
Filtered by product Sinatra Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-11627 2 Redhat, Sinatrarb 3 Cloudforms, Cloudforms Managementengine, Sinatra 2024-08-05 N/A
Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
CVE-2018-7212 2 Microsoft, Sinatrarb 2 Windows, Sinatra 2024-08-05 5.3 Medium
An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
CVE-2022-45442 3 Debian, Redhat, Sinatrarb 6 Debian Linux, Enterprise Linux, Rhel E4s and 3 more 2024-08-03 8.8 High
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
CVE-2022-29970 3 Debian, Redhat, Sinatrarb 7 Debian Linux, Enterprise Linux, Rhel E4s and 4 more 2024-08-03 7.5 High
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.