Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Sinatra
(Sinatrarb)| Repositories | https://github.com/sinatra/sinatra |
| #Vulnerabilities | 4 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2022-05-02 | CVE-2022-29970 | Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files. | Debian_linux, Sinatra | 7.5 | ||
| 2022-11-28 | CVE-2022-45442 | Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue. | Debian_linux, Sinatra | 8.8 | ||
| 2018-02-18 | CVE-2018-7212 | An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters. | Sinatra | 5.3 | ||
| 2018-05-31 | CVE-2018-11627 | Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception. | Cloudforms, Sinatra | 6.1 |