CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2019-18978 – Debian Security Advisory 4918-1
https://notcve.org/view.php?id=CVE-2019-18978
14 Nov 2019 — An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format. Se descubrió un problema en la gema rack-cors (también se conoce como Rack CORS Middleware) versiones anteriores a la versión 1.0.4 para Ruby. Permite que un salto de directorio ../ acceda a recursos privados porque la coincidencia de recursos no garantiza que los nombre... • https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-16470 – rubygem-rack: Buffer size in multipart parser allows for denial of service
https://notcve.org/view.php?id=CVE-2018-16470
13 Nov 2018 — There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size. Hay una posible vulnerabilidad de denegación de servicio (DoS) en el analizador multiparte en Rack en versiones anteriores a la 2.0.6. Las peticiones especialmente manipuladas pueden provocar que el analizador multiparte entre en estado patológico, haciendo que... • https://access.redhat.com/errata/RHSA-2019:3172 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-16471 – Ubuntu Security Notice USN-4089-1
https://notcve.org/view.php?id=CVE-2018-16471
13 Nov 2018 — There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable. Hay una po... • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00032.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2017-11173
https://notcve.org/view.php?id=CVE-2017-11173
13 Jul 2017 — Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed. La falta de anclaje en la expresión regular (regex) generada para rack-cors anterior a versión 0.4.1 permite que un sitio de terceros malicioso realice peticio... • http://seclists.org/fulldisclosure/2017/Jul/22 •
CVSS: 5.3EPSS: 10%CPEs: 7EXPL: 0CVE-2015-3225 – rubygem-rack: Potential Denial of Service Vulnerability in Rack normalize_params()
https://notcve.org/view.php?id=CVE-2015-3225
26 Jul 2015 — lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth. Vulnerabilidad en lib/rack/utils.rb en Rack en versiones anteriores a 1.5.4 y 1.6.x anteriores a 1.6.2, tal como se utiliza con Ruby on Rails en versiones 3.x y 4.x y en otros productos, permite a atacantes remotos provocar una denegación de servicio (SystemStackError) a tr... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164173.html • CWE-19: Data Processing Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 1%CPEs: 11EXPL: 0CVE-2013-0183 – rubygem-rack: receiving excessively long lines triggers out-of-memory error
https://notcve.org/view.php?id=CVE-2013-0183
01 Mar 2013 — multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet. multipart/parser.rb de Rack v1.3.x antes de v1.3.8 y v1.4.x antes de v1.4.3 permite a atacantes remotos causar una denegación de servicios (consumo de memoria y accesos fuera de rango) usando un long string en un paquete Multipart HTTP. The update of librack-ruby in DSA-2783-1 also addressed CVE-2... • http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 0CVE-2013-0184 – rubygem-rack: Rack::Auth:: AbstractRequest DoS
https://notcve.org/view.php?id=CVE-2013-0184
01 Mar 2013 — Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings." Vulnerabilidad no especificada en Rack::Auth::AbstractRequest en Rack v1.1.x anterior a v1.1.5, v1.2.x anterior a v1.2.7, v1.3.x anterior a v1.3.9, y v1.4.x anterior a v1.4.4, permite a atacantes remotos provocar una denegación de servicio a través... • http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 25EXPL: 0CVE-2012-6109 – rubygem-rack: parsing Content-Disposition header DoS
https://notcve.org/view.php?id=CVE-2012-6109
01 Mar 2013 — lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header. lib/rack/multipart.rb en Rack anterior a v1.1.4 anterior a v1.1.5, v1.2.x anterior a v1.2.6, v1.3.x anterior a v1.3.7, y v1.4.x anterior a v1.4.2, emplea incorrectamente las expresiones regulares lo que permite a atacantes remotos provocar una denegaci... • http://rack.github.com • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2013-0262 – rubygem-rack: Path sanitization information disclosure
https://notcve.org/view.php?id=CVE-2013-0262
08 Feb 2013 — rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals." rack/file.rb (Rack::File) en Rack v1.5.x anterior a v1.5.2 y v1.4.x anterior a v1.4.5 permite a atacantes acceder a ficheros arbitrarios fuera del directorio raiz mediante una variable de entorno PATH_INFO... • http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.1EPSS: 8%CPEs: 28EXPL: 0CVE-2013-0263 – rubygem-rack: Timing attack in cookie sessions
https://notcve.org/view.php?id=CVE-2013-0263
08 Feb 2013 — Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time. Rack::Sesión::Cookie en rack v1.5.x antes de v1.5.2, v1.4.x antes de v1.4.5, v1.3.x antes de v1.3.10, v1.2.x antes de v1.2.8, antes de v1.1.x y v1.1.6 permite atacantes remotos para adivi... • http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html •