https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:36:33 +0000 https://cve.radiocsirt.org/vuln/bdu:2019-00439 bdu:2019-00439 https://cve.radiocsirt.org/vuln/bdu:2019-00439 https://cve.radiocsirt.org/vuln/cnvd-2018-06100 cnvd-2018-06100 https://cve.radiocsirt.org/vuln/cnvd-2018-06100 https://cve.radiocsirt.org/vuln/euvd-2026-71103 EUVD-2026-71103 https://cve.radiocsirt.org/vuln/euvd-2026-71103 https://cve.radiocsirt.org/vuln/fkie_cve-2018-1000119 <p>Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.</p> <p>Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-1000119 https://cve.radiocsirt.org/vuln/ghsa-688c-3x49-6rqj <p><strong>Affected:</strong> RubyGems: rack-protection</p> <p>Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.</p> <p><strong>Affected:</strong> RubyGems: rack-protection</p> <p>Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.</p> https://cve.radiocsirt.org/vuln/ghsa-688c-3x49-6rqj https://cve.radiocsirt.org/vuln/gsd-2018-1000119 gsd-2018-1000119 https://cve.radiocsirt.org/vuln/gsd-2018-1000119 https://cve.radiocsirt.org/vuln/rhsa-2018:1060 <p>pcs: Privilege escalation via authorized user malicious REST call pcs: Debug parameter removal bypass, allowing information disclosure rack-protection: Timing attack in authenticity_token.rb</p> <p>pcs: Privilege escalation via authorized user malicious REST call pcs: Debug parameter removal bypass, allowing information disclosure rack-protection: Timing attack in authenticity_token.rb</p> https://cve.radiocsirt.org/vuln/rhsa-2018:1060 https://cve.radiocsirt.org/vuln/rhsa-2020:4366 <p>mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL rack-protection: Timing attack in authenticity_token.rb hibernate-validator: safeHTML validator allows XSS Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS rubygem-rack: hijack sessions by using timing attacks targeting the session id rubygem-secure_headers: limited header injection when using dynamic overrides with user input rubygem-secure_headers: directive injection when using dynamic overrides with user input rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser puppet: Arbitrary catalog retrieval puppet: puppet server and puppetDB may leak sensitive information via metrics API rubygem-rack: directory traversal in Rack::Directory rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names jackson-databind: Lacks certain xbean-reflect/JNDI blocking jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core hibernate-validator: Improper input validation in the interpolation of constraint error messages jackson-databind: Ser…</p> <p>mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL rack-protection: Timing attack in authenticity_token.rb hibernate-validator: safeHTML validator allows XSS Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS rubygem-rack: hijack sessions by using timing attacks targeting the session id rubygem-secure_headers: limited header injection when using dynamic overrides with user input rubygem-secure_headers: directive injection when using dynamic overrides with user input rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser puppet: Arbitrary catalog retrieval puppet: puppet server and puppetDB may leak sensitive information via metrics API rubygem-rack: directory traversal in Rack::Directory rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names jackson-databind: Lacks certain xbean-reflect/JNDI blocking jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core hibernate-validator: Improper input validation in the interpolation of constraint error messages jackson-databind: Ser…</p> https://cve.radiocsirt.org/vuln/rhsa-2020:4366 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-1000119 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: ruby-rack-protection, Ubuntu:18.04:LTS: ruby-rack-protection</p> <p>Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: ruby-rack-protection, Ubuntu:18.04:LTS: ruby-rack-protection</p> <p>Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-1000119