Most recent entries from all

bdu:2021-01344

BREW-mailcatcher-CVE-2020-8184 — Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

Affected: Homebrew: mailcatcher

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix.

cnvd-2020-52838

EUVD-2026-38303

fkie_cve-2020-8184

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

GHSA-j6w9-fv6q-3q52 — Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

Affected: RubyGems: rack

gsd-2020-8184

OESA-2022-1729 — rubygem-rack security update

Affected: openEuler:20.03-LTS-SP1: rubygem-rack, openEuler:20.03-LTS-SP3: rubygem-rack, openEuler:22.03-LTS: rubygem-rack

Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call. Security Fix(es): Denial of Service Vulnerability in Rack Multipart Parsing(CVE-2022-30122) Possible shell escape sequence injection vulnerability in Rack(CVE-2022-30123) A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.(CVE-2020-8184)

openSUSE-SU-2020:1993-1 — Security update for rmt-server

Security update for rmt-server

RHSA-2020:4366 — Red Hat Security Advisory: Satellite 6.8 release

mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL rack-protection: Timing attack in authenticity_token.rb hibernate-validator: safeHTML validator allows XSS Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS rubygem-rack: hijack sessions by using timing attacks targeting the session id rubygem-secure_headers: limited header injection when using dynamic overrides with user input rubygem-secure_headers: directive injection when using dynamic overrides with user input rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser puppet: Arbitrary catalog retrieval puppet: puppet server and puppetDB may leak sensitive information via metrics API rubygem-rack: directory traversal in Rack::Directory rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names jackson-databind: Lacks certain xbean-reflect/JNDI blocking jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core hibernate-validator: Improper input validation in the interpolation of constraint error messages jackson-databind: Ser…

SUSE-SU-2020:2678-1 — Security update for rubygem-rack

Security update for rubygem-rack

UBUNTU-CVE-2020-8184

Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:16.04:LTS: ruby-rack, Ubuntu:18.04:LTS: ruby-rack, Ubuntu:20.04:LTS: ruby-rack