https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:06:55 +0000 https://cve.radiocsirt.org/vuln/cve-2018-3760 <p><strong>Affected:</strong> HackerOne Sprockets</p> <p>There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application&#39;s root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.</p> <p><strong>Affected:</strong> HackerOne Sprockets</p> <p>There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application&#39;s root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.</p> https://cve.radiocsirt.org/vuln/cve-2018-3760 https://cve.radiocsirt.org/vuln/ghsa-pr3h-jjhj-573x <p><strong>Affected:</strong> RubyGems: sprockets</p> <p>Specially crafted requests can be used to access files that exist on the filesystem that is outside an application&#39;s root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. ### Workaround: In Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.</p> <p>This work around will not be possible in all hosting environments and upgrading is advised.</p> <p><strong>Affected:</strong> RubyGems: sprockets</p> <p>Specially crafted requests can be used to access files that exist on the filesystem that is outside an application&#39;s root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. ### Workaround: In Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.</p> <p>This work around will not be possible in all hosting environments and upgrading is advised.</p> https://cve.radiocsirt.org/vuln/ghsa-pr3h-jjhj-573x