Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

sinatra

6 known vulnerabilities (1 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 1 high, 1 medium, 1 low
Registry
RubyGems

Advisories 6

  • Sinatra has ReDoS vulnerability in ETag header value generation

    Affected: fixed in 4.2.0.

  • CVE-2024-21510Medium 5.4

    Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host…

    Affected: fixed in 4.1.0.

  • Sinatra vulnerable to Reflected File Download attack

    Affected: from 3.0, fixed in 3.0.4; from 2.0.0, fixed in 2.2.3.

  • Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

    Affected: fixed in 2.2.0.

  • Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

    Affected: from 2.0.0, fixed in 2.0.2.

  • An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows.

    Affected: from 2.0.0.beta1, fixed in 2.0.1.