Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2022-45442

Sinatra vulnerable to Reflected File Download attack

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat Sinatrarb
Products
Debian Linux Enterprise Linux Rhel E4s and 3 more
CVE-2025-61921

Sinatra has ReDoS vulnerability in ETag header value generation

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Sinatrarb
Products
Sinatra
CVE-2018-7212

rubygem-sinatra: path traversal via backslash characters

An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.

CVSS 3.1 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Microsoft Sinatrarb
Products
Windows Sinatra
CVE-2018-1000119

rack-protection: Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

CVSS 3.0 · 5.9 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat Sinatrarb
Products
Enterprise Linux Satellite Satellite Capsule and 1 more