Published: 13/11/2018 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

There is a possible XSS vulnerability in Rack prior to 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.

Vulnerable Product	Search on Vulmon	Subscribe to Product
rack project rack
debian debian linux 8.0

Debian Bug report logs - #913005 ruby-rack: CVE-2018-16471: Possible XSS vulnerability in Rack Package: src:ruby-rack; Maintainer for src:ruby-rack is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 5 Nov 2018 20:36 ...

Rack could allow cross-site scripting (XSS) attacks ...

There is a possible XSS vulnerability in Rack before 206 and 1611 Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request` Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack Note that applications using the nor ...

Server code for STRESS

Allosteric Web Repo for website of an allosteric project in Gersten lab All code from DC in code folder Note about potential security vulnerability The current version of this server has a security vulnerability This vulnerability, which is in the rack module, has been classified by GitHub as a moderate severity security vulnerability More information can be found here: https

STRESS A computationally-efficient framework for identifying potential allosteric residues at the protein surface and within the interior The original stress server on AWS is currently down due to AWS settings udpdates We apologize for the inconvenience Note about potential security vulnerability: The current version of this server has a security vulnerability This vulnerabil

CWE-79 https://lists.debian.org/debian-lts-announce/2018/11/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00032.html https://usn.ubuntu.com/4089-1/http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html https://groups.google.com/forum/#%21topic/rubyonrails-security/GKsAFT924Ag https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=913005 https://usn.ubuntu.com/4089-1/https://nvd.nist.gov

CVE-2018-16471

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect