← Back

Rack Cors Project

rack-cors_project

2 CVEs • 1 product

Products (1)

Click to collapse
Toggle
Rack Cors
rack-cors
2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-18978
3Canonical
DebianRack Cors Project
3Debian Linux
Rack CorsUbuntu Linux
Jun 17, 2026
Nov 14, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in...Show more
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.Show less
CVE-2017-11173
2Debian
Rack Cors Project
2Debian Linux
Rack Cors
May 13, 2026
Jul 13, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the...Show more
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.Show less