Ratpack Project Ratpack
6 CVEs affecting Ratpack Project Ratpack. Latest disclosed: 2021-06-29. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-29485 | Critical | 9.9 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE) via a maliciously… |
CVE-2019-17513 | High | 7.5 | 2019-10-18 | An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP c… |
CVE-2021-29479 | High | 7.0 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisonin… |
CVE-2021-29481 | Medium | 6.5 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but s… |
CVE-2021-29480 | Medium | 4.4 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing… |
CVE-2019-11808 | Low | 3.7 | 2019-05-07 | Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can dete… |