Vulnerabilities

TI-2020-04272 CVE-2020-5216 · GHSA-w978-rmpf-qmwg

Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

LOW 28

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.01209 Published 2020-01-23 Partial fix · 3.9.0, 5.2.0 +1 CWE-113

TI-2020-04273 CVE-2020-5217 · GHSA-xq52-rv6w-397c

LOW 30

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.0183 Published 2020-01-23 Partial fix · 3.8.0, 5.1.0 +1 CWE-95