ratpack project records
6 published records for vendor ratpack project.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-312 Cleartext Storage of Sensitive Information1
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)1
- CWE-340 Generation of Predictable Numbers or Identifiers1
- CWE-502 Deserialization of Untrusted Data1
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1
- CWE-807 Reliance on Untrusted Inputs in a Security Decision1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
6 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
36Monitor | CVE-2021-29485No exploit | Remote Code Execution Vulnerability in Session Storageratpack project · ratpack · CWE-502 | High8.8 | — | 2.0% | Jun 29, 2021 |
31Monitor | CVE-2019-17513Proof of concept | An issue was discovered in Ratpack before 1.7.5.ratpack project · ratpack · CWE-74 | High7.5 | — | 2.2% | Oct 17, 2019 |
30Monitor | CVE-2021-29481No exploit | Client side sessions should not allow unencrypted storageratpack project · ratpack · CWE-312 | High7.5 | — | 0.5% | Jun 29, 2021 |
24Monitor | CVE-2021-29479No exploit | Cached redirect poisoning via X-Forwarded-Host headerratpack project · ratpack · CWE-807 | Medium6.1 | — | 0.9% | Jun 29, 2021 |
14Monitor | CVE-2019-11808No exploit | Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom.ratpack project · ratpack · CWE-338 | Low3.7 | — | 1.3% | May 7, 2019 |
12Monitor | CVE-2021-29480No exploit | Default client side session signing key is highly predictableratpack project · ratpack · CWE-340 | Low3.1 | — | 0.3% | Jun 29, 2021 |
- CVE-2021-2948536Monitor
Remote Code Execution Vulnerability in Session Storage
HighCVSS 8.8No exploitEPSS 2%ratpack project · ratpackJun 29, 2021
- CVE-2019-1751331Monitor
An issue was discovered in Ratpack before 1.7.5.
HighCVSS 7.5Proof of conceptEPSS 2%ratpack project · ratpackOct 17, 2019
- CVE-2021-2948130Monitor
Client side sessions should not allow unencrypted storage
HighCVSS 7.5No exploitEPSS 0%ratpack project · ratpackJun 29, 2021
- CVE-2021-2947924Monitor
Cached redirect poisoning via X-Forwarded-Host header
MediumCVSS 6.1No exploitEPSS 1%ratpack project · ratpackJun 29, 2021
- CVE-2019-1180814Monitor
Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom.
LowCVSS 3.7No exploitEPSS 1%ratpack project · ratpackMay 7, 2019
- CVE-2021-2948012Monitor
Default client side session signing key is highly predictable
LowCVSS 3.1No exploitEPSS 0%ratpack project · ratpackJun 29, 2021