ruby-grape/grape

ruby-grape/grape

www.ruby-grape.org

Releases85

Frequency2 months 1 week

Last Release9 days ago

Stars10K

An opinionated framework for creating REST-like APIs in Ruby.

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2018-3769NVD↗	= -, <= 1.0.3, < 1.1.0	Jul 5, 2018Thursday, 5 July 2018, 16:29	6.1 MEDIUM	4.3 MEDIUM
ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.
CVE-2013-0175NVD↗	= 0.2.4, = 0.2.0, = 0.1.5, = 0.1.4, = 0.2.2, = 0.2.3, = 0.2.5, = 0.1.2, = 0.1.3, = 0.1.1, = 0.2.1, = 0.1.0	Apr 25, 2013Thursday, 25 April 2013, 23:55	—	7.5 HIGH
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.