Skip to content
OpenAdvisories

Product · Twitter

secure_headers

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.4
    CVE-2020-5216

    Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

    In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leadi…

    Twitter secure_headers secure_headers ruby-secure-headers Debian Ubuntu RubyGems
  • Medium 4.4
    CVE-2020-5217

    Directive injection when using dynamic overrides with user input in RubyGems secure_headers

    In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected lea…

    Twitter secure_headers ruby-secure-headers secure_headers Debian Ubuntu RubyGems