CVE-2019-10770

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects the development mode error handler when an exception message contains untrusted data. Note the production mode error handler is not vulnerable - so for this to be utilized in production it would require users to not disable development mode.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/aio.ratpack:ratpack-coreall versions from 0.9.10 inclusive and before 1.7.6

References

Timeline

Published
Jan 28, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-107716.1Characters in the GET url path are not properly escaped and can be reflected in the server response.CVE-2019-107726.1It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by CVE-2019-107737.8In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using speciaCVE-2019-107749.8php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code executioCVE-2019-107757.5ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.CVE-2019-107769.8In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-difCVE-2019-107779.8In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function wiCVE-2019-107789.8devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The varCVE-2019-107796.1All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An CVE-2019-10785.5An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory. An attacker who sucCVE-2019-107809.8BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.openCVE-2019-107819.8In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used wit
CVE-2019-10770: Medium severity, CVSS 6.1 | Vulnix