37 matches found
@daiyu-5577/quickbuild (>=1.2.1, <=2.6.8), @dataunions/default-join-server (>=3.0.0-alpha.1, <=3.0.3) +14 more potentially affected by CVE-2024-43800 via serve-static (>=2.0.0-beta.1, <=2.0.0-beta.2)
serve-static NPM version =2.0.0-beta.1, =1.2.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =2.0.0, =3.0.3, =4.2.0, =0.2.0, =0.0.1, =0.1.0, =0.55.1, =4.89.0, =1.27.20, =5.0.0-beta.1, =4.0.0, =0.2.0, =0.5.16 and more Source cves: CVE-2024-43800 Source advisory: OSV:GHSA-CM22-4G7W-348P...
CVE-2024-43800
creationtimestamp| type| source ---|---|--- 2024-09-10 18:25:08+00:00| seen| https://t.me/cvedetector/5241...
DEBIAN-CVE-2024-43800
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...
AZL-49147 CVE-2024-43800 affecting package reaper for versions less than 3.1.1-13
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...
CVE-2024-43800 vulnerabilities
Vulnerabilities for packages: kubeflow-centraldashboard, sqlpad, argo-workflows, kubeflow-pipelines...
CVE-2024-43800 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, sqlpad, kubeflow-centraldashboard, argo-workflows...
CVE-2024-43800 serve-static affected by template injection that can lead to XSS
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...
CVE-2024-43800 serve-static affected by template injection that can lead to XSS
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...
CVE-2023-43800
Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint /v2/pkgs/tools/installed. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those ...
CVE-2023-43800
CVE-2023-43800 affects the Arduino Create Agent. The vulnerability stems from the endpoint /v2/pkgs/tools/installed, where a user able to issue HTTP requests to the localhost interface or bypass the CORS policy can escalate privileges to the user running the Arduino Create Agent service via a cra...
CVE-2022-43800
creationtimestamp| type| source ---|---|--- 2023-01-01 07:15:45+00:00| seen| https://t.me/cibsecurity/55694...
CVE-2022-43800
To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used...
CVE-2021-43800
creationtimestamp| type| source ---|---|--- 2021-12-06 22:20:53+00:00| seen| https://t.me/cibsecurity/33406...
CVE-2021-43800
Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special...
CVE-2021-43800
CVE-2021-43800 affects Wiki.js (Node.js) prior to version 2.5.254. Affected condition: on Windows, when a storage module with local asset caching (e.g., Local File System or Git) is enabled and no web application firewall strips malicious URLs. The vulnerability allows directory traversal outside...